Management System Inspection

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 6Cases 7

Certification criterion

To verify whether the management system is being operated effectively in accordance with internal policies and implementation documents, an organization shall assemble personnel with assured independence and expertise to conduct an inspection at least once a year, and management shall confirm the accuracy and effectiveness of the improvement results for the identified problems.

Key checkpoints

Is a management system inspection plan established that includes the inspection criteria, scope, cycle, and qualification requirements for inspection personnel, in order to check whether the information security and personal information protection management system is operated effectively in accordance with legal requirements and established policies?
In accordance with the management system inspection plan, is a team of personnel with assured independence, objectivity, and expertise formed to conduct an inspection at least once a year, and are problems identified reported to management?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.4.2 Management System Inspection] and [1.4.3 Management System Improvement], which belong to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

An organization shall establish a management system inspection plan that includes the inspection criteria, scope, cycle, and qualification requirements for inspection personnel, in order to check whether the information security and personal information protection management system is operated effectively in accordance with legal requirements and established policies, and shall report the plan to management.

Inspection criteria: Include the information security and personal information protection management system certification criteria
Inspection scope: Include the entire organization or the certification scope
Inspection cycle: Must be conducted at least once a year
Qualification requirements for inspection personnel: Define qualification requirements to assure the objectivity, independence, and expertise of the inspection

In accordance with the management system inspection plan, an organization shall form a team of personnel with assured independence, objectivity, and expertise, conduct an inspection at least once a year, and report problems identified to management such as the Chief Information Security Officer and the Chief Privacy Officer.

Compose the inspection organization so as to assure the objectivity, independence, and expertise of the inspection
Conduct the inspection at least once a year in accordance with the inspection plan
Prepare an inspection result report and report it to management such as the Chief Information Security Officer and the Chief Privacy Officer

The organization shall analyze the root causes of problems in the management system identified through the review of compliance with legal requirements and the inspection of the management system, and shall establish/implement measures for preventing recurrence and for improvement.

For problems found through inspection, establish/implement action plans and additionally confirm whether the actions have been completed
Analyze the root causes of the identified problems and deficiencies in the management system
Based on the results of the root-cause analysis, establish/implement measures to prevent recurrence of the identified problems and to improve

※ Recurrence-prevention measures (examples)
- Revision of information security and personal information protection policies/guidelines/procedures
- Strengthening or improving education for employees and outsiders
- Strengthening monitoring of anomalous activity, etc.
- Automation of information security and personal information protection operations (account management, etc.)
- Improvement of review/approval procedures related to information security and personal information protection
- Improvement of internal inspection checklists or methods, etc.
Share the established recurrence-prevention measures with relevant personnel and conduct education

The organization shall establish criteria and procedures to confirm the accuracy and effectiveness of the recurrence-prevention and improvement results.

To measure the accuracy and effectiveness of recurrence-prevention and improvement actions, derive key performance indicators (security performance indicators) from a management-system perspective

※ Security performance indicators related to recurrence-prevention and improvement actions (examples)
- Rate of violations of security policies/guidelines (rate of violations of external transmission rules, rate of security bypass attempts, etc.)
- Number of security exception approvals
- Security program installation rate
- Malware infection rate
- Self-inspection execution rate, etc.
Establish/implement measurement and monitoring procedures for the key performance indicators (security performance indicators)
Report the confirmation and measurement results regarding the accuracy/effectiveness of recurrence-prevention and improvement actions to management

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Management system inspection plan (internal inspection plan, internal audit plan)
Management system inspection results report
Minutes of the information security and personal information protection committee
Management system inspection action plan/action results report
Recurrence-prevention measures
Effectiveness measurement indicators and measurement results (including reports to management)

Nonconformity examples

A case where an IT team staff member identified as an inspection target was included among the management system inspection personnel and was involved in inspecting the IT team's management area, thereby undermining the independence of the inspection
A case where a management system inspection was conducted this year, but the inspection scope was limited to certain areas and did not cover the full scope of the information security and personal information protection management system
A case where the management system inspection team consisted only of internal staff and external consultants who had participated in the management system establishment process such as risk assessment or vulnerability inspection, so the independence of the inspection cannot be regarded as assured
A case where problems in the operation of the information security and personal information protection management system found through internal inspection recur identically each time
A case where internal rules require that, for problems found during internal inspection, root causes be analyzed and recurrence-prevention measures be established, but in a recently conducted internal inspection, root-cause analysis and recurrence-prevention measures were not established for the problems found
A case where recurrence-prevention measures for problems in the management system have been established and key performance indicators have been prepared and are measured periodically, but the results have not been reported to management for a long period
A case where, for problems found during management system inspection, an action plan was not established or whether the actions were completed was not confirmed