Annex 7-262 items
Applies to|Small enterprises, and medium enterprises with previous-year ICT-service revenue under KRW 30 billionA simplified set that eases the certification burden for SMEs. Detailed explanation follows the corresponding Annex 7 guide.
1. Establishment and Operation of the Management System
- 1.1.1Participation of Executive Management1.1 Laying the Foundation for the Management System
- 1.1.2Designation of the Chief Officers1.1 Laying the Foundation for the Management System
- 1.1.3Organization Composition1.1 Laying the Foundation for the Management System
- 1.1.4Scope Definition1.1 Laying the Foundation for the Management System
- 1.1.5Policy Establishment1.1 Laying the Foundation for the Management System
- 1.2.1Information Asset Identification1.2 Risk Management
- 1.3.1Management of Operational Status1.3 Management System Operation
- 1.4.1Management System Inspection1.4 Management System Inspection and Improvement
2. Protective Measure Requirements
- 2.1.1Security Pledge2.1 Human Resource Security
- 2.1.2Awareness Raising and Education/Training2.1 Human Resource Security
- 2.2.1Security When Contracting with External Parties2.2 External Party Security
- 2.3.1Designation of Protected Areas2.3 Physical Security
- 2.3.2Information System Protection2.3 Physical Security
- 2.3.3Control of Devices Brought In and Out2.3 Physical Security
- 2.3.4Work Environment Security2.3 Physical Security
- 2.4.1User Account Management2.4 Authentication and Authorization Management
- 2.4.2User Identification2.4 Authentication and Authorization Management
- 2.4.3User Authentication2.4 Authentication and Authorization Management
- 2.4.4Password Management2.4 Authentication and Authorization Management
- 2.5.1Network Access2.5 Access Control
- 2.5.2Information System Access2.5 Access Control
- 2.5.3Remote Access Control2.5 Access Control
- 2.5.4Internet Access Control2.5 Access Control
- 2.6.1Application of Cryptographic Policy2.6 Application of Encryption
- 2.7.1Definition of Security Requirements2.7 Information System Introduction and Development Security
- 2.7.2Separation of Test and Operational Environments2.7 Information System Introduction and Development Security
- 2.7.3Test Data Security2.7 Information System Introduction and Development Security
- 2.7.4Source Program Management2.7 Information System Introduction and Development Security
- 2.8.1Change Management2.8 System and Service Operation Management
- 2.8.2Backup and Recovery Management2.8 System and Service Operation Management
- 2.8.3Log and Access Record Management2.8 System and Service Operation Management
- 2.9.1Security System Operation2.9 System and Service Security Management
- 2.9.2Cloud Security2.9 System and Service Security Management
- 2.9.3Public Server Security2.9 System and Service Security Management
- 2.9.4Security of Business Terminals2.9 System and Service Security Management
- 2.9.5Removable Storage Media Management2.9 System and Service Security Management
- 2.9.6Patch Management2.9 System and Service Security Management
- 2.9.7Malicious Code Control2.9 System and Service Security Management
- 2.10.1Establishment of an Incident Prevention and Response System2.10 Incident Prevention and Response
- 2.10.2Vulnerability Assessment and Remediation2.10 Incident Prevention and Response
- 2.10.3Incident Response and Recovery2.10 Incident Prevention and Response
3. Requirements by Personal Information Processing Stage
- 3.1.1Collection/Use of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.2Limitation on Collection of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.3Restrictions on Processing Resident Registration Numbers3.1 Protective Measures When Collecting Personal Information
- 3.1.4Restrictions on Processing Sensitive Information and Unique Identifying Information3.1 Protective Measures When Collecting Personal Information
- 3.1.5Indirect Collection of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.6Installation/Operation of Video Information Processing Devices3.1 Protective Measures When Collecting Personal Information
- 3.1.7Collection/Use of Personal Information for Marketing Purposes3.1 Protective Measures When Collecting Personal Information
- 3.2.1Personal Information Status Management3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.2Ensuring Personal Information Quality3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.3Protection of User Device Access3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.4Use and Provision of Personal Information Beyond the Purpose3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.5Processing of Pseudonymized Information3.2 Protective Measures When Retaining and Using Personal Information
- 3.3.1Provision of Personal Information to Third Parties3.3 Protective Measures When Providing Personal Information
- 3.3.2Outsourcing of Personal Information Processing Tasks3.3 Protective Measures When Providing Personal Information
- 3.3.3Transfer of Personal Information Due to Business Transfer, etc.3.3 Protective Measures When Providing Personal Information
- 3.3.4Cross-Border Transfer of Personal Information3.3 Protective Measures When Providing Personal Information
- 3.4.1Destruction of Personal Information3.4 Protective Measures When Destroying Personal Information
- 3.4.2Measures When Retaining Personal Information After the Processing Purpose Is Achieved3.4 Protective Measures When Destroying Personal Information
- 3.5.1Disclosure of the Privacy Policy3.5 Protection of Data Subject Rights
- 3.5.2Guaranteeing the Rights of Data Subjects3.5 Protection of Data Subject Rights
- 3.5.3Notification to Data Subjects3.5 Protection of Data Subject Rights