Management of Operational Status
Certification criterion
The operational activities and their execution records that must be performed on an ongoing or periodic basis in accordance with the management system established by the organization shall be recorded and managed so that they can be identified and traced, and management shall periodically verify and manage the effectiveness of the operational activities.
Key checkpoints
- Are the information security and personal information protection activities that must be performed periodically or on an ongoing basis for management system operation documented and managed?
- Does management periodically verify and manage the effectiveness of the management system operational activities?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.3.3 Management of Operational Status], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
For the effective operation of the management system, the organization shall identify the information security and personal information protection activities that require periodic or ongoing execution on a daily/weekly/monthly/quarterly/semiannual/annual basis, and shall prepare and manage a document (operational status table) that defines the execution cycle and timing, the responsible party (responsible department, person in charge), and so on, so that the operational status can be easily verified.
※ Periodic information security and personal information protection activities (examples)
- Review of access records of key job holders and personal information handlers
- Review of access rights of key job holders
- Holding of regular information security and personal information protection committee meetings
- Information security and personal information protection education
- Office security inspection
- Review of amendments to information security and personal information protection policies/guidelines
- Legal compliance review
- Breach response drills, IT disaster recovery drills
- Internal audit, etc.
Management shall periodically verify the effectiveness of the management system operational activities and, when problems are found, shall manage them by improving them and taking similar measures.
- Periodically verify whether the management system operational activities are being carried out periodically/on an ongoing basis in accordance with the operational status table, and report to management
- Management evaluates the effectiveness of the management system operational activities and, when necessary, takes improvement measures (changing the responsible party, adjusting the execution cycle, adding/changing/deleting operational activities, etc.)
Related laws
- Personal Information Protection Act Article 31 (Designation of the Chief Privacy Officer, etc.)
- Network Act Article 45-3 (Designation of the Chief Information Security Officer, etc.)
Evidence (examples)
- Annual information security and personal information protection plan
- Information security and personal information protection operational status table
- Results of the inspection on whether information security and personal information protection activities have been performed
Nonconformity examples
- The case where, among the operational status of the information security and personal information protection management system, the status of activities requiring periodic or ongoing execution has not been documented
- The case where the operational status of the information security and personal information protection management system was documented, but periodic review of that operational status was not carried out, so that some information security and personal information protection activities requiring monthly and quarterly execution were omitted and, for some, whether they were implemented could not be verified