TIETO22 to test cooperation in the event of a large-scale payment transaction disruption

“The financial sector plays a critical role in our society by managing, among other things, payment transactions – in practice, all companies are dependent on its continued operation. The operations of the financial sector are almost fully digitalised, so the need to prepare for cyberthreats is constant,” says the project manager of the exercise, Antti Nyqvist, from the Digital Pool.

In the financial sector, preparedness has traditionally been at a good level, which was also proven in the sector’s own FATO exercise organised in autumn 2021. However, in the digital world, change is constant and rapid, and disruptions are quick to spread. In recognition of this, the TIETO exercise will focus not only on the preparedness of individual participants, but also their cooperation with other companies in the sector and the authorities. This cooperation improves preparedness for various threats targeting supply and service chains.

There will be a total of approximately 120 organisations participating in the TIETO22 exercise. In addition to financial sector organisations, the participants will also include companies from other sectors critical to security of supply, the key telecommunications and ICT service providers of these sectors, the security sector and the media sector. Also participating in the preparation of the exercise are the authorities and ministries governing these sectors, the National Emergency Supply Agency, Traficom’s National Cyber Security Centre, the police and the Finnish Defence Forces.

Valuable lessons about cyber and information security and cooperation in crisis situations

TIETO22 will consist of training days organised during spring 2022 and exercises assigned to participants. The lessons learned from these will be put to the test in September in a three-day role-playing game, in which participants will tackle a fictional large-scale cybersecurity incident affecting the financial sector, practicing cooperation and information sharing in a crisis situation in particular.

“During the spring, we will be going over all the things that you need to prepare for in the digital world. Examples of threats include various types of malware, ransomware and information-based influencing. Another important theme will be cooperation within supply chains and with the authorities. Cooperation between the authorities and companies is, in fact, one of the particular strengths of the Finnish system,” Nyqvist explains.

The TIETO22 exercise supports companies’ continuity management and preparedness and develops contract-based cooperation. The goals of the exercise include developing cooperation-based operating culture and cooperation models and identifying concrete cybersecurity development needs that can then be addressed in the National Emergency Supply Agency’s Digital Security 2030 programme, for example.

TIETO exercises are organised every other year by the National Emergency Supply Organisation’s Digital Pool. They have been held in various forms in Finland since the late 1970s.