Participation of Executive Management
Certification criterion
The chief executive officer shall establish and operate a reporting and decision-making system so that executive management can participate throughout the establishment and operation activities of the information security and personal information protection management system.
Key checkpoints
- Are the responsibilities and roles for reporting, decision-making, and so forth documented so that executive management can participate throughout the establishment and operation activities of the information security and personal information protection management system?
- Are reporting, review, and approval procedures established and implemented so that executive management can actively participate in decision-making related to information security and personal information protection activities?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.1.1 Participation of Executive Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
The responsibilities and roles for reporting, decision-making, and so forth shall be documented so that executive management with decision-making authority can participate throughout the establishment and operation activities of the information security and personal information protection management system.
- Specify the basis for the relevant activities in the information security and personal information protection policy or implementation documents so that executive management can participate in important matters of management system operation, such as the enactment/revision of information security and personal information protection policies, risk management, and internal audits.
Reporting, review, and approval procedures shall be established and implemented so that executive management can actively participate in decision-making related to information security and personal information protection activities.
- Define the important activities in which executive management participates within the information security and personal information protection management system, and establish a corresponding reporting system (regular/ad hoc reporting, committee participation, and so forth).
- Determine the reporting and decision-making procedures, targets, cycles, and so forth in a manner suited to the organization's size and characteristics, so that executive management can effectively participate in the establishment/operation of the management system.
- In accordance with the established internal procedures, executive management receives reports on and participates in decision-making regarding key matters within the information security and personal information protection management system.
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Information security and personal information protection reporting system (communication plan, and so forth)
- Minutes of the information security and personal information protection committee
- Information security and personal information protection policies/guidelines (including records of executive management approval)
- Information security plan and internal management plan (including records of executive management approval)
- Information security and personal information protection organization chart
Nonconformity examples
- A case where the information security and personal information protection policy specifies that the information security and personal information protection status shall be reported to executive management on a quarterly basis, but the relevant reporting has not been carried out for a long period
- A case where, while performing important information security activities (risk assessment, determination of the risk acceptance level, review of information security measures and implementation plans, review of the results of implementing information security measures, security audits, and so forth), executive management or a person delegated the authority of executive management did not participate in decision-making such as reporting and approval related to the relevant activities, or where the relevant evidence cannot be confirmed