Designation of the Chief Officers

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 6Cases 4

Certification criterion

The top management shall designate a Chief Information Security Officer (CISO) who oversees information security work and a Chief Privacy Officer (CPO) who oversees personal information protection work, at an executive level able to allocate resources such as budget and personnel.

Key checkpoints

Does the top management formally designate a chief officer who takes overall responsibility for information security and personal information protection activities?
Are the CISO and the CPO designated at an executive level able to allocate resources such as budget and personnel, and do they meet the qualification requirements under the relevant laws?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.1.2 Designation of the Chief Officers], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

To effectively drive information security and personal information protection activities within the organization, the top management shall formally designate, through procedures such as a personnel order, a CISO and a CPO who can take overall responsibility for them.

The CISO and the CPO shall be formally appointed through a personnel order or equivalent. Where the role is held ex officio, the position shall be specified in the information security and personal information protection policy.

The CISO and the CPO shall be designated at an executive level able to allocate resources such as budget and personnel, and shall meet the qualification requirements under the relevant laws (see Article 36-7 of the Enforcement Decree of the Network Act).

The CISO and the CPO shall be persons with the knowledge and competence in information security and personal information protection to substantively oversee the organization's work, and shall be designated at an executive level able to allocate resources such as budget and personnel.

※ An information and communications service provider shall designate an executive/employee meeting the criteria set by Presidential Decree as its CISO for the security of information and communications systems and the safe management of information, and report this to the Minister of Science and ICT. However, the report may be exempted where the case meets the criteria set by Presidential Decree.

Legal requirements for CISO designation shall be met (see Article 45-3 of the Network Act).

The CISO performs the following duties:

The CISO takes overall charge of the following:
- a. Establishment, implementation, and improvement of the information security plan
- b. Regular audit and improvement of information security practices and status
- c. Identification and assessment of information security risks and preparation of protection measures
- d. Establishment and implementation of information security education and drill plans
The CISO may concurrently perform the following:
- a. Work on information security disclosure under Article 13 of the Act on the Promotion of Information Security Industry
- b. Duties of the information security officer under Article 5(5) of the Act on the Protection of Information and Communications Infrastructure
- c. Duties of the CISO under Article 21-2(4) of the Electronic Financial Transactions Act
- d. Duties of the CPO under Article 31(2) of the Personal Information Protection Act
- e. Other measures necessary for information security under this Act or related laws

CISO designation requirements (Article 36-7(1) of the Enforcement Decree of the Network Act)

No	Category (information and communications service provider)	CISO designation requirement
1	A provider with capital of KRW 100 million or less / a small enterprise / a medium enterprise that is not a telecommunications business operator, not subject to mandatory ISMS certification, not a personal information controller required to disclose its privacy policy, and not a mail-order distributor	Business owner or representative
2	A provider with total assets of KRW 5 trillion or more at the end of the immediately preceding business year / a provider subject to mandatory ISMS certification under Article 47(2) with total assets of KRW 500 billion or more at the end of the immediately preceding business year	A director (including a person under Article 401-2(1)3 of the Commercial Act and an executive officer under Article 408-2 of the same Act). Note: the restriction on concurrent positions shall be observed
3	A provider not falling under No. 1 or No. 2 above	Business owner or representative / a director (including a person under Article 401-2(1)3 of the Commercial Act and an executive officer under Article 408-2 of the same Act) / the head of the department that oversees information security work

Legal requirements for CPO designation shall be met (see Article 32 of the Enforcement Decree of the Personal Information Protection Act, and others).

The CPO performs the following duties:
1. Establishment and implementation of the personal information protection plan
2. Regular investigation and improvement of personal information processing status and practices
3. Handling of complaints and remedy of damage related to personal information processing
4. Building an internal control system to prevent leakage, misuse, and abuse of personal information
5. Establishment and implementation of the personal information protection education plan
6. Protection, management, and supervision of personal information files
7. Establishment, change, and implementation of the privacy policy
8. Management of materials related to personal information protection
9. Destruction of personal information whose processing purpose has been achieved or whose retention period has expired

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures), Article 31 (Designation of the Chief Privacy Officer, etc.)
Network Act Article 45-3 (Designation of the Chief Information Security Officer, etc.)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Materials on the appointment of the CISO and the CPO (personnel order, personnel record, etc.)
Information security and personal information protection organization chart
Information security and personal information protection policy/guidelines
Job descriptions (roles and responsibilities of the CISO and the CPO)
CISO report records
Internal management plan (matters on the designation of the CPO)

Nonconformity examples

Although subject to the CISO designation and reporting duty under the Network Act, the organization has not designated and reported a CISO
A person without substantive authority and standing for personal information protection is designated as the CPO, so it is hard to view them as able to take overall responsibility for personal information processing work
The CISO and the CPO are shown on the organization chart, but they were not appointed through a formal designation procedure such as a personnel order
An information and communications service provider that is subject to mandatory ISMS certification and whose total assets exceeded KRW 500 billion at the end of the previous year has its CISO concurrently serving as CIO