Policy Maintenance

Based on official sourcesISMSISMS-PCheckpoints 4Evidence 4Cases 5

Certification criterion

Information security and personal information protection policies and implementation documents shall be reviewed periodically in light of laws and regulations, alignment with the policies of higher-level organizations and relevant institutions, and changes in the organization's internal and external environment. When necessary, they shall be established/revised, and the details thereof shall be managed as a history record.

Key checkpoints

Are procedures for periodic validity review of information security and personal information protection policies and implementation documents established/implemented?
When a significant change occurs in the organization's internal or external environment, is its impact on the information security and personal information protection policies and implementation documents reviewed, and are they established/revised when necessary?
When information security and personal information protection policies and implementation documents are established/revised, is a review by stakeholders obtained?
Is history management performed for the establishment/revision records of information security and personal information protection policies and implementation documents?

Detailed explanation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.1.1 Policy Maintenance], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

For information security and personal information protection policies and implementation documents (guidelines, procedures, guidance documents, etc.), procedures for periodic validity review shall be established/implemented, and the relevant policies and implementation documents shall be established/revised when necessary.

Establishment of periodic validity review procedures for information security and personal information protection policies and implementation documents
- ※ Matters to be included in the periodic validity review procedures (examples)
  - Review cycle and timing : review required at least once a year
  - Roles and responsibilities by relevant organization
  - Responsible department and responsible person
  - Review method
  - Follow-up procedures : where establishment/revision of policies and implementation documents is required, the relevant procedures, internal consultation and reporting procedures, etc.
Conduct validity review considering the following matters so that laws and regulations, alignment with the policies of higher-level organizations and relevant institutions, and changes in the organization's internal and external environment can be reflected
- Analyze alignment with the information security and personal information protection policies of higher-level organizations and relevant institutions, and review whether there are elements that do not mutually conform and whether the hierarchical structure among policies is appropriate
- Review whether consistency is maintained across documents in terms of the cycle, level, and method of information security and personal information protection activities
- Review whether establishment/revision of information security and personal information protection laws and regulations (including planned matters) has occurred and whether such matters have been appropriately reflected in the policies and implementation documents
- Reflect the results of risk assessment and management system inspection
- Reflect the discovery of new threats and vulnerabilities, changes in the business environment, changes in the IT environment such as the introduction of new technologies, changes in the information security and personal information protection environment, etc.

When a significant change occurs in the organization's internal or external environment as follows, the impact on the information security and personal information protection policies and implementation documents shall be reviewed, and they shall be established/revised when necessary.

Establishment/revision of information security and personal information protection laws and regulations
Changes in the business environment (entry into new business areas, large-scale organizational restructuring, etc.)
Significant changes in the information security, personal information protection, and IT environment (introduction of new security systems or IT systems, etc.)
Occurrence of internal/external significant security incidents
Discovery of new threats or vulnerabilities, etc.

When establishing/revising information security and personal information protection policies and implementation documents, the relevant content shall be sufficiently consulted/reviewed with stakeholders.

Identify and consult with stakeholders such as the Chief Information Security Officer and the Chief Privacy Officer, information security and personal information protection related organizations, the IT department, departments handling important information and personal information, and handlers of important information and personal information
Consider the business impact and legal compliance resulting from changes to the information security and personal information protection policies and implementation documents
Retain evidence of reviewed matters, such as meeting minutes, and reflect the relevant matters in policies/guidelines, etc.

To record/manage the history of changes (establishment, revision, distribution, disposal, etc.) to information security and personal information protection policies and implementation documents, document management procedures shall be prepared and implemented.

Record and manage the revision history within the document, including document version, date, reason for revision, author, and approver
Distribute and manage documents so that relevant executives and employees can always refer to the latest version

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Information security and personal information protection policies and implementation documents (guidelines, procedures, guides, manuals, etc.)
Results of regular/irregular validity reviews of policies/guidelines
Review meeting minutes and circulation records with departments related to policies/guidelines
Establishment/revision history of policies/guidelines

Nonconformity examples

Where there is no consistency in the password setting rules between the guideline document and the procedure document
Where the targets, cycles, levels, and methods of information security activities (information security training, encryption, backup, etc.) are specified differently across the relevant internal regulations, guidelines, and procedures, resulting in a lack of consistency
Where a database access control solution has been newly introduced and operated to effectively record and manage access to and operation history of the database, but matters concerning access control, operation history, logging, review, etc. are not reflected in internal security guidelines such as the security system security management guideline and the database security management guideline
Where the personal information protection policy has been revised but the effective date of the policy is not specified, and the preparation date, author, approver, etc. of the relevant policy are omitted
Where a significant change has occurred in personal information protection related laws, notices, etc., but the impact of such change on the personal information protection policies and implementation documents was not reviewed, or the changes were not reflected through revision