Description of S Group (customer-owned Finnish network of companies in the retail and service sectors) Computer Security Incident Response Team (CSIRT).
1. Document introduction
This document describes the SOK Computer Security Incident Response Team functions for S group (SOK CSIRT).
1.1 Date of last update
This document was last updated 2026-04-03
1.2 Distribution List for Notifications
There is no distribution list for notifications in relation to this document. The document is publicly available.
Full Name: SOK Computer Security Incident Response TeamShort Name: SOK CSIRT
2.2 Address
Mailing address:CSIRT / SOK Kyberturvallisuus Suomen Osuuskauppojen Keskuskunta Fleminginkatu 34 P.O. Box 1, 00088 S-RYHMÄ
2.3 Timezone
SOK CSIRT operates in Helsinki, Finland, in the Eastern European Time Zone (EET, UTC+2h). Finland observes summertime arrangements as indicated in the EU directive 2000/84/EC.The DST offsets in Finland are applied as follows.UTC+3h (EEST) summertime between the last Sunday of March and the last Sunday of October UTC+2h (EET) otherwise.
2.4 Telephone Number
SOK CSIRT Duty Officer has a direct 24/7 phone number, which is available by request only.
2.5 Facsimile Number
None.
2.6 Other Telecommunication
SOK CSIRT has access to video and teleconferencing systems.
2.7 Electronic mail Address
SOK CSIRT can be reached via email at csirt (at) sok.fi
3. Charter
3.1 Mission Statement
The main areas of responsibility of SOK CSIRT are:Maintain situational awareness of S Group’s cybersecurity landscape. Responding to IT security incidents. Coordinating the response to significant IT security incidents, where required, in the S Group. Coordinating with NCSC-FI, FIN-CERT, and other external organizations.
3.2 Constituency
SOK CSIRT constituency is composed of all the elements of S Group’s information systems: its users, its systems, its applications, and its networks.
3.3 Sponsoring Organization / Affiliation
SOK CSIRT is a service within the SOK IT department. We act as the SPOC for matters relating to cybersecurity for the whole S Group.
3.4 Authority
CSIRT has the authority to act on all cybersecurity related incidents that cause or could cause detriment to the confidentiality, integrity, and availability of S Group's IT assets.
3.5 Policies
SOK CSIRT is authorized to handle all types of cyberattacks targeting S Group.All incidents are considered normal priority unless they are labeled EMERGENCY.SOK CSIRT works closely with Finnish institutions & law enforcement agencies. All relevant Finnish Data Protection Laws apply. In the case of criminal action, these will be reported to the appropriate authorities.
Incident reporting forms are not used. External contacts via email.
3.7 Co-operation, Interaction, and Disclosure of Information
SOK CSIRT is committed to open and transparent collaboration with our trusted partners, including the international CERT community, in accordance with S Group policies.For this reason, all worldwide CERT teams are welcome to contact SOK CSIRT to establish cooperation agreements, questions, or information-sharing initiatives as appropriate.
3.8: Disclaimers
This document is provided on an "as is" basis and does not imply any guarantee of the service supplied by the SOK CSIRT.While every precaution will be taken in the preparation & dissemination of information and security alerts, SOK CSIRT assumes no responsibility to external (Non-S Group organizations and users) for errors, omissions, or damages resulting from the use of the information provided within this document or our security communications.
