User Identification

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.5.2 User Identification], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When registering users in information systems and personal information processing systems, unique identifiers that can distinguish each user and personal information handler must be assigned, and the use of guessable identifiers must be restricted.

• Issue one account per person as a principle to ensure accountability (traceability) for users
• Restrict account sharing and the use of shared (common) accounts
• Restrict general users' access to the operational accounts used by the system
• After system installation, remove the default accounts and test accounts provided by the manufacturer or vendor, or change them to accounts that are hard to guess before use (including changing default passwords)
• Restrict the use of easily guessable identifiers (root, admin, administrator, etc.) for administrator and special-privilege accounts

When the same identifier must unavoidably be shared for business reasons, the reason and justification must be reviewed and the manager's approval obtained.

• Even when an administrator account is shared because the roles of primary/secondary personnel are separated under the division of duties, individual user accounts must be granted separately, and users must log in with their own user account and then switch to the administrator account
• When an account is temporarily shared for maintenance work, etc., change the password of that account immediately after the work is completed
• When the use of a shared (common) account is unavoidably necessary for business reasons, review the reason and justification, obtain the manager's approval, and apply additional controls to ensure accountability (traceability)