Security Pledge
Certification criterion
An information security pledge appropriate to the nature of the work shall be obtained from employees, temporary staff, external parties, and others who handle information assets or are granted access rights, so that they clearly understand compliance obligations such as internal policies, related laws, and confidentiality duties.
Key checkpoints
- When recruiting new personnel, is an information security and personal information protection pledge that specifies information security and personal information protection responsibilities obtained?
- When granting access rights to information assets to external parties such as temporary staff and outsourced service personnel, is a pledge obtained that specifies responsibilities for information security and personal information protection, confidentiality obligations, and so on?
- When employees leave the organization, is a separate confidentiality pledge obtained?
- Are the information security, personal information protection, and confidentiality pledges stored securely and managed so that they can be easily located when needed?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.2.3 Security Pledge], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
When recruiting new personnel, an information security and personal information protection pledge that specifies information security and personal information protection responsibilities must be obtained.
- When new personnel join, they sign a pledge specifying the necessity of and responsibility for information security and personal information protection, compliance with internal policies and related laws, and confidentiality obligations
- When significant changes such as changes to employment conditions occur, measures such as re-signing the pledge are carried out
When granting access rights to information assets (including personal information), information systems, and so on to external parties such as temporary staff and outsourced service personnel, a pledge must be prepared that specifies responsibilities for information security and personal information protection, confidentiality obligations, and so on.
- Include necessary content such as responsibilities for information security and personal information protection, confidentiality obligations, obligations to comply with internal regulations and related laws, and liability for damages in the event of an incident/accident caused by non-compliance with related obligations
When employees leave the organization, a separate confidentiality pledge must be obtained.
- Obtain a confidentiality pledge from departing personnel so that they clearly recognize that they bear legal liability if an information leak occurs (included within the departure procedure)
The information security, personal information protection, and confidentiality pledges must be preserved securely and managed so that they can be easily located when needed.
- Store and manage them securely in a lockable cabinet or a document storage room with access control applied, so that they can be used as evidence of legal liability in the event of a legal dispute
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Information security and personal information protection pledges (employees, external personnel)
- Confidentiality pledges (departing personnel)
Nonconformity examples
- The case where the entry procedure requires new hires to sign a security pledge, but some recently hired employees failed to complete the security pledge
- The case where security pledges are obtained from employees, but no security pledge is obtained from outsourced personnel who can directly access the information processing system
- The case where management is inadequate, such as a folder collecting submitted information security and personal information protection pledges being left on an office desk in a state accessible to unauthorized persons
- The case where only a security pledge is obtained from personal information handlers, but the security pledge contains only content on confidentiality and does not include responsibilities and content regarding personal information protection