Organization Composition

Based on official sourcesISMSISMS-PCheckpoints 1Evidence 5Cases 4

Certification criterion

The top management shall establish and operate a working-level organization for the effective implementation of information security. (However, for information security and personal information protection management system certification, "information security" shall read "information security and personal information protection".)

Key checkpoints

To systematically carry out the organization's information security activities, is a working-level organization with expertise established and operated?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.1.3 Organization Composition], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Considering characteristics such as the organization's size and the importance of its business, the basis for the organizational composition needed to build and continuously operate the information security and personal information protection management system shall be specified in documents such as the information security and personal information protection policy, and a working-level organization with expertise shall be established and operated.

Specify matters concerning the composition/operation of information security and personal information protection organizations, such as the Chief Information Security Officer, the Chief Privacy Officer, the personal information protection working-level organization, and the committee, in the policy, internal management plan, etc.
Determine the form of composition and size of the working-level organization by considering the size of the enterprise-wide organization, the business, the characteristics of the services, the importance and sensitivity of the information and personal information processed, and laws and regulations
The working-level organization may be composed as a dedicated organization or a concurrently-assigned organization, but even when composed as a concurrently-assigned organization, roles and responsibilities must be officially assigned so that actual role performance is possible
Compose the members of the working-level organization of employees with information security and personal information protection expertise and with a high level of understanding and experience across various services (holding relevant degrees and certifications, having practical experience, having completed relevant training, etc.)

A committee that can review, approve, and make decisions on important information security and personal information protection matters across the organization shall be established and operated.

The committee shall be composed of executives and staff with actual review and decision-making authority, such as management, executives, the Chief Information Security Officer, and the Chief Privacy Officer, so that it can represent interests within the organization and make decisions regarding information security and personal information protection
Hold the committee regularly or from time to time depending on the matter
The committee reviews, approves, and makes decisions on major matters across the organization

※ Major matters requiring review and decision-making by the committee (examples)

Establishment/revision of information security and personal information protection policies/guidelines
Risk assessment results
Allocation of information security and personal information protection budget and resources
Actions on internal security incidents and major violations
Internal audit results, etc.

A working-level consultative body composed of information security and personal information protection officers and departmental officers shall be established and operated for organization-wide information security and personal information protection activities.

Determine the members and organizational structure of the working-level consultative body according to the size of the organization and the importance of the services within the scope of the management system
In the working-level consultative body, share/coordinate/review/improve matters related to information security and personal information protection at the working level, and when decision-making and management support are needed, submit them to the committee for discussion

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Information security and personal information protection committee regulations/meeting minutes
Information security and personal information protection working-level consultative body regulations/meeting minutes
Information security and personal information protection organization chart
Internal management plan
Job description

Nonconformity examples

Where an information security and personal information protection committee has been established but does not include management such as executives and is instead composed of heads of working-level departments, so that it cannot decide on matters concerning the protection of the organization's important information and personal information
Where an information security and personal information protection working-level consultative body composed of heads (team-leader level) of major information processing departments and personal information processing departments has been established in accordance with internal guidelines, but there is no record of operation over a long period
Where an information security and personal information protection committee has been held, but major information security and personal information protection matters such as the annual information security and personal information protection plan, training plan, budget, and personnel have not been reviewed and decided
Where an information security committee has been established and operated for deliberation/resolution related to information security and personal information protection, but only operations and IT security related organizations participate while the personal information protection related organization does not, so that matters concerning personal information protection cannot be decided