Companies have many ways of protecting critical infrastructure

Companies can use fairly simple methods to improve the protection of their critical infrastructure. Access control, locks and monitoring systems, both physical and digital, are the primary factors that companies critical to security of supply must take especially seriously in the current security situation.

Securing the operations also requires that the risks of all factors of the continuity of business have been identified and continuity management has been planned. The National Emergency Supply Agency (NESA) cooperates closely with the authorities and the private sector and produces a situational picture of security of supply regularly with the help of its extensive network.

Earlier this week, NESA instructed companies critical to security of supply to raise their level of preparedness with regard to critical infrastructure in particular. This is due to a change in the security situation in connection with the damage to the Balticconnector gas pipeline. The last time this was done was in 2022 when Russia attacked Ukraine.

Ensuring the continuity of operations in case of different kinds of disturbances benefits the company in particular, but with regard to the critical infrastructure, it is also strongly linked to the best interests of society. Critical infrastructure includes the basic structures and services necessary to maintain the vital functions of society as well as the related functions.

– In Finland, most of the critical infrastructure is owned by the private sector. The state does not have a backup system; instead, the critical functions, such as the supply of food and energy, logistics and telecommunications, must function in all circumstances. This requires deep and confidential cooperation between companies and public operators, and fortunately, this cooperation has been ongoing here for a long time, says Jaakko Pekki, the director of the NESA’s Operations Department.

NESA has increased the frequency of the cycle of compiling a situational picture. Now the situational picture is compiled weekly for the sectors critical to security of supply, meaning energy supply, food supply, the financial sector, logistics, critical industry and health care as well as the digital, media and private security sectors.

All organisations are responsible for protecting their own physical and digital infrastructure. In addition, the threshold of reporting observations on critical infrastructure to the authorities should be kept low.

– Right now, it is especially important to ensure that the organisation’s cyber security, physical security as well as continuity management and security management are on a good level as a whole. In addition, you should keep your eyes open and the threshold of reporting observations of anything abnormal low, Pekki says.

General preparedness measures recommended for companies

Companies should prepare to ensure the continuity of the operation of key critical services and infrastructure at a heightened level.

1. Check the access control, locks, monitoring and physical protection of physical sites and take any other measures required depending on the needs of the site
2. Check the protective measures and incident management practices of the cyber security and critical core functions of the business in particular
3. Ensure sufficient backup telecommunications connections for critical operations from the perspective of tolerance of disturbances
4. Ensure the energy supply of critical operations by means such as ensuring the availability of replacement energy sources and reviewing the ability of functions to tolerate interruptions in energy supply
5. Check the organisation’s preparedness and continuity management measures and plans
6. Encourage the personnel to stay alert and ensure that the employees receive up-to-date information
7. Keep the threshold of reporting observations to the authorities and the network low to obtain an overall situational picture and start possible support measures, if necessary