The Electronic Communications Office of Iceland (ECOI) carries out audits and testing to assess whether telecommunications companies and operators of critical digital infrastructure meet the requirements of laws and regulations. The aim is to obtain a clear picture of the state of security and identify where improvements are needed.
The scope of audits and testing is determined based on risk and prioritization. In that assessment, consideration is given to available resources, such as time, personnel and funding.
When assessing
security arrangements and risk management, ECOI must, among other things, ensure that telecommunications services are secure and uninterrupted. Consideration is also given to public interest and national security in accordance with the Electronic Communications Act.
ECOI applies different methods in its monitoring, depending on what is appropriate in each case. This may include, for example:
review of documents and data
interviews with key staff
on-site inspections and visits
An audit may be based on one or more methods. This depends on the scope of the case and what is being assessed.
A desk-based audit involves the Electronic Communications Office of Iceland (ECOI) reviewing documents and other information. This type of review often forms the basis for further assessment.The documents reviewed may include:
security policies and related documentation
risk assessments and selected and implemented security measures
contingency plans and incident response plans
information on employee roles and responsibilities
procedures and work instructions
descriptions of system design and architecture
results of internal testing and external audits
This review gives the Electronic Communications Office an overview of how cybersecurity is organised, documented and implemented by the organisation.
Interviews are one of the methods used by the Electronic Communications Office of Iceland (ECOI) in supervision. They may be conducted on their own or alongside a desk-based audit.
Interviews can provide more detailed information about processes, procedures and challenges. They may highlight issues that are not always clearly reflected in documentation.
The number of interviewees depends on the size of the organisation and how responsibilities for networks and information systems are distributed among staff.
An on-site inspection involves visiting a location, such as systems, data centers or equipment rooms, to verify that security measures are in place and operating as intended.
On-site inspections make it possible to confirm elements that are not always visible in documentation or interviews, such as access controls, physical security, equipment and how procedures are carried out in practice.
The inspection may be conducted by staff from the Electronic Communications Office of Iceland (ECOI) or by external experts working on its behalf.
Technical testing is used to verify that security measures work as intended. Examples of such testing include vulnerability scanning and penetration testing.
What is tested is determined based on:
the current state of cybersecurity at the organization
the results of self-assessments and audits
previous testing
investigations of security incidents
Vulnerability scanning is used to identify weaknesses in systems, equipment and procedures. These may include:
technical vulnerabilities in hardware or software
lack of appropriate procedures
misconfigured or outdated systems
In penetration testing, the tester attempts to bypass security measures using methods similar to those of an attacker. The aim is to assess whether it is possible to:
breach security measures
identify vulnerabilities that could be exploited
determine whether disruption or interruption of services is possible
Testing is usually carried out in coordination with the company or operator. This supports transparency, security and effective follow-up of the results.
The Electronic Communications Office of Iceland (ECOI) uses a standardised assessment method and scoring system when evaluating security at telecommunications companies and operators of digital infrastructure. This allows results to be compared in a clear and consistent way.
A standardised approach helps ECOI gain a better overview of the overall security posture and ensures that the same criteria apply to all entities subject to supervision.
Audits and testing focus on the areas of highest risk. This means that not all requirements set out in laws or standards are always assessed, but rather the aspects that are most important in each case. For example, an assessment may focus on compliance with provisions in cybersecurity legislation on organisational measures. These provisions are divided into five defined assessment areas.
Scores are based on predefined criteria and are used to provide a clear overview and enable comparison of results.
The table below shows what scores from 0 to 3 represent.
Score
Explanation
Score 3 (3.00)
No non-conformities were identified during the inspection. Assessment areas, control items and/or criteria are met. The management system and/or security measure has been established and complies with minimum requirements.
No action is required by the Electronic Communications Office of Iceland (ECOI).
Score 2 (2.00–2.99)
A minor non-conformity was identified during the inspection. Security measures and documentation are in place and implemented, but the inspection identified opportunities for improvement that must be addressed before the next ECOI audit.
ECOI issues binding instructions.
Score 1 (1.00–1.99)
A non-conformity was identified during the inspection. Security measures and/or documentation are in place but not fully implemented. The results require corrective action within six months.
ECOI issues binding instructions.
Score 0 (0.00–0.99)
A serious non-conformity was identified during the inspection. It is not possible to confirm that security measures are in place. The results require corrective action within three months.
