Assessment, accreditation and guidance

Assessment and accreditation

NCSA-FI’s duty to assess and accredit the security of information systems arises from the Act on International Information Security Obligations, Act on Background Checks and the Act on the Assessment of the Information Security of Public Authorities' Information Systems and Telecommunications Arrangements.

As for international classified data, NCSA-FI is the national Security Accreditation Authority (SAA), Crypto Approval Authority (CAA), National TEMPEST Authority, and Crypto Distribution Authority (CDA) (or National Distribution Authority, NDA), which is the authority responsible for the distribution of crypto material.

Assessment and accreditation of information systems

Government organisations acquire accreditation service for information systems that are required by international information security obligations (for example processing of EU or NATO information) to have SAA approval. We also provide accreditation for information systems of companies in the process of seeking facility security clearance.

Assessment service is available for information systems governed by government authorities and for systems which government authorities are planning to acquire and on which a government authority has filed a request for accreditation with us. Moreover, we examine, at the Ministry of Finance's request, the general level of information security of information systems or data communications arrangements governed by central authorities.

Further information is available in the guideline on assessment and accreditation process of information systems. List of accredited information security inspection bodies. (External link)

Assessment and accreditation of security products

We provide assessment and accreditation for security products meant for protecting national and international classified information. A key focus area is the assessment and accreditation of encryption products. Further information is available in the guideline on assessment and accreditation of encryption products.

Information security guidance for governmental organisations and critical infrastructure providers

The aim is to prepare organisations for threats in the cyber domain and support clients in securing their operations and systems.
There are two types of information security guidance. One focuses on guidance related to protecting classified information. The other is guidance on more general cyber security issues in society.