Status and Flow Analysis

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 4Cases 3

Certification criterion

The work procedures and flows across all areas of the management system shall be identified and documented, and these shall be periodically reviewed to keep them up to date.

Key checkpoints

Is the information service status across all areas of the management system identified, and are business procedures and flows understood and documented?
Are the work procedures reviewed periodically in response to changes in services, work, and information assets, so that related documents such as flow diagrams are kept up to date?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.2.2 Status and Flow Analysis], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Status and flow analysis is a preliminary stage of risk analysis and provides the baseline material for conducting risk analysis from various perspectives. It can also be effectively used by management to understand the information security status and to make decisions for risk management.

Status analysis identifies the differences between the certification criteria and the operational status through a GAP analysis table that compares the certification criteria with the operational status.
Flow analysis is divided into information service flow analysis and stage-by-stage personal information processing flow analysis, and the results are diagrammed as a flow table or a flow diagram.

※ The information service flow diagram refers to an access control concept diagram that depicts, on a user basis, the interconnection of the organization's business procedures, information security requirements, and security controls. ※ The personal information flow diagram refers to a concept diagram that depicts the flow at a glance across the personal information processing stages of collection, retention, use/provision, and destruction.

The organization shall identify the information service status across all areas of the management system, and understand and document business procedures and flows.

Identify the status of all information services within the scope of the management system.
Understand the business procedures and flows for each information service.

Document business procedures and flows: business status table, business flow diagram, etc.

Information service flow diagram (system operator example)

flowchart LR
  subgraph EXT["External network"]
    subgraph EXT_PC["PC"]
      EPC["External PC<br>- Antivirus<br>- Screen capture prevention"]
    end
    subgraph EXT_NET["Network"]
      INET(("Internet"))
    end
    SSLVPN["SSL<br>VPN<br>- ID/PW + OTP"]
    subgraph EXT_SRV["Server"]
      EVDI["VDI for external access<br>- Antivirus<br>- E-DLP<br>- DRM<br>- PMS<br>- Output security"]
    end
  end
  subgraph INT["Internal network"]
    subgraph INT_PC["PC"]
      WPC["Work PC<br>- Antivirus<br>- EDR<br>- E-DLP<br>- PC security<br>- DRM<br>- NAC<br>- PMS<br>- Print output security"]
    end
    subgraph INT_NET["Network"]
      WVDI["VDI for work<br>- Antivirus<br>- E-DLP<br>- DRM<br>- PMS<br>- Print output security"]
    end
    subgraph INT_SRV["Server"]
      SAC["Server access control<br>- ID/PW<br>+OTP+<br>IP restriction"]
      DAC["DB access control<br>- ID/PW<br>+OTP+<br>IP restriction"]
      SRV["Server"]
    end
    subgraph INT_DB["DB"]
      DBSRV["DB server<br>- Secure<br>OS"]
      DBMS[("DBMS")]
    end
  end
  EPC -->|"VPN tunneling"| INET
  INET --> SSLVPN
  SSLVPN --> EVDI
  EVDI -->|"Server zone<br>firewall"| SAC
  WPC -->|"VDI zone<br>firewall"| WVDI
  WVDI --x|"VDI zone<br>firewall<br>Internet blocked"| INET
  WVDI -->|"Server zone<br>firewall"| SAC
  WVDI -->|"Server zone<br>firewall"| DAC
  SAC --> SRV
  SAC -->|"DB zone<br>firewall"| DBSRV
  DAC -->|"DB zone<br>firewall"| DBMS

	PC	Network	Server	DB
Description of key protective measures	Security programs such as antivirus and EDR installed on work PCs, and non-business sites, etc. blocked For external access, antivirus and screen capture prevention programs forcibly installed on the external PC	Servers and DBs accessed through the VDI for work (direct access controlled at the firewall) Internet blocked from the VDI for work through the VDI zone firewall External access : VPN (ID/PW+OTP) → VDI for external access	Servers accessible through the server access control system (direct access to servers blocked at the server zone firewall) DBMS accessible through the DB access control system (controlled by the DB zone firewall ACL) Server access control and DB access control authenticate with ID/PW + OTP + IP restriction	SecureOS installed on the DB server (logging, control of connections between servers, command control, etc.) Direct connection to the DBMS from the DB server is subject to command control in SecureOS (sqlplus, etc.)

The organization shall identify the status of personal information processing within the scope of the management system and understand the flow of personal information, documenting it in a personal information flow table, personal information flow diagram, etc. (in the case of ISMS-P certification).

(Step 1) Identify the unit tasks in which personal information processing takes place.

(Step 2) Prepare a personal information flow table by personal information life cycle for each unit task.

※ Example of preparing a personal information flow table (source: Guide to Conducting Privacy Impact Assessments)

Example of a collection flow table

Task name	Collection
	Collection items	Collection route	Collection target	Collection cycle	Person in charge of collection	Basis for collection
Member management (member registration)	Mandatory: name, date of birth, gender, disability type, member ID, password, address occupation, phone number, mobile phone, email, Optional: ○○○, disability certificate file, ○○○ name, field of interest, ○○○, nearby ○○○ information	Homepage (online)	Data subject	As needed	Person in charge of the homepage	Consent of the data subject

Example of a retention/use flow table

Task name	Retention, use
	Retention form	Encrypted items	Items used	Purpose of use	Personal information handler	Method of use
Member management (member registration)	DB	Password (SHA-256)	Mandatory: name, date of birth, gender, disability type, member ID, password, address occupation, phone number, mobile phone, email, Optional: ○○○, disability certificate file, ○○○ name, field of interest, ○○○, nearby ○○○ information	The person in charge manages member information	Person in charge of the homepage	Accesses the homepage using a personal PC, selects the relevant menu, and views member information

Example of a destruction flow table

Task name	Destruction
	Retention period	Person in charge of destruction	Destruction procedure	Separate storage
Member management (member registration)	Deleted without delay after membership withdrawal, or up to 3 years	Person in charge of the homepage	The relevant record is deleted from the table when the purpose is achieved. However, it is not destroyed after the period elapses

(Step 3) Based on the prepared personal information flow tables, prepare an overall personal information flow diagram and business-specific personal information flow diagrams so that the flow can be grasped at a glance across the personal information processing stages of collection, retention, use/provision, and destruction.

※ Example of preparing a personal information flow diagram (source: Guide to Conducting Privacy Impact Assessments)

Example personal information flow diagram: overall (integrated) flow diagram

flowchart LR
  subgraph LIFE["Personal information life cycle"]
    subgraph COL["Collection"]
      subgraph COL_TASK["Related tasks"]
        TC1("Member management")
        TC2("Library tour<br>application management")
      end
      subgraph COL_SUBJ["Data subject/personal information handler"]
        SMEM("Member"):::subj
        SFOR("Foreign group<br>representative"):::subj
        SLIB("Library tour<br>staff PC"):::handler
      end
    end
    subgraph RET["Retention/use/provision"]
      subgraph RET_TASK["Related tasks"]
        TR1("Other event management")
        TR2("Member management")
        TR3("Library tour<br>application management")
        TR4("Community service<br>application management")
        TR5("Volunteer work<br>application management")
        TR6("Other<br>event management")
        TR7("Education program<br>management")
        TR8("Humanities on the Road<br>event management")
      end
      subgraph RET_SUBJ["Data subject/personal information handler"]
        SNON("Non-member"):::subj
        P1("Member/task<br>staff PC"):::subj
        P2("Member/task<br>staff PC"):::subj
        P3("Member/task<br>staff PC"):::subj
        P4("Member/task<br>staff PC"):::subj
        P5("Member/task<br>staff PC"):::subj
        P6("Member/task<br>staff PC"):::subj
        P7("Member/task<br>staff PC"):::subj
      end
      subgraph RET_FLOW["Personal information processing flow"]
        TDB[("Integrated member<br>DB")]
        HDB[("Homepage<br>DB")]
        BUS(( ))
        NTDB["When a member applies<br>to use a service, each<br>system transfers the basic<br>information in the<br>integrated member DB<br>to the homepage DB<br>and uses it"]:::note
      end
      subgraph RET_EXT["External linkage/provision"]
        SPON("Sponsor<br>(travel agency)"):::handler
        NSPON["For the purpose of<br>travel insurance enrollment"]:::note
      end
    end
    subgraph DES["Destruction"]
      D3Y["Destroyed when the 3-year<br>retention period elapses"]:::dashed
      NADD["Additional materials : foreign library tour application form, community service<br>information use consent form, Humanities on the Road on-site participation application form"]:::note
      subgraph DES_FLOW["Personal information processing flow"]
        DNOT("DB<br>not destroyed")
        DDEL("DB destruction")
      end
      subgraph DES_EXT["External linkage/provision"]
        DMEMO["Destroyed immediately after<br>membership withdrawal, but<br>not destroyed when the 3-year<br>validity period elapses"]
      end
    end
  end
  subgraph LEG["Legend"]
    LG1A[" "]:::note -->|"Online"| LG1B[" "]:::note
    LG2A[" "]:::note -.->|"Offline"| LG2B[" "]:::note
    LG3A[" "]:::note ==>|"Encryption"| LG3B[" "]:::note
    LG4("Data subject"):::subj
    LG5("Personal information handler"):::handler
  end
  TC1 --- SMEM
  TC2 --- SFOR
  SFOR -.-> SLIB
  SMEM ==>|"Member personal details"| TDB
  SLIB -->|"Proxy application entry"| HDB
  TR1 --- SNON
  SNON -->|"Event participation application information"| HDB
  TR2 --- P1
  TDB ==>|"Inquiry and<br>member information modification"| P1
  TR3 --- P2
  TR4 --- P3
  TR5 --- P4
  TR6 --- P5
  TR7 --- P6
  TR8 --- P7
  HDB ---|"Application and<br>approval,<br>inquiry<br>(similar for<br>each task)"| BUS
  BUS --> P2
  BUS --> P3
  BUS --> P4
  BUS --> P5
  BUS --> P6
  BUS --> P7
  TDB --> HDB
  TDB ~~~ NTDB
  HDB --> SPON
  SPON ~~~ NSPON
  TDB --> DDEL
  HDB -.- DNOT
  DDEL --> DMEMO
  D3Y ~~~ NADD
  classDef subj fill:#ffffff,stroke:#8c8c8c
  classDef handler fill:#b4c7e7,stroke:#8eaadb
  classDef dashed fill:#ffffff,stroke:#8c8c8c,stroke-dasharray:5 5
  classDef note fill:none,stroke:none

Example of a business-specific personal information flow diagram (detailed)

flowchart LR
  subgraph LIFE["Personal information life cycle"]
    subgraph COL["Collection"]
      subgraph COL_SUBJ["Data subject/personal information handler"]
        FG("Foreign<br>group"):::subj
        EVT("Event task<br>staff"):::handler
      end
      subgraph COL_FLOW["Personal information processing flow"]
        M1("○○○<br>management task")
      end
    end
    MEM1("Member"):::subj
    M2("○○○<br>management task")
    subgraph RET["Retention/use/provision"]
      subgraph RET_SUBJ["Data subject/personal information handler"]
        GY("Tour task<br>staff"):::handler
        MEM2("Member"):::subj
        MEM3("Member"):::subj
      end
      subgraph RET_FLOW["Personal information processing flow"]
        M3("○○○<br>management task")
        OO("○○")
        M4("○○○<br>management task")
        HDB[("Homepage<br>DB")]
        MC["C"]:::note
        TDB[("Integrated member<br>DB")]
        XLS("Excel<br>file")
      end
      subgraph RET_EXT["External linkage/provision"]
        TRV("Travel agency"):::handler
      end
    end
    subgraph DES["Destruction"]
      subgraph DES_FLOW["Personal information processing flow"]
        D3Y["Destroyed when the 3-year<br>retention period elapses"]:::dashed
        DNOSET["Retention period<br>not set"]
        DNOT("DB not<br>destroyed")
      end
    end
  end
  subgraph LEG["Legend"]
    LG1A[" "]:::note -->|"Online"| LG1B[" "]:::note
    LG2A[" "]:::note -.->|"Offline"| LG2B[" "]:::note
    LG3A[" "]:::note ==>|"Encryption"| LG3B[" "]:::note
    LG4("Data subject"):::subj
    LG5("Personal information handler"):::handler
  end
  FG -.-> EVT
  EVT ---|"Tour reservation ❶<br>receipt A"| M1
  M1 --> HDB
  MEM1 ---|"○○○<br>tour reservation application<br>(some information<br>newly collected ❶ A"| M2
  M2 --> HDB
  MEM1 -->|"○○○<br>tour reservation application<br>(existing information<br>transferred) ❷"| M2
  M2 --> TDB
  EVT -.->|"Application form ❶"| D3Y
  M3 -->|"- Review/approval of<br>received details ❸ B<br>- Reservation cancellation<br>approval/application<br>status inquiry"| GY
  M3 --> HDB
  TDB -->|"❷"| HDB
  HDB ~~~ MC
  HDB --- OO
  OO -->|"Application result/ ❸<br>reservation cancellation<br>confirmation"| MEM2
  MEM3 ---|"Reservation cancellation<br>request ❸"| M4
  M4 --> HDB
  HDB --> XLS
  XLS -->|"❹ B"| TRV
  HDB -.-|"D"| DNOT
  classDef subj fill:#ffffff,stroke:#8c8c8c
  classDef handler fill:#b4c7e7,stroke:#8eaadb
  classDef dashed fill:#ffffff,stroke:#8c8c8c,stroke-dasharray:5 5
  classDef note fill:none,stroke:none

Personal information processed
① Mandatory : affiliation (group name), group leader, mobile phone
② Mandatory : name (applicant), phone number, email, address Optional : mobile phone
③ Mandatory : name (applicant), phone number, email, address, affiliation (group name), group leader Optional : mobile phone

Description of key business flows
The applicant applies for a tour of the main building or the annex through the ○○ tour application screen (in the case of a foreign group, when the group asks the ○○○ tour person in charge to apply for tour participation, the person in charge applies on its behalf with his or her own ID
The ○○○ task person in charge reviews the application details and registers the review result (review result - under review, approved, rejected, on hold, canceled)
The applicant checks the application result through ‘○○’
When a reservation that has been approved is to be canceled, the applicant asks the ○○○ tour task person in charge to cancel it, and the cancellation is processed

Concerns
A. Some newly collected personal information is collected without the consent of the data subject (3.1.1)
B. Strengthened password composition rules are not applied, so a third party may be able to find out passwords (4.1.2)
C. No separate processing log is recorded for personal information stored in the homepage DB, so traceability is not secured when a security incident occurs (4.4.1)
D. The retention period of personal information is not set and the information is not destroyed, so personal information may be leaked or misused (3.5.1)

The organization shall periodically review (at least once a year) the business procedures and personal information flows in line with changes in services, business, information assets, etc., referring to the following perspectives, and shall manage them to keep them current.

Whether existing services, business, and personal information flows have changed (opening or reorganization of new services, changes in business procedures, changes in personal information processing methods, organizational changes, changes in external linkage and provision flows, etc.)
Whether the important information or personal information items being processed have changed
Whether the type, configuration, functions, etc. of information systems and personal information processing systems have changed
Whether new personal information processing tasks and flows have arisen
Whether the external environment has changed, such as amendments to laws or the emergence of new vulnerabilities

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

Information service status table
Information service business flow table / business flow diagram
Personal information processing status table (in the case of ISMS-P certification)
Personal information flow table / flow diagram (in the case of ISMS-P certification)

Nonconformity examples

When the business procedures/flows and status of key services within the scope of the management system have not been documented
When a personal information flow diagram has been prepared, but there are numerous parts that differ from the actual personal information flow, or important personal information flows are omitted
When, after the initial preparation of the personal information flow diagram, it has not been kept current, so that changed personal information flows are not reflected in the flow diagram