Current information for Elisa’s corporate customers

1. Identify the processes and services that are critical to your business. What will happen if they are disrupted? Also consider the technical processes and dependencies that affect the performance of critical business processes.

2. Ensure that your organisation has sufficient resources to carry out critical functions even in an exceptional situation. In particular, the most critical functions should be secured. This applies not only to your own personnel but also to partners and subcontractors: now is a good opportunity to ensure that partners’ capabilities are up to date.

3. Ensure the adequacy and functionality of security controls for the most critical activities. For example, the update practices and vulnerability management should be reviewed. It is also important to pay attention to the security of physical premises.

4. Limit your exposure to cyber-attacks:

• Multi-factor authentication (MFA) should be required, especially for services visible to the public network.
• Install the latest security updates without delay, unless this causes a separate disruption to the service.
• Pay particular attention to remote access solutions. Ensure that no external can access your organisation’s environment through them.

5. Maintain backups for key systems. For example, in a ransomware attack, backups may be the only way to restore critical data. Prioritize systems/services according to their business criticality, e.g., AD environment and CRM systems, and ensure that your recovery mechanisms and procedures work.

6. Ensure that you are prepared for exceptional situations. Maintain adequate detect and response capabilities to protect critical resources and to ensure business continuity. Make sure your personnel’s wellbeing and that they have adequate rest breaks.

7. Ensure that plans and responsibilities are up to date. Update continuity plans, especially for the most critical business processes, and recovery plans for the technical processes that support them. In addition, check with potential partners whether their responsibilities are still valid and update the contracts.

8. Build a culture and know-how of security in your organisation. Your personnel should have sufficient knowledge of the procedures to be followed in an exceptional situation. Who should be contacted if the situation requires further action or reporting? Who will help in case of problems? Practise regularly for phishing situations, for example. Communicate security issues openly to the personnel and build trust.