Designation of Protected Areas

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.4.1 Designation of Protected Areas] and [2.4.2 Physical Entry Control], which belong to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

To protect personal information and important information, documents, storage media, key facilities and systems, and the like from physical/environmental threats, criteria for designating physical protected areas such as controlled areas, restricted areas, and reception areas shall be established.

• Designate physical protected areas as reception areas, restricted areas, controlled areas, and the like

• Select the terminology and classification of protected areas to suit the organization's environment

  ※ Physical protected areas (examples)

  • Reception area : an area where outsiders can enter without a separate access pass (e.g. : reception area)
  • Restricted area : a place where separate access control devices and monitoring systems are installed to prevent unauthorized access, and where an access pass such as a staff card is required to enter (e.g. : departmental offices)
  • Controlled area : a place that includes all the control items of a restricted area, where access eligibility is kept to the minimum number of persons, and where additional procedures are required for entry (e.g. : computer room, communications equipment room, control room, HVAC room, power generation room, power supply room)

Protected areas shall be designated in accordance with the physical protected area designation criteria, and protective measures for each zone shall be established/implemented.

• Apply protective measures for each zone, such as access control methods (ID card, biometrics, etc.), authorized entrants, entry procedures, and video surveillance
• Since access authorization to controlled areas is kept to a minimum even within the organization, mark them as controlled areas where necessary to fundamentally block access attempts in the first place, and periodically review whether any unlawful access attempts have occurred

Entry control procedures for internal and external persons must be established so that only authorized persons may enter each protected area, and the status of persons permitted to enter must be managed.

• Define the departments/duties/tasks permitted to enter each protected area, identify the employees granted entry permission, and manage the status of such permissions
• For controlled areas, restrict entry so that only the minimum necessary personnel may enter according to business purposes
• Entry procedure: entry application, approval by the responsible person, granting and revocation of entry permissions, recording of entry details, periodic review of entry records, etc.
• Installation of access control devices: password-based, ID card-based, biometric-based, etc.
• Establishment/operation of access control procedures: registration/deletion of persons with entry rights, management of entry permissions, visitor management, entry log management, etc.

Entry records of internal and external persons for each protected area must be retained for a defined period, and entry records and entry permissions must be reviewed periodically.

• Retain entry records for a defined period in documentary or electronic form so that subsequent monitoring is possible
• Review of entry records and entry permissions: persons who have not entered for a long period, abnormal entry attempts, excessive granting of entry permissions, etc.
• Identify unauthorized entry attempts, persons who have not entered for a long period, etc., confirm the reasons, and take action
• Through periodic review, recover access passes from and delete entry permissions of departed employees, and adjust entry permissions following changes in duties
• Where entry logs cannot be recorded by the system, prepare an entry logbook to verify entry records