Annex 7-365 items
Applies to|Medium enterprises with ICT-service revenue of KRW 30 billion or more that run no major ICT facilities of their own and use hosting or cloud services certified under ISMS, ISMS-P or CSAPA simplified set that eases the certification burden for SMEs. Detailed explanation follows the corresponding Annex 7 guide.
1. Establishment and Operation of the Management System
- 1.1.1Participation of Executive Management1.1 Laying the Foundation for the Management System
- 1.1.2Designation of the Chief Officers1.1 Laying the Foundation for the Management System
- 1.1.3Organization Composition1.1 Laying the Foundation for the Management System
- 1.1.4Scope Definition1.1 Laying the Foundation for the Management System
- 1.1.5Policy Establishment1.1 Laying the Foundation for the Management System
- 1.2.1Information Asset Identification1.2 Risk Management
- 1.2.2Status and Flow Analysis1.2 Risk Management
- 1.3.1Management of Operational Status1.3 Management System Operation
- 1.4.1Review of Compliance with Legal Requirements1.4 Management System Inspection and Improvement
- 1.4.2Management System Inspection1.4 Management System Inspection and Improvement
- 1.4.3Management System Improvement1.4 Management System Inspection and Improvement
2. Protective Measure Requirements
- 2.1.1Policy Maintenance2.1 Policy, Organization, and Asset Management
- 2.1.2Maintenance of the Organization2.1 Policy, Organization, and Asset Management
- 2.1.3Information Asset Management2.1 Policy, Organization, and Asset Management
- 2.2.1Designation and Management of Key Personnel2.2 Human Resource Security
- 2.2.2Security Pledge2.2 Human Resource Security
- 2.2.3Awareness Raising and Education/Training2.2 Human Resource Security
- 2.2.4Management of Departure and Job Change2.2 Human Resource Security
- 2.3.1Security When Contracting with External Parties2.3 External Party Security
- 2.4.1Physical Entry Control2.4 Physical Security
- 2.4.2Work Environment Security2.4 Physical Security
- 2.5.1User Account Management2.5 Authentication and Authorization Management
- 2.5.2User Identification2.5 Authentication and Authorization Management
- 2.5.3User Authentication2.5 Authentication and Authorization Management
- 2.5.4Password Management2.5 Authentication and Authorization Management
- 2.6.1Network Access2.6 Access Control
- 2.6.2Information System Access2.6 Access Control
- 2.6.3Remote Access Control2.6 Access Control
- 2.6.4Internet Access Control2.6 Access Control
- 2.7.1Application of Cryptographic Policy2.7 Application of Encryption
- 2.8.1Definition of Security Requirements2.8 Information System Introduction and Development Security
- 2.8.2Test Data Security2.8 Information System Introduction and Development Security
- 2.8.3Source Program Management2.8 Information System Introduction and Development Security
- 2.9.1Change Management2.9 System and Service Operation Management
- 2.9.2Backup and Recovery Management2.9 System and Service Operation Management
- 2.9.3Log and Access Record Management2.9 System and Service Operation Management
- 2.10.1Security System Operation2.10 System and Service Security Management
- 2.10.2Security of Business Terminals2.10 System and Service Security Management
- 2.10.3Removable Storage Media Management2.10 System and Service Security Management
- 2.10.4Patch Management2.10 System and Service Security Management
- 2.10.5Malicious Code Control2.10 System and Service Security Management
- 2.11.1Establishment of an Incident Prevention and Response System2.11 Incident Prevention and Response
- 2.11.2Vulnerability Assessment and Remediation2.11 Incident Prevention and Response
- 2.11.3Incident Response and Recovery2.11 Incident Prevention and Response
3. Requirements by Personal Information Processing Stage
- 3.1.1Collection/Use of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.2Limitation on Collection of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.3Restrictions on Processing Resident Registration Numbers3.1 Protective Measures When Collecting Personal Information
- 3.1.4Restrictions on Processing Sensitive Information and Unique Identifying Information3.1 Protective Measures When Collecting Personal Information
- 3.1.5Indirect Collection of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.6Installation/Operation of Video Information Processing Devices3.1 Protective Measures When Collecting Personal Information
- 3.1.7Collection/Use of Personal Information for Marketing Purposes3.1 Protective Measures When Collecting Personal Information
- 3.2.1Personal Information Status Management3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.2Ensuring Personal Information Quality3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.3Protection of User Device Access3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.4Use and Provision of Personal Information Beyond the Purpose3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.5Processing of Pseudonymized Information3.2 Protective Measures When Retaining and Using Personal Information
- 3.3.1Provision of Personal Information to Third Parties3.3 Protective Measures When Providing Personal Information
- 3.3.2Outsourcing of Personal Information Processing Tasks3.3 Protective Measures When Providing Personal Information
- 3.3.3Transfer of Personal Information Due to Business Transfer, etc.3.3 Protective Measures When Providing Personal Information
- 3.3.4Cross-Border Transfer of Personal Information3.3 Protective Measures When Providing Personal Information
- 3.4.1Destruction of Personal Information3.4 Protective Measures When Destroying Personal Information
- 3.4.2Measures When Retaining Personal Information After the Processing Purpose Is Achieved3.4 Protective Measures When Destroying Personal Information
- 3.5.1Disclosure of the Privacy Policy3.5 Protection of Data Subject Rights
- 3.5.2Guaranteeing the Rights of Data Subjects3.5 Protection of Data Subject Rights
- 3.5.3Notification to Data Subjects3.5 Protection of Data Subject Rights