Control of Devices Brought In and Out

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.4.5 Work within Protected Areas] and [2.4.6 Control of Devices Brought In and Out], which belong to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

For cases where work within a protected area is required for purposes such as the introduction or maintenance of information systems, formal work request and execution procedures shall be established and implemented.

• Work procedures: work request, approval, preparation of work records, etc. when performing work in a controlled area
• Work records: date and time of work, purpose and content of work, work company and person in charge, reviewer and approver, etc.
• Control measures: procedures for entering the protected area to perform work, securing accountability for work details, monitoring measures, etc.

Work records shall be reviewed periodically to verify whether work within a protected area was carried out appropriately in accordance with control procedures.

• Work review: periodic review of prior approval records, entry records, work records, etc.
• Review method: consistency between entry request forms and entry records (management ledgers, system logs, etc.), etc.

When information systems, mobile devices, storage media, and similar items are brought into or taken out of protected areas, control procedures must be established and implemented to prevent security incidents such as information leakage and malicious code infection.

• Targets of bring-in/bring-out control : information systems (servers, network equipment, etc.), mobile devices (laptops, smart pads, smartphones, etc.), storage media (HDD, SSD, USB memory, external hard disks, CD/DVD, tapes, etc.), and similar items
• Bring-in/bring-out control procedures : prior approval by the person responsible for access control of the protected area, recording in the bring-in/bring-out management log, performing security checks on devices brought in and out (whether antivirus is installed, whether security updates are applied, whether infected with malicious code, whether a security sticker is attached, whether important information has leaked, etc.), periodic review of the bring-in/bring-out records, etc.
• Exception use procedure : exception application/approval, recording in the bring-in/bring-out management log, etc.

※ Items recorded in the bring-in/bring-out management log (examples)

• Date, time, and location of bringing in/out
• User information
• Model (type), device identification information (serial number, etc.)
• Reason for bringing in/out
• Security check results
• Administrator confirmation signature, etc.

Records must be maintained and managed in accordance with the control procedures for items brought in and out, and the history of items brought in and out must be inspected periodically so that compliance with the procedures can be verified.

• Maintaining records of the history of items brought in and out within protected areas (bring-in/bring-out management log, bring-in/bring-out control system logs, etc.)

• Periodically inspect the bring-in/bring-out history to review whether bringing items in and out of protected areas was carried out properly in accordance with the control procedures.