Handling of classified documents in cloud computing services

Abstract

This recommendation of the Information Management Board on the handling of classified documents in cloud computing services supplements the previous recommendation on the handling of documents that are subject to security classification (Ministry of Finance 2021:5). These two recommendations offer guidance on how to meet the requirements of section 18 of the Act on Information Management in Public Administration (906/2019) and the Government Decree on Security Classification of Documents in Central Government (1101/2019). It is recommended that information management units select a cloud computing service based on use cases and on the information management and information security requirements specified for the classified information materials handled in the service. To manage the risks associated with cloud computing services, it is recommended that information management units use services or providers that have undergone facility security clearances under the Security Clearance Act or that have been granted a certificate of conformity with security requirements referred to in the provisions regarding information security assessment.

The Information Management Board approved the recommendation on 13 December 2021.