Kyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance

Sections 7 to 10 of the Kyberturvallisuuslaki require an entity within scope to identify, assess and manage the risks to the network and information systems it uses in its operations or to provide its services, and to act to prevent or minimise an incident's impact on its operations, their continuity, the recipients of its services and other services (Section 7).

The entity must maintain a documented cybersecurity risk-management operating model (Section 8) whose management measures cover, at minimum, twelve areas matching NIS2 Article 21(2): risk-management policy and effectiveness assessment; network and information system security policy; supply-chain security, including vulnerability handling and disclosure for direct suppliers and service providers; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic cyber-hygiene practices; and, where appropriate, multi-factor or continuous authentication (Section 9).

The entity's board, supervisory board or chief executive is responsible for organising the implementation and oversight of this risk management, approves the operating model, and must hold sufficient familiarity with cybersecurity risk management (Section 10).

Liikenne- ja viestintävirasto (Traficom) is the supervisory authority for Annex I items 1 to 7, covering transport, digital infrastructure and ICT service management, and for Annex II items 1 to 5, covering postal and courier services and the online marketplace, online search engine and online social-networking-platform digital-service-providers flagged here; the Act designates seven further sector authorities for its other Annex I and II classes.

An intentional or grossly negligent failure of the Section 7, 8 or 9 duties is subject to an administrative penalty of up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity and up to EUR 7,000,000 or 1.4 percent for any other bound entity (Section 38), mirroring NIS2 Article 34(4) and (5), though Section 35 exempts state authorities, state enterprises, wellbeing regions and joint authorities, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President, and the Evangelical Lutheran and Orthodox Churches of Finland and their parishes from the penalty itself, without exempting them from the underlying duty.

Beyond the entities that meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC while carrying out an Annex I or Annex II activity, Section 3 binds a narrower set of entities regardless of size: a provider of public electronic communications networks or publicly available electronic communications services, a trust service provider, a top-level-domain registry operator, a DNS service provider, and a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025).

Section 1 excludes the public administration sector named in NIS2 Annex I point 10 from this Act's own scope, assigning that sector instead to the Act on Information Management in Public Administration (906/2019), a different Finnish instrument not researched here.