What must an information security officer know under the Cybersecurity Act?

In brief

An information security officer must know how the Cybersecurity Act turns cyber risk into daily controls, reporting routines and management evidence. The core competence is risk management: identifying risks to networks and information systems, choosing proportionate measures, and keeping those measures current. The role must also know incident reporting deadlines, continuity planning, supply chain security, encryption, access control, staff training and how management responsibility is documented. The Cybersecurity Act, section 10, makes management responsible, so the information security officer’s job is to make that responsibility visible and workable.

The information security officer must connect the law to everyday systems

The Cybersecurity Act 124/2025, section 1, says the Act concerns the management of cybersecurity risks. It implements the NIS2 Directive (European Union) 2022/2555 in Finland.

For an information security officer, this means the work is not only technical. It is a bridge between legal duties, management decisions and practical systems. A firewall rule, an access right, a backup test and a supplier clause all need to fit the same risk picture.

The Cybersecurity Act, section 7, requires the operator to identify, assess and manage risks to the security of communications networks and information systems used in its operations or services. In plain work terms, you need a way to know which systems matter, what could go wrong, how likely it is, and what the impact would be.

An everyday example is a payroll system. It may contain sensitive data, depend on an external service, and stop salary payments if it fails. The information security officer must be able to show how that risk has been recognised and what has been done to reduce it.

The competence needed is therefore broader than system administration. It includes:

• understanding which services and systems are in scope;
• maintaining a risk management model;
• translating risks into technical, operational and organisational controls;
• preparing incident reporting chains;
• keeping evidence for management, auditors, customers and authorities;
• helping staff understand their part in cyber hygiene.

The subject continues in NIS2 and the Finnish Cybersecurity Act: management training and staff cyber hygiene, especially for the link between management and staff competence.

The competence areas come directly from risk management duties

The Cybersecurity Act, section 8, requires an up-to-date cybersecurity risk management model for protecting networks, information systems and their physical environment from incidents and their effects. The model must define objectives, procedures, responsibilities and management measures.

This is where the information security officer needs structured competence. A risk management model is not just a document. It is the organisation’s operating method for deciding what is protected, by whom, and how.

The Cybersecurity Act, section 9, lists the areas that must be taken into account and kept up to date. NIS2 Directive Article 21 contains the corresponding risk management measures at European Union level.

For the role, the main competence areas are these:

Competence area	What the information security officer must be able to do
Risk analysis and policies	Turn threats, vulnerabilities and business impact into risk-based rules and priorities.
Secure acquisition, development and maintenance	Make security part of buying, building and maintaining systems, including vulnerability handling.
Supply chain security	Assess immediate suppliers and service providers, including their resilience and cybersecurity practices.
Asset management	Know which systems, devices, data and services support important operations.
Staff security and training	Connect people’s daily behaviour to risk management and cyber hygiene.
Access control and authentication	Define who gets access, how identity is checked and how unnecessary rights are removed.
Encryption and secure communications	Know when information must be protected in storage, in transfer and in communications.
Incident detection and handling	Build procedures for detecting incidents and restoring security and operational reliability.
Backup, recovery and continuity	Ensure that recovery planning, crisis management and continuity measures are planned and tested.
Effectiveness assessment	Measure whether controls work, not only whether they exist.

The Cybersecurity Act, section 9, also says measures must be proportionate. In practice, a small internal tool and a critical customer-facing service may not need the same control set. The role must understand proportionality, because over-light controls leave risk untreated and over-heavy controls may be unrealistic.

NIS2 Directive Article 21 also refers to European and international standards when assessing measures. The article does not make one named standard mandatory. It does show why the information security officer benefits from understanding formal security management systems and control frameworks.

Incidents require deadlines, roles and a rehearsed chain

An incident is a cyber event that disrupts, threatens or compromises a service or system. A simple example is ransomware that stops access to files. Another is unauthorised access to an administrator account.

The information security officer must know how to decide whether an incident is significant and how reporting works. The Cybersecurity Act, section 11, defines a significant incident as one that has caused or may cause a serious service disruption or considerable financial losses to the operator. It also covers an incident that has affected or may affect other natural or legal persons by causing considerable material or non-material damage.

The deadlines are strict. Under the Cybersecurity Act, section 11:

• the initial notification must be made within 24 hours of detecting the significant incident;
• the follow-up notification must be made within 72 hours of detecting the significant incident;
• for a trust service provider, the follow-up notification must be made within 24 hours if the significant incident affects the provision of its trust services.

The initial notification must cover the detection of the significant incident, whether it is suspected to result from a crime or another unlawful or hostile act, and the possibility and likelihood of cross-border effects. The follow-up notification must include an assessment of the nature, severity and effects of the incident, technical indicators of compromise if available, and updates to the initial notification.

The Cybersecurity Act, section 12, requires additional information or an interim report if the supervisory authority requests it. If the significant incident is long-running, an interim report must be given no later than one month after the follow-up notification.

The Cybersecurity Act, section 13, requires a final report within one month of submitting the follow-up notification. If the incident is long-running, the final report is due within one month after handling has ended.

This is why incident competence is not only technical forensics. The information security officer must also understand decision points, documentation, escalation, legal reporting, and who can approve communications when time is short. A reporting chain that has never been rehearsed may fail during the first 24 hours.

For a deeper incident view, see What must be reported after a cybersecurity incident, and when?.

Management is responsible, but the information security officer makes responsibility visible

The Cybersecurity Act, section 10, states that management is responsible for arranging implementation and supervision of cybersecurity risk management. Management also approves the cybersecurity risk management model and supervises its implementation.

The same section says management must have sufficient familiarity with cybersecurity risk management. It defines management as the board, supervisory board and chief executive officer, and also a person in a comparable position who actually manages the operator’s activities.

This matters for the information security officer’s competence. The role does not replace management. It enables management to act.

In practice, the information security officer needs to prepare material that management can understand and use. That may mean a risk register, a summary of major untreated risks, incident lessons learned, supplier risk findings, backup test results, or access control exceptions.

Good evidence is practical. It shows what risk was identified, what decision was made, what measure was chosen, who owns it, and when it will be reviewed. Without this, management approval may exist on paper but not as real supervision.

The role must also know how to explain cybersecurity without hiding behind technical terms. For example, “multi-factor authentication” means that a person proves identity in more than one way, such as a password and a phone confirmation. That explanation helps management decide where stronger authentication is needed.

Staff competence is part of risk management

The Cybersecurity Act, section 9, includes staff security and cybersecurity training among the areas that must be taken into account in the risk management model and related controls. NIS2 Directive Article 21 also includes basic cyber hygiene practices and cybersecurity training.

For the information security officer, this means staff training is not a separate awareness campaign with no connection to controls. It is part of risk management.

A finance employee who can recognise a fraudulent payment request reduces one kind of risk. A service desk employee who verifies identity before resetting a password reduces another. A system owner who reports a suspected vulnerability quickly helps incident handling and secure maintenance.

The information security officer must therefore understand what different groups need to know. Management needs enough familiarity to approve and supervise risk management. IT and security roles need deeper skills in risks, incidents, continuity, suppliers, encryption and access control. Other employees need cyber hygiene that matches their work.

The Cybersecurity Act does not state a fixed training length, format or renewal cycle. The important point is that training supports the risk management model and the controls in section 9.

For the staff-level question, see What does the Cybersecurity Act require for staff training?. For a practical training format, see Microlearning at work: why short and repeated beats the training day.

When the duty does not apply, or does not cover all activity

The Cybersecurity Act does not apply to every organisation in the same way. This limit is important because the information security officer must be able to separate real statutory duties from good practice.

The Cybersecurity Act, section 3, applies to a legal person or natural person that carries out an activity referred to in Annex I or II, or is an operator referred to in those annexes, and that meets or exceeds the conditions for medium-sized enterprises under the Commission Recommendation 2003/361/EC, Annex, Article 2, and provides services or carries out activities in a European Union Member State.

The same section also applies regardless of size to certain operators. These include providers of public electronic communications networks or publicly available electronic communications services, trust service providers, top-level domain registries and Domain Name System service providers. Section 3 also covers certain Annex I or II operators regardless of size where the service is central to critical societal or economic functions, where disruption would significantly affect public order, public safety or public health, where disruption could cause significant systemic risk, or where the operator is critical due to particular importance at national or regional level.

Section 4 sets important exclusions. Chapter 2 does not apply to activities or services provided for national defence, national security, public order and safety, or the prevention, investigation and prosecution of criminal offences. The Act does not apply to an operator that provides only those activities or services, except that the Act still applies to a trust service provider.

Section 4 also says the Act does not apply to an operator whose Annex I or II activity is occasional and minor. For municipalities, section 4 says the Act applies only for the activity referred to in Annex I or II.

The practical consequence is that scope analysis is a necessary competence. An information security officer must know which services are covered, which are not, and where a legal assessment is needed. The role should not assume that every department, system or minor side activity is covered in the same way.

Gaps can lead to sanctions

The Cybersecurity Act, section 35, allows an administrative penalty payment if an operator intentionally or through gross negligence neglects specified duties. These include the duty to manage risks under section 7, to prepare the risk management model under section 8, to take account of the section 9 areas as part of that model, to implement the measures referred to in section 9, and to give the incident notification, interim report or final report required by sections 11, 12 and 13.

Section 35 also states that a penalty payment cannot be imposed on state authorities, state enterprises, wellbeing services counties or joint county authorities, municipal authorities, independent public law institutions, Parliament offices, the Office of the President of the Republic, the Evangelical Lutheran Church of Finland or the Orthodox Church of Finland, or their parishes, parish unions and other bodies.

For operators that can receive a penalty payment, section 38 sets maximum amounts. For an essential operator, the maximum is 10,000,000 euros or 2 percent of the operator’s worldwide annual turnover in the previous financial year, whichever is higher. For an operator other than an essential operator, the maximum is 7,000,000 euros or 1.4 percent of the operator’s worldwide annual turnover in the previous financial year, whichever is higher.

The information security officer does not need to treat sanctions as the main reason for cybersecurity. The stronger reason is service continuity and trust. But sanctions show why the competence must be systematic, documented and connected to management decisions.