Management System Inspection
Certification criterion
To verify whether the management system is operated effectively in accordance with internal policies and legal requirements, an organization shall form a team of personnel with assured independence and expertise, conduct an inspection at least once a year, and report any problems identified to management.
Key checkpoints
- Is a management system inspection plan established that includes the inspection criteria, scope, cycle, and qualification requirements for inspection personnel, in order to check whether the information security and personal information protection management system is operated effectively in accordance with legal requirements and established policies?
- In accordance with the management system inspection plan, is a team of personnel with assured independence, objectivity, and expertise formed to conduct an inspection at least once a year, and are problems identified reported to management?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [1.4.2 Management System Inspection], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
An organization shall establish a management system inspection plan that includes the inspection criteria, scope, cycle, and qualification requirements for inspection personnel, in order to check whether the information security and personal information protection management system is operated effectively in accordance with legal requirements and established policies, and shall report the plan to management.
- Inspection criteria: Include the information security and personal information protection management system certification criteria
- Inspection scope: Include the entire organization or the certification scope
- Inspection cycle: Must be conducted at least once a year
- Qualification requirements for inspection personnel: Define qualification requirements to assure the objectivity, independence, and expertise of the inspection
In accordance with the management system inspection plan, an organization shall form a team of personnel with assured independence, objectivity, and expertise, conduct an inspection at least once a year, and report problems identified to management such as the Chief Information Security Officer and the Chief Privacy Officer.
- Compose the inspection organization so as to assure the objectivity, independence, and expertise of the inspection
- Conduct the inspection at least once a year in accordance with the inspection plan
- Prepare an inspection result report and report it to management such as the Chief Information Security Officer and the Chief Privacy Officer
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)
Evidence (examples)
- Management system inspection plan (internal inspection plan, internal audit plan)
- Management system inspection results report
- Minutes of the information security and personal information protection committee
Nonconformity examples
- A case where an IT team staff member identified as an inspection target was included among the management system inspection personnel and was involved in inspecting the IT team's management area, thereby undermining the independence of the inspection
- A case where a management system inspection was conducted this year, but the inspection scope was limited to certain areas and did not cover the full scope of the information security and personal information protection management system
- A case where the management system inspection team consisted only of internal staff and external consultants who had participated in the management system establishment process such as risk assessment or vulnerability inspection, so the independence of the inspection cannot be regarded as assured