Application of Cryptographic Policy

Based on official sourcesISMSISMS-PCheckpoints 4Evidence 6Cases 8

Certification criterion

To protect personal information and key information, the organization shall establish encryption targets, cryptographic strength, cryptographic usage policies, and cryptographic key management procedures that reflect legal requirements, and shall apply encryption when personal information and key information are stored, transmitted, or delivered.

Key checkpoints

To protect personal information and key information, has the organization established a cryptographic policy that reflects legal requirements and includes encryption targets, cryptographic strength, cryptographic usage, etc.?
In accordance with the cryptographic policy, is encryption performed when storing, transmitting, and delivering personal information and key information?
Are procedures for the generation, use, storage, distribution, change, recovery, destruction, etc. of cryptographic keys established and implemented?
Are cryptographic keys stored in a separate secure location so that they can be recovered when necessary, and are access rights for cryptographic key use minimized?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.7.1 Application of Cryptographic Policy] and [2.7.2 Cryptographic Key Management], which belong to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

To protect personal information and key information, the organization shall establish a cryptographic policy that reflects legal requirements and includes encryption targets, cryptographic strength, cryptographic usage, etc..

Encryption targets : Defined according to legal requirements and the sensitivity and importance of the information being processed

Personal information subject to encryption under the Personal Information Protection Act

Category		Personal information of data subjects who are not users	Personal information of users
When transmitted/received via an information and communications network	Information and communications network	Authentication information (passwords, biometric recognition information, etc.)	Authentication information (passwords, biometric recognition information, etc.)
When transmitted/received via an information and communications network	Internet network	Personal information ※ However, for those subject to the former Standards for Measures to Ensure the Safety of Personal Information, this takes effect on 2024.9.15	Personal information ※ However, for those subject to the former Standards for Measures to Ensure the Safety of Personal Information, this takes effect on 2024.9.15
When stored	Regardless of storage location	Authentication information (passwords, biometric recognition information, etc.) ※ However, passwords shall be one-way encrypted	Authentication information (passwords, biometric recognition information, etc.) ※ However, passwords shall be one-way encrypted
When stored	Regardless of storage location	Resident registration numbers ※ Encrypted pursuant to Article 24-2(2) of the Act	Resident registration numbers ※ Encrypted pursuant to Article 24-2(2) of the Act
When stored	Internet zone, DMZ	Unique identifying information	Resident registration numbers, passport numbers, driver's license numbers, alien registration numbers, credit card numbers, account numbers, biometric recognition information ※ Regardless of storage location
When stored	Internal network	Unique identifying information ※ However, when unique identifying information other than resident registration numbers is stored on the internal network, whether and to what extent encryption is applied may be determined and implemented according to the results of a privacy impact assessment or a risk analysis	(same as above)
When stored on a personal information handler's computer, mobile device, auxiliary storage media, etc.		Unique identifying information, biometric recognition information	Personal information

Encryption algorithm : Select a secure encryption algorithm and security strength taking into account legal requirements and other factors

※ Secure encryption algorithms (examples) (refer to the "Guide to Encryption Measures for Personal Information")

Category	Algorithm name
Symmetric-key encryption algorithms	SEED, ARIA-128/192/256, AES-128/192/256, HIGHT, LEA, etc.
Public-key encryption algorithms	RSAES-OAEP, etc.
One-way encryption algorithms	SHA-256/384/512, etc.

In accordance with the cryptographic policy, encryption shall be performed when storing, transmitting, and delivering personal information and key information.

Select and apply an encryption method taking into account the encryption location, system characteristics, and other factors

※ Encryption methods (examples)

Category	Encryption method
When transmitted/received via an information and communications network	1. Install an SSL (Secure Socket Layer) certificate on the web server to encrypt the transmitted information for sending and receiving 2. Install an encryption application on the web server to encrypt the transmitted information for sending and receiving 3. Use other encryption technologies : VPN, PGP, etc.
When stored in a personal information processing system, etc.	1. Application-level self-encryption (API method) 2. Database server encryption (Plug-in method) 3. DBMS self-encryption (TDE method) 4. Calling DBMS encryption functions 5. Operating system encryption (file encryption, etc.) 6. Use of other encryption technologies
When stored on business computers and mobile devices	1. Document tool self-encryption (using the password setting function provided by office software, etc.) 2. Encryption using an encryption utility 3. Application of DRM (Digital Rights Management) technology, etc.
When stored on auxiliary storage media	1. Use of secure storage media that provide encryption functions (secure USB, etc.) 2. Encrypting the relevant information before storing it on auxiliary storage media, etc.

Policies and procedures that include the following content must be established for the generation, use, storage, distribution, and destruction of cryptographic keys.

Person in charge of cryptographic key management
Methods for generating and storing cryptographic keys (offsite backup, etc.)
Recipients and distribution methods for cryptographic keys (including granting decryption rights)
Validity period for cryptographic key use (change cycle) : determined by considering cost, business importance, etc. when changing cryptographic keys
Procedures and methods for cryptographic key recovery and disposal
Matters concerning the prohibition of recording cryptographic keys as hard-coded values in source code, etc.

Cryptographic keys must be stored in a separate secure location so that they can be recovered when necessary, and access rights for cryptographic key use must be minimized.

To recover the system or encrypted information in case of cryptographic key damage, cryptographic keys must be stored on a separate medium and then kept in a secure location (cryptographic key management system, physically separated location, etc.)
Minimizing access rights to cryptographic keys and monitoring access, etc.

Related laws

Personal Information Protection Act Article 24-2 (Restrictions on Processing Resident Registration Numbers), Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 7 (Encryption of Personal Information)

Evidence (examples)

Cryptographic control policy (targets, methods, algorithms, etc.)
Status of encryption application (when storing and transmitting)
Risk analysis results (when encryption is not applied to unique identifying information other than resident registration numbers on the internal network)
Management screen of the encryption solution
Cryptographic key management policy
Cryptographic key management ledger and management system screens

Nonconformity examples

Where the internal policy/guidelines do not appropriately specify matters such as encryption targets, cryptographic strength, encryption methods for storage and transmission, and the roles and responsibilities of encryption-related personnel that take into account the legal requirements for cryptographic control
Where, in establishing the cryptographic policy, the organization misapplies the laws to which it is subject and thus fails to comply with the legal requirements related to encryption (for example, storing a user's account number without applying encryption)
Where one-way encryption was applied to the passwords of personal information handlers and data subjects, but the insecure MD5 algorithm was used
Where a personal information controller applied a secure server to an internet shopping mall in accordance with the relevant laws and internal regulations, but encryption measures were omitted in some sections where users' personal information is transmitted, such as member information inquiry and modification, password recovery, and password change
Where passwords for accessing information systems, authentication key values, etc. are stored in plaintext within system configuration files and source code
When procedures, methods, etc. related to cryptographic key management are not specified within the encryption policy, resulting in vulnerabilities in cryptographic key management such as differences in the level and method of cryptographic key management by person in charge
When internal regulations require that, when encrypting important information, encryption keys be generated with the approval of the relevant responsible party and a cryptographic key management ledger be prepared, but some cryptographic keys are omitted from the cryptographic key management ledger or the ledger is not kept up to date
When the cryptographic key applied to the development system is identical to the cryptographic key applied to the operational system, so that encrypted real data can be easily decrypted through the development system