Incident Response and Recovery

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.11.5 Incident Response and Recovery], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When signs or occurrences of a security incident or personal information breach are recognized, response and reporting must be carried out promptly in accordance with the defined security incident response procedures.

• Initial response to the security incident and evidence preservation measures
  • Deleting/changing access rights to the information system suspected of intrusion, or blocking access
  • Security inspection of internal and external systems such as networks and firewalls, and vulnerability remediation measures
  • Preserving evidence such as external access records needed for the incident investigation
  • Verifying whether personal information and important information have been leaked through log analysis and the like
• Preparing a security incident report including the following items, and reporting it internally
  • Date and time the security incident occurred
  • Reporter and date and time of the report
  • Incident details (findings, damage details, etc.)
  • Progress details of the incident response
  • Time taken until the incident response, etc.
• If the impact of the security incident on the organization is severe, reporting promptly up to top management in accordance with the reporting procedures

When a personal information breach incident occurs, the procedures for notifying data subjects and reporting to relevant agencies must be carried out in accordance with the applicable laws.

• Requirements for notifying data subjects following loss/theft/leakage of personal information (hereinafter "leakage etc.")

Field	Value
Matters to be notified	1. The items of personal information subject to leakage etc. 2. The point in time and circumstances of the leakage etc. 3. Information on the methods that data subjects can use to minimize the damage that may arise from the leakage etc. 4. The response measures of the personal information controller and the damage relief procedures 5. The department in charge and contact point where data subjects can file reports and the like if damage occurs ※ If the specific details concerning matters 1 and 2 cannot be verified, the fact that personal information was leaked, the details verified up to that point, and matters 3 through 5 of the same paragraph must be notified first by written or other means, and additionally verified details must be notified immediately upon verification.
Method of notification	Written or other means (in writing, email, fax, telephone, text message, etc.)
Timing of notification	Within 72 hours from the time the leakage etc. becomes known However, in any of the following cases, data subjects may be notified without delay after the relevant reason is resolved: 1. Where urgent measures are needed to prevent the spread of and further leakage etc. of the leaked personal information, such as blocking access paths, inspecting/remediating vulnerabilities, or recovering/deleting the leaked personal information 2. Where notification within 72 hours is difficult due to a natural disaster or other unavoidable reasons
Exception to notification	Where there is a justifiable reason, such as being unable to ascertain the contact information of the data subject, notification may be replaced by posting the above five matters to be notified on the internet website for at least 30 days However, a personal information controller that does not operate an internet website must post the above five matters to be notified in a conspicuous place at the business premises and the like for at least 30 days.

• Requirements for reporting to relevant agencies following leakage etc. of personal information

Field	Value
Matters to be reported	1. The items of personal information subject to leakage etc. 2. The point in time and circumstances of the leakage etc. 3. Information on the methods that data subjects can use to minimize the damage that may arise from the leakage etc. 4. The response measures of the personal information controller and the damage relief procedures 5. The department in charge and contact point where data subjects can file reports and the like if damage occurs ※ If the specific details concerning matters 1 and 2 cannot be verified, the fact that personal information was subject to leakage etc., the details verified up to that point, and matters 3 through 5 of the same paragraph must be reported first by written or other means, and additionally verified details must be reported immediately upon verification.
Reporting agency	Personal Information Protection Commission or Korea Internet & Security Agency
Method of reporting	Written or other means (in writing, email, fax, telephone, text message, etc.) ※ Reporting is possible through the Personal Information Portal (www.privacy.go.kr).
Timing of reporting	Within 72 hours from the time the leakage etc. becomes known However, where reporting within 72 hours is difficult due to a natural disaster or other unavoidable reasons, the report must be made without delay after the relevant reason is resolved.
Cases subject to reporting	1. Where personal information of 1,000 or more data subjects is subject to leakage etc. 2. Where sensitive information or unique identifying information is subject to leakage etc. 3. Where personal information is subject to leakage etc. due to unlawful external access to the personal information processing system or to the information devices used by personal information handlers to process personal information ※ However, where the path of the personal information leakage etc. has been identified and the possibility of infringement on the rights and interests of data subjects has become significantly lower through measures such as recovering/deleting the relevant personal information, reporting may be omitted.

After a security incident is closed, the cause of the incident must be analyzed, and the results must be reported and shared with the relevant organizations and personnel.

• After the security incident is handled and closed, performing an analysis of the cause of the incident, preparing a results report, and reporting it to the responsible person
• Sharing the security incident information and the discovered vulnerabilities, causes, and remediation measures with the relevant organizations and personnel

Using the information obtained through the analysis of the security incident, measures must be established to prevent similar incidents from recurring, and where necessary, the security incident response procedures and the like must be modified.

• Using the information obtained through the analysis of the security incident, establishing recurrence prevention measures so that similar incidents are not repeated
• Where necessary based on the analyzed results, modifying the security incident response system, including the security incident response procedures and the information security policies and procedures