Log and Access Record Management

※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.9.4 Log and Access Record Management] and [2.9.5 Log and Access Record Review], which belong to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

For information systems such as servers, applications, security systems, and network systems, the organization must establish log management procedures and, in accordance with these procedures, generate and retain the necessary logs.

• Identify the log types requiring retention and the target systems

  ※ Major log types (examples)

  • System event logs : logs generated by operating system components (system start, shutdown, status, error codes, etc.)
  • Network event logs : IP address allocation, traffic logs for major segments
  • Security system logs : administrator access, registration/change/deletion of security policies (rule sets), etc.
  • Security-related audit logs : user access records, authentication success/failure logs, file access, account and privilege registration/change/deletion, etc. (servers, applications, security systems, network systems, databases, etc.)
  • Personal information processing system access records : items that make it possible to identify the fact that a personal information handler accessed the personal information processing system, such as the accessor account, access date and time, access location information, information about the data subjects processed, and the tasks performed
  • Other information security-related logs

• Define the log format, retention period, log retention (backup) method, etc. for each system and device

• Establish log management procedures and generate/retain logs accordingly

The log records of information systems must be safely retained so that they are not tampered with, altered, stolen, or lost, and access privileges to the log records must be granted on a minimized basis.

• Log records must be backed up using a separate storage device such as storage, and the granting of access privileges to the log records must be minimized so that tampering, alteration, or deletion of log records by unauthorized persons does not occur

Access records for the personal information processing system must be electronically recorded and safely retained for a certain period, including all necessary items so as to comply with legal requirements.

• Items that must be included in the personal information processing system access records

  Item	Description
  Identifier	Identification information of the accessor, such as the personal information handler ID
  Access date and time	The time of access or the time the task was performed (year/month/day and hour/minute/second)
  Access location information	The accessor's IP address, etc.
  Information about the data subject processed	The data subject's ID, customer number, student number, employee number, etc.
  Task performed	Personal information inquiry, change, entry, deletion, output, download, etc.

• Retention periods for personal information processing system access records

  Field	Retention period
  Access records of personal information handlers - where the system is a personal information processing system that processes the personal information of at least 50,000 data subjects	At least 2 years
  Access records of personal information handlers - where the system is a personal information processing system that processes unique identifying information or sensitive information	At least 2 years
  Access records of personal information handlers - where the personal information controller is a common telecommunications business operator that has registered under Article 6(1) of the Telecommunications Business Act or reported under the proviso to the same paragraph	At least 2 years
  Access records of personal information handlers - where none of the above three conditions apply	At least 1 year

• Personal information access records must be safely retained so that they are not tampered with, altered, stolen, or lost

  ※ Safe retention methods for access records (examples)

  • Perform ongoing backups of access records and store them on separate auxiliary storage media, a separate storage device, object storage, etc., other than the personal information processing system
  • To prevent tampering/alteration of access records, use overwrite-prevention media such as CD-ROM, DVD-R, or WORM (Write Once Read Many)
  • When backing up access records to modifiable media (hard disks, magnetic tapes, etc.), store and manage on a separate device information that can verify whether tampering/alteration has occurred (MAC values, digital signature values, etc.) to ensure integrity

Log review and monitoring procedures, including the log review cycle, targets, and methods, shall be established/implemented so that anomalies such as information system errors, misuse/abuse (unauthorized access, excessive inquiries, etc.), and fraudulent acts can be recognized.

• Review cycle
• Review targets
• Review standards and methods
• Reviewers and responsible persons
• Response procedures when anomalies are found, etc.

The results of log review and monitoring shall be reported to the responsible person, and when anomalies are found, they shall be responded to according to procedures.

• After conducting the review according to the log review and monitoring standards, report the results, including whether anomalies were found, to the relevant responsible person
• When anomalies are found, establish procedures to check whether information leakage, hacking, misuse/abuse, fraudulent acts, etc. have occurred, and respond according to the procedures
• When it is confirmed that personal information has been downloaded, verify the reason according to the log review standards prescribed in the internal management plan, etc., and if it is confirmed that the download was for the purpose of misuse/abuse or leakage of personal information, perform necessary measures without delay, such as retrieving and destroying the personal information downloaded by the personal information handler

The access records of the personal information processing system shall be inspected regularly according to the cycle prescribed by relevant laws.

• Personal information access record inspection cycle under the law: at least once per month