Scope Definition

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.1.4 Scope Definition], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

The scope of the management system shall be defined so as to include the core assets that may affect the organization's core services and personal information processing.

• The scope of the management system shall include, without omission, tangible and intangible core assets related to the business (service), such as executives and employees, information systems, information, and facilities.
• In particular, in the case of entities subject to mandatory ISMS certification, the scope shall be defined so that information and communications services and related information assets required by law are mandatorily included.

Where exceptions exist within the defined scope, the relevant grounds, such as a clear rationale, consultation with the parties concerned, and approval by the responsible manager, shall be recorded and managed.

• Where the scope of the information security management system and that of the personal information protection management system differ, the list of information assets within the certification scope (personal information, systems, networks, etc.) shall be clearly identified and defined from the perspectives of both the information security management system and the personal information protection management system.
• For services, information systems, etc. excluded from the certification scope, the rationale and grounds shall be recorded and managed after undergoing internal consultation and approval by the responsible manager.

Documents that include the relevant content (status of major services and tasks, list of information systems, list of documents, etc.) shall be prepared and managed so that the scope of the information security and personal information protection management system can be clearly identified.

• Status of major services and tasks (including the status of personal information processing tasks)
• Status of the organization related to service provision (organizational chart, etc.)
• Status of the information security and personal information protection organization
• List of major facilities
• List of information systems and network configuration diagram
• Asset identification criteria and asset status for information assets and personal information related assets
• List of information security and personal information protection systems
• Service (system) configuration diagram and personal information processing flow (collection, use, provision, storage, management, destruction)
• List of documents (e.g.: policies, guidelines, manuals, statement of operations, etc.)
• Methods and procedures for establishing the information security and personal information protection management system, review of related legal compliance, internal audit
• Status of outsourcing (consignment) companies such as customer centers, IDCs, IT development and operation, etc.