FinlandKyberturvallisuuslaki, Cybersecurity Risk-Management Measures and Governance
Kyberturvallisuuslaki (124/2025), 3 ja 7-10 §
In force since .
A sector security regimes rule binding public and private bodies.
- Obligation class
- Security, Governance
What it requires
- This binds you if you carry out an Annex I or Annex II activity and meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC, or, regardless of size, if you are a public electronic communications network or service provider, a trust service provider, a top-level-domain registry operator, a DNS service provider, or a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025); an online marketplace, online search engine or online social-networking platform named in Annex II is reached as such, and the wider Annex I and Annex II sector classes are reached by declaring that you are an essential or important entity.
- Identify, assess and manage the risks to the network and information systems you use in your operations or to provide your services, and act to prevent or minimise an incident's impact on your operations, their continuity, the recipients of your services and other services.NIST CSF 2.0ID.RA-05NIST CSF 2.0ID.RA-06
- Maintain a documented cybersecurity risk-management operating model covering at minimum: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of your direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources.NIST CSF 2.0GV.PO-01
- Have your board, supervisory board or chief executive approve and oversee this operating model; they must hold sufficient familiarity with cybersecurity risk management to do so.NIST CSF 2.0GV.RR-01NIST CSF 2.0PR.AT-02
- The public administration sector named in NIS2 Annex I point 10 is carved out of this Act's own scope and governed instead by the Act on Information Management in Public Administration (906/2019), a different Finnish instrument.
These lines are LexLint's reading of the law's text. Also read by: Kyberturvallisuuskeskus (NCSC-FI), Liikenne- ja viestintävirasto Traficom (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- NIST CSF 2.0
- GV.RR-01Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving
- GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
- ID.RA-05Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- PR.AT-02Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind
- CIS Controls
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
The Act's own sanction for a Section 7, 8, 9, 11, 12, 13 or 41 breach is the administrative penalty in Sections 35 to 40; the Act creates no criminal offence for it.
Penalty structure
Section 38 sets the maximum administrative penalty for an essential entity's breach at EUR 10,000,000 or 2 percent of worldwide annual turnover in the preceding financial year, whichever is higher, and the maximum for any other bound entity at EUR 7,000,000 or 1.4 percent, mirroring NIS2 Article 34(4) and (5). Section 35 excludes state authorities, state enterprises, wellbeing regions and joint authorities, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President, and the Evangelical Lutheran and Orthodox Churches of Finland and their parishes from the penalty entirely.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
Liikenne- ja viestintävirasto (Traficom), the Act's Section 26 supervisory authority for Annex I items 1 to 7 (transport, space ground infrastructure, digital infrastructure and ICT service management) and Annex II items 1 to 5 (postal and courier services, digital service providers including the online marketplace, search engine and social-networking-platform providers flagged here, motor-vehicle and other transport-equipment manufacturing, and research organizations that pursue applied research for commercial use); the Act designates six further sector authorities for its other Annex I and II classes, and a seventh from .
Settledness
- As of
- Guidance link
- https://kyberturvallisuuskeskus.fi/fi/toimintamme/saantely-ja-valvonta/nis-2-euroopan-unionin-kyberturvallisuusdirektiivi
- Guidance body
- Kyberturvallisuuskeskus (NCSC-FI), Liikenne- ja viestintävirasto Traficom
- Open questions
- Does the Act on Information Management in Public Administration (906/2019) impose risk-management duties on Finland's public administration sector equivalent to Kyberturvallisuuslaki Sections 7 to 10, given Section 1 excludes that sector from this Act's own scope and points to the other Act instead?
What this law does
Sections 7 to 10 of the Kyberturvallisuuslaki require an entity within scope to identify, assess and manage the risks to the network and information systems it uses in its operations or to provide its services, and to act to prevent or minimise an incident's impact on its operations, their continuity, the recipients of its services and other services (Section 7).
The entity must maintain a documented cybersecurity risk-management operating model (Section 8) whose management measures cover, at minimum, the twelve areas Section 9 lists: risk-management policy and effectiveness assessment; network and information system security policy; security in acquisition, development and maintenance, including vulnerability handling and disclosure; supply-chain security, covering the quality and resilience of direct suppliers' products and services and their cybersecurity practices; asset management and identification of security-critical functions; personnel security and cybersecurity training; access-control and authentication procedures; cryptography policy and, where needed, measures for secured electronic communication; incident detection and handling; backup, recovery planning, crisis management and business continuity; basic information-security practices; and security of the physical environment and premises and of essential resources (Section 9).
The entity's board, supervisory board or chief executive is responsible for organising the implementation and oversight of this risk management, approves the operating model, and must hold sufficient familiarity with cybersecurity risk management (Section 10).
Liikenne- ja viestintävirasto (Traficom) is the supervisory authority for Annex I items 1 to 7, covering transport, space ground infrastructure, digital infrastructure and ICT service management, and for Annex II items 1 to 5, covering postal and courier services, digital service providers (including the online marketplace, online search engine and online social-networking-platform providers flagged here), motor-vehicle and other transport-equipment manufacturing, and research organizations that pursue applied research for commercial use; the Act designates six further sector authorities for its other Annex I and II classes, and a seventh from .
An intentional or grossly negligent failure of the Section 7, 8 or 9 duties is subject to an administrative penalty of up to EUR 10,000,000 or 2 percent of worldwide annual turnover for an essential entity and up to EUR 7,000,000 or 1.4 percent for any other bound entity (Section 38), mirroring NIS2 Article 34(4) and (5), though Section 35 exempts state authorities, state enterprises, wellbeing regions and joint authorities, municipal authorities, independent public-law institutions, parliamentary agencies, the Office of the President, and the Evangelical Lutheran and Orthodox Churches of Finland and their parishes from the penalty itself, without exempting them from the underlying duty.
Beyond the entities that meet or exceed the medium-enterprise thresholds of Commission Recommendation 2003/361/EC while carrying out an Annex I or Annex II activity, Section 3 binds a narrower set of entities regardless of size: a provider of public electronic communications networks or publicly available electronic communications services, a trust service provider, a top-level-domain registry operator, a DNS service provider, and a critical entity designated outside the public administration sector under the Act on Protecting and Improving the Resilience of Critical Infrastructure (310/2025).
Section 1 excludes the public administration sector named in NIS2 Annex I point 10 from this Act's own scope, assigning that sector instead to the Act on Information Management in Public Administration (906/2019), a different Finnish instrument.
When LexLint raises it
When your app profile says your app runs an essential service, operates a social platform or provides telecom services.
Back to the example · Lint your app
Page updated .