XML 163 R43.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
 12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] Cybersecurity risk management
Nokia, along with its partners and contracted third parties, faces
cybersecurity threats like ransomware, viruses, worms and
other malicious software, unauthorized modifications, or illegal
activities that may cause potential security risks and other harm
to Nokia, its customers or consumers and other end-users of
Nokia’s products and services. The dynamic nature of IT
technologies, including the introduction of AI technologies,
increase these risks.
Cybersecurity incidents can lead to lengthy and costly incident
response, remediation of the attack affecting business
continuity, or breach and legal proceedings and fines imposed
on Nokia, as well as adverse effects to Nokia’s reputation and
brand value. Despite sustained investments, preventing,
detecting and containing cyber-attacks remain challenging. 
Additionally, the regulatory framework around responding to
and disclosing such events is in flux and we may not be able to
comply with the regulations. 
We face a number of cybersecurity risks within our business.
Although such risks have not materially affected us thus far,
including our business strategy, results of operations, or
financial condition, we have experienced threats to and
breaches of our data and systems, including malware and
computer virus attacks. We continue to address these
challenges, but there is no guarantee against future attacks.
Nokia has well-established cybersecurity processes built into its
overall security risk management framework. This integration is
achieved through the implementation of a security program set on
various processes, such as cybersecurity risk management, third-
party security risk management, security incident management and
business continuity and disaster recovery planning. In evaluation of
the effectiveness of our cybersecurity processes and their
alignment with the industry best practices, we have engaged and
may engage in the future with third party advisers and consultants.
The Chief Security Officer, who has the authority to establish
and oversee the Nokia information security program, keeps
Nokia’s executive leadership informed on program outcomes
and highlights information security risks which may affect Nokia
business and customers. Nokia’s executive leadership provides
direction and support and has the responsibility to execute the
program within their own domains. Key principles are
communicated through the Nokia Information Security Policy,
applicable also to third parties and collaborators and supported
by topical Standard Operation Procedures and guidelines.
Nokia’s commitment to security is reflected in the supplier
selection processes, contracts and supplier (re)assessments
that are designed to ensure effective security is in place in our
supply chain and with our third-party partners. We are dedicated
to adhering to applicable laws, regulations, contractual
commitments, and industry best practices, including but not
limited to ISO 27001, NIST SP 800 series, the Cloud Security
Alliance Control Matrix, and the Information Security Forum.
Nokia’s cybersecurity incidents are handled in the Security Incident
Management Process, which covers all phases of incident
response, including preparation, identification, containment,
eradication, recovery and post-incident analysis. Each confirmed
cybersecurity-related incident is assessed against a classification
scheme (impact on confidentiality, integrity and availability of the
related asset, urgency, and priority of the security incident).
Significant cybersecurity incidents are elevated and managed by
a cross-functional, executive management-level team, which is
responsible for making the necessary decisions and prioritizing
actions that can minimize the impact of the security incident to
Nokia and its customers. Members from the CFO and Legal,
Compliance & Sustainability teams are responsible for determining
the materiality of the security incident and promptly informing the
Audit Committee of the Board.
The Nokia management team for assessing and managing
cybersecurity threats includes members with training and
experience in security risk management, security governance, cyber
resilience, security incident management, information technology,
cybersecurity legal and compliance requirements and disclosures.
These activities are coordinated and overseen by the Chief Security
Officer, who leads the assessment of cybersecurity risks, ensures
the alignment between different functions to assess and manage
the risks and works with the designated risk owners through the
Cyber Risk Council and the Enterprise Risk Management framework.
The Chief Security Officer has extensive cybersecurity expertise,
having held cybersecurity‑related roles since 2012, and holds
undergraduate and post-graduate degrees in Engineering and
professional certifications in cyber security management. The
Cyber Risk Council includes members of our senior management
navi20F-bg_02.jpg
with significant working experience in technology, cybersecurity and
risk management. For an overview of the training and experience of
the members of the Board and our assessment of their experience
and skills related to cybersecurity, please see “Main corporate
governance bodies of Nokia – Board of Directors”.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Nokia has well-established cybersecurity processes built into its
overall security risk management framework. This integration is
achieved through the implementation of a security program set on
various processes, such as cybersecurity risk management, third-
party security risk management, security incident management and
business continuity and disaster recovery planning. In evaluation of
the effectiveness of our cybersecurity processes and their
alignment with the industry best practices, we have engaged and
may engage in the future with third party advisers and consultants.
The Chief Security Officer, who has the authority to establish
and oversee the Nokia information security program, keeps
Nokia’s executive leadership informed on program outcomes
and highlights information security risks which may affect Nokia
business and customers. Nokia’s executive leadership provides
direction and support and has the responsibility to execute the
program within their own domains. Key principles are
communicated through the Nokia Information Security Policy,
applicable also to third parties and collaborators and supported
by topical Standard Operation Procedures and guidelines
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Board oversight of cybersecurity
Nokia group-level security is set up in four domains: product,
service, information, and customer security. While the oversight of
security risks and their management, including cybersecurity, is a
Board level responsibility in the Company, the detailed reviews
of the different security domains are allocated to the
Committees of the Board. These Committees are responsible for
monitoring and assessing security, including cybersecurity-
related risks and reporting to the Board in their respective areas
of responsibilities. The responsibilities of the Audit Committee
include oversight of the management and processes related to
IT and services security risks and maturity, including security-
related controls, compliance, incident process, disclosures and
risk management. The Technology Committee oversees product
and customer security risk management. The Committees
report to the Board on a regular basis and prepare
recommendations to the Board, whenever deemed necessary.
The Board also receives regular updates on cybersecurity.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] the detailed reviews
of the different security domains are allocated to the
Committees of the Board. These Committees are responsible for
monitoring and assessing security, including cybersecurity-
related risks and reporting to the Board in their respective areas
of responsibilities. The responsibilities of the Audit Committee
include oversight of the management and processes related to
IT and services security risks and maturity, including security-
related controls, compliance, incident process, disclosures and
risk management. The Technology Committee oversees product
and customer security risk management. The Committees
report to the Board on a regular basis and prepare
recommendations to the Board, whenever deemed necessary
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] These Committees are responsible for
monitoring and assessing security, including cybersecurity-
related risks and reporting to the Board in their respective areas
of responsibilities. The responsibilities of the Audit Committee
include oversight of the management and processes related to
IT and services security risks and maturity, including security-
related controls, compliance, incident process, disclosures and
risk management. The Technology Committee oversees product
and customer security risk management. The Committees
report to the Board on a regular basis and prepare
recommendations to the Board, whenever deemed necessary.
Significant cybersecurity incidents are elevated and managed by
a cross-functional, executive management-level team, which is
responsible for making the necessary decisions and prioritizing
actions that can minimize the impact of the security incident to
Nokia and its customers. Members from the CFO and Legal,
Compliance & Sustainability teams are responsible for determining
the materiality of the security incident and promptly informing the
Audit Committee of the Board.
The Nokia management team for assessing and managing
cybersecurity threats includes members with training and
experience in security risk management, security governance, cyber
resilience, security incident management, information technology,
cybersecurity legal and compliance requirements and disclosures.
Cybersecurity Risk Role of Management [Text Block] Significant cybersecurity incidents are elevated and managed by
a cross-functional, executive management-level team, which is
responsible for making the necessary decisions and prioritizing
actions that can minimize the impact of the security incident to
Nokia and its customers. Members from the CFO and Legal,
Compliance & Sustainability teams are responsible for determining
the materiality of the security incident and promptly informing the
Audit Committee of the Board.
The Nokia management team for assessing and managing
cybersecurity threats includes members with training and
experience in security risk management, security governance, cyber
resilience, security incident management, information technology,
cybersecurity legal and compliance requirements and disclosures.
These activities are coordinated and overseen by the Chief Security
Officer, who leads the assessment of cybersecurity risks, ensures
the alignment between different functions to assess and manage
the risks and works with the designated risk owners through the
Cyber Risk Council and the Enterprise Risk Management framework.
The Chief Security Officer has extensive cybersecurity expertise,
having held cybersecurity‑related roles since 2012, and holds
undergraduate and post-graduate degrees in Engineering and
professional certifications in cyber security management. The
Cyber Risk Council includes members of our senior management
navi20F-bg_02.jpg
with significant working experience in technology, cybersecurity and
risk management. For an overview of the training and experience of
the members of the Board and our assessment of their experience
and skills related to cybersecurity, please see “Main corporate
governance bodies of Nokia – Board of Directors”.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Significant cybersecurity incidents are elevated and managed by
a cross-functional, executive management-level team, which is
responsible for making the necessary decisions and prioritizing
actions that can minimize the impact of the security incident to
Nokia and its customers. Members from the CFO and Legal,
Compliance & Sustainability teams are responsible for determining
the materiality of the security incident and promptly informing the
Audit Committee of the Board.
The Nokia management team for assessing and managing
cybersecurity threats includes members with training and
experience in security risk management, security governance, cyber
resilience, security incident management, information technology,
cybersecurity legal and compliance requirements and disclosures.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The
Cyber Risk Council includes members of our senior management
navi20F-bg_02.jpg
with significant working experience in technology, cybersecurity and
risk management. For an overview of the training and experience of
the members of the Board and our assessment of their experience
and skills related to cybersecurity, please see “Main corporate
governance bodies of Nokia – Board of Directors”
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Nokia’s cybersecurity incidents are handled in the Security Incident
Management Process, which covers all phases of incident
response, including preparation, identification, containment,
eradication, recovery and post-incident analysis. Each confirmed
cybersecurity-related incident is assessed against a classification
scheme (impact on confidentiality, integrity and availability of the
related asset, urgency, and priority of the security incident).
Significant cybersecurity incidents are elevated and managed by
a cross-functional, executive management-level team, which is
responsible for making the necessary decisions and prioritizing
actions that can minimize the impact of the security incident to
Nokia and its customers. Members from the CFO and Legal,
Compliance & Sustainability teams are responsible for determining
the materiality of the security incident and promptly informing the
Audit Committee of the Board
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true