Security When Contracting with External Parties

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.3.2 Security When Contracting with External Parties], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When selecting an external service or an outsourcing vendor related to the processing of important information and personal information, a procedure shall be established to consider information security and personal information protection capabilities.

• Reflect the relevant requirements in the request for proposal (RFP) and the proposal evaluation items so that a vendor with information security and personal information protection capabilities can be selected, and apply them when selecting the vendor

When outsourcing the organization's information processing work to an external party or using an external service, the following security requirements shall be defined and reflected in the contract.

• Compliance with information security and personal information protection laws, and submission of an information security and personal information protection pledge

• Periodic information security training for employees performing the outsourced work, and periodic security inspections

• Measures to prevent leakage of important information obtained in connection with performing the work

• Restrictions on external parties' internet access, physical protection measures (bringing equipment and media in and out, etc.), terminal security for devices such as PCs (installing anti-virus software, setting safe passwords and changing them periodically, setting up screen savers, etc.), and restrictions on the use of wireless networks

• Procedures for granting and revoking access rights so that excessive privileges are not granted when access to the information system is permitted

• Restriction of re-outsourcing, and definition of the procedures and security requirements for cases where re-outsourcing is necessary

• Penalties for violations of security requirements, liability for damages, obligations to report in the event of a security incident, etc.

  ※ Matters to be included in the document when outsourcing personal information processing work (Article 26(1) of the Personal Information Protection Act and Article 28(1) of its Enforcement Decree)

  • Matters concerning the prohibition of processing personal information beyond the purpose of performing the outsourced work
  • Matters concerning technical/managerial protection measures for personal information
  • The purpose and scope of the outsourced work
  • Matters concerning the restriction of re-outsourcing
  • Matters concerning measures to ensure safety, such as restricting access to personal information
  • Matters concerning supervision, such as inspecting the management status of personal information held in connection with the outsourced work
  • Matters concerning liability, such as damages, in the event that the trustee violates the obligations that must be complied with

When outsourcing the development of an information system or a personal information processing system, the information security and personal information protection requirements that must be complied with during development shall be specified in the contract.

• Compliance with legal requirements related to information security and personal information protection
• Application of development security procedures, such as compliance with secure coding standards
• Vulnerability inspection and remediation for the completed information system and personal information processing system
• Security management of the development environment, including development-related deliverables, source programs, and development data
• Obligation of confidentiality regarding information obtained during the development process
• Matters concerning liability, such as damages, in the event of a violation, etc.