XML 149 R43.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Cybersecurity Risk Management
Nokia, along with its partners and contracted third parties, faces
cybersecurity threats like ransomware, viruses, worms and
other malicious software, unauthorized modifications, or illegal
activities that may cause potential security risks and other harm
to Nokia, its customers or consumers and other end-users
of Nokia’s products and services. The dynamic nature of IT
technologies makes it challenging to fully mitigate these risks.
The cybersecurity incidents may lead to lengthy and costly
incident response, remediation of the attack affecting business
continuity, or breach and legal proceedings and fines imposed
on us, as well as adverse effects to our reputation and brand
value. Despite ongoing investments, preventing, detecting and
containing cyber-attacks remain challenging. Additionally, the
cost and operational consequences of implementing further
information system protection measures, especially if
prescribed by national authorities, could be significant. We may
not be successful in implementing such measures in due time,
which could lead to business disruptions. The regulatory
framework around responding to and disclosing such events is
in flux. We may not be able to comply with the regulations that
must be implemented or such compliance may negatively
impact our ability to deal with the underlying event.
We face a number of cybersecurity risks within our business.
Although such risks have not materially affected us thus far,
including our business strategy, results of operations, or financial
condition, we have from time to time experienced threats to
and breaches of our data and systems, including malware and
computer virus attacks. We continue to address these challenges,
but there is no guarantee against future attacks.
Nokia has well-established cybersecurity processes built into its
overall security risk management framework. This integration is
achieved through the implementation of a security program set
on various processes, such as cybersecurity risk management,
third-party security risk management, security incident
management and disaster recovery planning. In evaluation of
the effectiveness of our cybersecurity processes and their
alignment with the industry best practices, we have engaged
and may engage in the future with third party advisers
and consultants.
The Chief Security Officer, who has the authority to establish
and oversee the Nokia information security program, keeps
Nokia’s executive leadership informed on program outcomes
and highlights information security risks which may affect Nokia
business and customers. Nokia’s executive leadership provides
direction and support and has the responsibility to execute
the program within their own domains. Key principles are
communicated through the Nokia Information Security Policy,
applicable also to third parties and collaborators and supported
by topical Standard Operation Procedures and guidelines.
Nokia’s security ambition is reflected in the supplier selection
processes, contracts and supplier (re)assessments ensuring
effective security is in place in our supply chain and with our
third-party partners. We are dedicated to adhering to
applicable laws, regulations, contractual commitments, and
industry best practices, including but not limited to ISO 27001,
NIST SP 800 series, the Cloud Security Alliance Control Matrix,
and the Information Security Forum.
Nokia’s cybersecurity incidents are handled in the Security
Incident Management Process, which covers all phases of
incident response, including preparation, identification,
containment, eradication, recovery and post-incident analysis.
Each confirmed cybersecurity-related incident is assessed
against a classification scheme (impact on confidentiality,
integrity and availability of the related asset, urgency, and
priority of the security incident). Significant cybersecurity
incidents are elevated and managed by a cross-functional,
executive management-level team, which is responsible for
making the necessary decisions and prioritizing actions that can
minimize the impact of the security incident to Nokia and its
customers. Members from the CFO and Legal, Compliance &
Sustainability teams are responsible for determining the
materiality of the security incident and promptly informing the
Audit Committee of the Board. The Nokia management team
for assessing and managing cybersecurity threats includes
members with training and experience in security risk
management, security governance, cyber resilience, security
incident management, information technology, cybersecurity
legal and compliance requirements and disclosures. For an
overview of the training and experience of the members of the
Board and our assessment of their experience and skills related
to cybersecurity, please see “Main corporate governance
bodies of Nokia—Board of Directors”.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Nokia has well-established cybersecurity processes built into its
overall security risk management framework. This integration is
achieved through the implementation of a security program set
on various processes, such as cybersecurity risk management,
third-party security risk management, security incident
management and disaster recovery planning. In evaluation of
the effectiveness of our cybersecurity processes and their
alignment with the industry best practices, we have engaged
and may engage in the future with third party advisers
and consultants.
The Chief Security Officer, who has the authority to establish
and oversee the Nokia information security program, keeps
Nokia’s executive leadership informed on program outcomes
and highlights information security risks which may affect Nokia
business and customers. Nokia’s executive leadership provides
direction and support and has the responsibility to execute
the program within their own domains. Key principles are
communicated through the Nokia Information Security Policy,
applicable also to third parties and collaborators and supported
by topical Standard Operation Procedures and guidelines
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Board oversight of cybersecurity
Nokia group-level security is set up in four domains: product,
service, information, and customer security. While the oversight
of the security risks and their management, including
cybersecurity, is a Board level responsibility in the Company,
the detailed reviews of the different security domains are
allocated to the Committees of the Board. These Committees
are responsible for monitoring and assessing the security,
including cybersecurity-related risks and reporting to the Board
in their respective areas of responsibilities. The responsibilities
of the Audit Committee include oversight of the management
and processes related to the IT and services security risks and
maturity, including security-related controls, compliance,
incident process, disclosures and risk management. The
Technology Committee oversees the product and customer
security risk management. The Committees report to the
Board on a regular basis and prepare recommendations to the
Board, whenever deemed necessary. The Board also receives
regular updates on cybersecurity.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] the detailed reviews of the different security domains are
allocated to the Committees of the Board. These Committees
are responsible for monitoring and assessing the security,
including cybersecurity-related risks and reporting to the Board
in their respective areas of responsibilities. The responsibilities
of the Audit Committee include oversight of the management
and processes related to the IT and services security risks and
maturity, including security-related controls, compliance,
incident process, disclosures and risk management. The
Technology Committee oversees the product and customer
security risk management. The Committees report to the
Board on a regular basis and prepare recommendations to the
Board, whenever deemed necessary
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] These Committees
are responsible for monitoring and assessing the security,
including cybersecurity-related risks and reporting to the Board
in their respective areas of responsibilities. The responsibilities
of the Audit Committee include oversight of the management
and processes related to the IT and services security risks and
maturity, including security-related controls, compliance,
incident process, disclosures and risk management. The
Technology Committee oversees the product and customer
security risk management. The Committees report to the
Board on a regular basis and prepare recommendations to the
Board, whenever deemed necessary. Significant cybersecurity
incidents are elevated and managed by a cross-functional,
executive management-level team, which is responsible for
making the necessary decisions and prioritizing actions that can
minimize the impact of the security incident to Nokia and its
customers. Members from the CFO and Legal, Compliance &
Sustainability teams are responsible for determining the
materiality of the security incident and promptly informing the
Audit Committee of the Board. The Nokia management team
for assessing and managing cybersecurity threats includes
members with training and experience in security risk
management, security governance, cyber resilience, security
incident management, information technology, cybersecurity
legal and compliance requirements and disclosures.
Cybersecurity Risk Role of Management [Text Block] Significant cybersecurity
incidents are elevated and managed by a cross-functional,
executive management-level team, which is responsible for
making the necessary decisions and prioritizing actions that can
minimize the impact of the security incident to Nokia and its
customers. Members from the CFO and Legal, Compliance &
Sustainability teams are responsible for determining the
materiality of the security incident and promptly informing the
Audit Committee of the Board. The Nokia management team
for assessing and managing cybersecurity threats includes
members with training and experience in security risk
management, security governance, cyber resilience, security
incident management, information technology, cybersecurity
legal and compliance requirements and disclosures. For an
overview of the training and experience of the members of the
Board and our assessment of their experience and skills related
to cybersecurity, please see “Main corporate governance
bodies of Nokia—Board of Directors”.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Significant cybersecurity
incidents are elevated and managed by a cross-functional,
executive management-level team, which is responsible for
making the necessary decisions and prioritizing actions that can
minimize the impact of the security incident to Nokia and its
customers. Members from the CFO and Legal, Compliance &
Sustainability teams are responsible for determining the
materiality of the security incident and promptly informing the
Audit Committee of the Board. The Nokia management team
for assessing and managing cybersecurity threats includes
members with training and experience in security risk
management, security governance, cyber resilience, security
incident management, information technology, cybersecurity
legal and compliance requirements and disclosures.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] with training and experience in security risk
management, security governance, cyber resilience, security
incident management, information technology, cybersecurity
legal and compliance requirements and disclosures.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Nokia’s cybersecurity incidents are handled in the Security
Incident Management Process, which covers all phases of
incident response, including preparation, identification,
containment, eradication, recovery and post-incident analysis.
Each confirmed cybersecurity-related incident is assessed
against a classification scheme (impact on confidentiality,
integrity and availability of the related asset, urgency, and
priority of the security incident). Significant cybersecurity
incidents are elevated and managed by a cross-functional,
executive management-level team, which is responsible for
making the necessary decisions and prioritizing actions that can
minimize the impact of the security incident to Nokia and its
customers. Members from the CFO and Legal, Compliance &
Sustainability teams are responsible for determining the
materiality of the security incident and promptly informing the
Audit Committee of the Board
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true