Establishment of an Incident Prevention and Response System

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 3Cases 6

Certification criterion

An organization shall establish a cooperation system with external agencies and others so as to prevent security incidents and personal information breaches and to respond promptly when an incident occurs.

Key checkpoints

When the incident response system is built/operated through an external organization such as a security monitoring service, are the details of the incident response procedures reflected in the contract?
Is a cooperation system established with external experts, specialized firms, and specialized organizations for the monitoring, response, and handling of security incidents?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.11.1 Establishment of an Incident Prevention and Response System], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

A system and procedures for preventing security incidents and personal information breach incidents and for responding promptly and effectively when an incident occurs must be prepared, including the following contents.

Definition and scope of security incidents (personal information breach incidents, hacking incidents, denial-of-service attacks, etc.)
Types and severity of security incidents
Procedures and methods for declaring a security incident
Contact system such as an emergency contact network
Security incident detection system
Recording and reporting procedures when a security incident occurs
Security incident notification and reporting procedures (relevant organizations, data subjects and users, etc.)
Preparation of security incident reports
Response and recovery procedures according to the severity and type of the security incident
Composition, responsibilities, and roles of the security incident recovery organization
Procurement of security incident recovery equipment and resources
Security incident response and recovery drills, and drill scenarios
Plans for utilizing external experts and specialized organizations
Other matters necessary for the prevention and recovery of security incidents, etc.

When the incident response system is built/operated through an external organization such as a security monitoring service, the details of the incident response procedures must be reflected in the contract (SLA, etc.).

Scope of the security monitoring service
Reporting and response procedures upon detection of signs of intrusion
Reporting and response procedures when a security incident occurs
Matters concerning responsibilities and roles in the event of a security incident, etc.

A cooperation system must be established with external experts, specialized firms, and specialized organizations for the monitoring, response, and handling of security incidents.

7 stages of security incident response

flowchart TB
    T["Incident occurrence/discovery or time of occurrence"]
    S1["Stage 1<br>Pre-incident preparation"]
    S2["Stage 2<br>Incident detection"]
    S3["Stage 3<br>Initial response"]
    S4["Stage 4<br>Response strategy formulation"]
    S5["Stage 5<br>Incident investigation"]
    S6["Stage 6<br>Report writing"]
    S7["Stage 7<br>Resolution"]
    R["Recovery/resolution process"]
    S1 --> S2 --> S3 --> S4 --> S5 --> S6 --> S7
    T -.-> S2
    S5 -.-> S4
    S6 -.-> S4
    S2 -.-> R
    S3 -.-> R
    S4 -.-> R
    S5 -.-> R
    S6 -.-> R

Stage	Name	Description
Stage 1	Pre-incident preparation	Prepare the security incident response team and an organizational response before an incident occurs
Stage 2	Incident detection	Detection of anomalies by information security and network equipment, identification of the security incident by administrators
Stage 3	Initial response	Performance of the initial investigation, recording of basic details of the incident circumstances, reporting to and convening of the incident response team, notification to the departments (organizations) related to the security incident
Stage 4	Response strategy formulation	Determine the optimal strategy and obtain management approval, determine with reference to the initial investigation results whether the matter requires litigation, and judge whether to cooperate with investigative agencies in the incident investigation process
Stage 5	Incident investigation	Performed through data collection and analysis, determine when, by whom, and how the incident was caused, and how to prevent the spread of damage and the recurrence of the incident
Stage 6	Report writing	Write an accurate report on the incident in a form that decision-makers can understand
Stage 7	Resolution	Decide on the establishment of security policies to identify and prevent similar future attacks, procedure changes, recording of the incident, establishment of long-term security policies, establishment of technical modification plans, etc.

<Source> Guide to Incident Response in the Private Sector (Ministry of Science and ICT, KISA)

Related laws

Personal Information Protection Act Article 34 (Notification and Reporting of Personal Information Breaches, etc.)
Network Act Article 48-3 (Reporting of Security Incidents, etc.), Article 48-4 (Cause Analysis of Security Incidents, etc.)

Evidence (examples)

Incident response guidelines/procedures/manuals
Incident response organization chart and emergency contact network
Security monitoring service contract (SLA, etc.)

Nonconformity examples

When the incident response organization and response procedures for security incidents are not clearly defined
When internal guidelines and procedures establish and specify stage-by-stage response procedures for security incidents (before the incident, recognition, handling, recovery, reporting, etc.), but some or all of the reporting/notification procedures and the response and recovery procedures according to the type and severity of the incident are not established for when a security incident occurs
When the incident response organization chart and emergency contact network are not kept up to date, or the roles and responsibilities of each person in charge are not clearly defined
When the contact information of external organizations for security incident reporting/notification and response cooperation has incorrect organization names, websites, or contact details, or when information related to some organizations is omitted or not kept up to date
When the detection and response to security incidents are outsourced to a related organization such as an external security monitoring specialized firm, but the mutual roles and scope of responsibility for incident response are not clearly defined in the contract or SLA
When incident response procedures have been established, but the criteria and timing for reporting personal information breaches do not comply with legal requirements