Finnish Transport and Communications Agency Cybersecurity Framework
Technical standards and requirements for cybersecurity in transportation and communications systems, including AI applications. Mandates security assessments for critical infrastructure, establishes incident reporting requirements, and provides guidelines for secure AI deployment in transportation systems.
| Jurisdiction | Finland |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Finnish Transport and Communications Agency (Traficom) Cybersecurity Framework establishes several key requirements for transportation and communications systems:
- Mandatory cybersecurity assessments for critical infrastructure using the Cybermeter national assessment framework. Organizations must evaluate their cybersecurity capabilities across 10 domains and share results confidentially with Traficom.
- Incident reporting requirements for cybersecurity events affecting critical systems. Organizations must report incidents to the National Cyber Security Centre Finland using their online reporting form or email.
- Implementation of basic cyber hygiene practices as outlined in Traficom's recommendation on cybersecurity risk management measures. This includes measures like multi-factor authentication, timely security updates, and network traffic security.
- Secure AI deployment guidelines for transportation systems, though specific requirements are still being developed as part of the ongoing NIS2 directive implementation.
Compliance Challenges
Organizations face several challenges in complying with the Traficom Cybersecurity Framework:
- Complexity of assessment frameworks: The Cybermeter framework covers 10 domains with multiple practices in each, making comprehensive self-assessment difficult for many organizations.
- Rapidly evolving threat landscape: As noted in Traficom's Strengthening cyber security at Finnish organisations guide, the cyber threat environment changes quickly, requiring constant vigilance and adaptation.
- Resource constraints: Implementing robust cybersecurity measures across complex transportation and communications systems requires significant financial and human resources, which can be challenging for smaller organizations.
Implementation Best Practices
To effectively implement the Traficom Cybersecurity Framework, organizations should:
- Conduct regular self-assessments using the Cybermeter tool to identify gaps and prioritize improvements.
- Implement the basic cyber hygiene practices outlined in Traficom's Strengthening cyber security at Finnish organisations guide, including multi-factor authentication and regular security updates.
- Develop and test incident response plans, including procedures for reporting to the National Cyber Security Centre Finland.
- Utilize resources like the NIST Cybersecurity Framework to complement Traficom's requirements and establish a comprehensive cybersecurity program.
Recent Updates
- In January 2024, Traficom announced the preparation of a new recommendation on cybersecurity risk management measures aligned with the NIS2 directive.
- The recommendation is expected to be published in summer 2024, following parliamentary processing of the NIS2 legislative package.
- Organizations should prepare for the NIS2 legislative package to enter into force in autumn 2024, with new requirements becoming mandatory at that time.
Related Regulations
- NIS2 Directive: The EU-wide cybersecurity directive that forms the basis for many of Traficom's new cybersecurity requirements.
- Radio Equipment Directive (RED): Starting August 1, 2025, new information security requirements will apply to radio equipment in the EU market, overlapping with some Traficom cybersecurity measures.
- Cyber Resilience Act: An upcoming EU regulation that will set new requirements for connected devices and services, complementing Traficom's cybersecurity framework.
Industry Impact
The Traficom Cybersecurity Framework has significant impacts on the transportation and communications industries:
- Increased cybersecurity investments: Organizations must allocate more resources to cybersecurity measures, assessments, and reporting to comply with the framework.
- Enhanced incident response capabilities: The incident reporting requirements drive improvements in detection, analysis, and response to cybersecurity events.
- Standardization of security practices: The framework promotes a more consistent approach to cybersecurity across the industry, potentially improving overall resilience.
Sources
- Cybermeter National Framework User Guide
- Traficom NIS2 Recommendation Announcement
- Strengthening Cyber Security at Finnish Organisations Guide
- NIST Cybersecurity Framework 2.0
- National Cyber Security Centre Finland Services
- Traficom Cybersecurity Label Announcement
Recent developments
- — From 2026-09-11, manufacturers must report actively exploited vulnerabilities and severe security incidents to Traficom within 24 hours of becoming aware of them. This is likely to have operational impact on transportation technology suppliers using connected devices and software. [6] (source)
- — From 2026-06-11, conformity assessment bodies can apply in Finland to be notified for CRA assessment tasks. This expands the national compliance ecosystem and is relevant for regulated manufacturers and testing bodies. [6] (source)
- — Finland’s national act on cyber resilience entered into force, creating new product-security obligations and a reporting channel to Traficom. Manufacturers must report actively exploited vulnerabilities and severe incidents from 2026-09-11, and full CRA applicability begins in 2027. [6] (source)
- — Finland approved national provisions supplementing the EU Cyber Resilience Act, with entry into force on 2026-06-01. The rules add procedures for smart devices/software cybersecurity and extend domain-name data obligations, directly affecting Traficom’s oversight role. [7] (source)
- — The deadline for Traficom’s cybersecurity grant application was 2025-10-16 at 16:15 EEST. The application window’s close indicates the move from policy design to funded implementation, with awards targeted to eligible Finnish SMEs. [1] (source)
- — Finland was among the countries flagged by the European Commission for failing to fully transpose NIS2 by late 2024. The notice underscored regulatory pressure on Finland to complete implementation and likely accelerated domestic policy work. [4] (source)
- — Traficom’s National Cyber Security Centre launched a EUR 2 million funding programme for Finnish microenterprises and SMEs to strengthen cybersecurity. The programme opened for applications in 2025 and supports projects implemented in 2026, showing a practical policy push to raise compliance readiness in the market. [1] (source)
- — The Ministry of Transport and Communications proposed a permanent EUR 4.7 million annual funding increase from 2026 for cyber security strategy measures. The money is intended to support the National Cyber Security Centre (Traficom) and related urgent priorities, signaling stronger long-term implementation capacity. [3] (source)
- — Finland’s National Cybersecurity Act implementing NIS2 entered into force, establishing minimum cybersecurity risk-management measures for operators. The Act also set deadlines for risk-management operating models and incident notification, creating immediate compliance obligations for transportation and other sectors. [10] (source)
- — Traficom said it was preparing a recommendation on cybersecurity risk-management measures under NIS2. This was an early policy-development step that helped define the framework operators would later need to follow. [8] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: NIST CSF Complete Bundle (cyberpolicy.shop)
- Build it yourself: NIST CSF 2.0 Self-Assessment Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates