Maintenance of the Organization
Certification criterion
The organization shall assign information security and personal information protection roles and responsibilities to each of its members, and shall establish and operate a system for evaluating those activities as well as a system that enables mutual communication among the organization and its members.
Key checkpoints
- Are the roles and responsibilities of the officers and staff responsible for information security and personal information protection clearly defined?
- Is a system established for evaluating the activities of the officers and staff responsible for information security and personal information protection?
- Are systems and procedures for mutual communication among the information security and personal information protection organization and its members established and implemented?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.1.2 Maintenance of the Organization], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
The roles and responsibilities of the relevant officers and staff shall be defined specifically in the implementing documents, taking into account the characteristics of the organization related to carrying out information security and personal information protection work.
- Chief Information Security Officer and Chief Privacy Officer
- Information security and personal information protection managers and staff
- Information security and personal information protection officers and staff for each department
- The Chief Information Security Officer and the Chief Privacy Officer perform the following duties, reflecting legal requirements and other considerations
| Chief Information Security Officer | Chief Privacy Officer |
|---|---|
| Establishment, implementation, and improvement of the information security plan Periodic auditing and improvement of information security practices and conditions Identification and assessment of information security risks and preparation of information security countermeasures Establishment and implementation of information security education and simulation training plans Implementation of other measures necessary for information security in accordance with the Network Act or related laws |
Establishment and implementation of the personal information protection plan Periodic investigation and improvement of the status and practices of personal information processing Handling of complaints and remedy of damages related to personal information processing Establishment of an internal control system to prevent leakage, misuse, and abuse of personal information Establishment and implementation of the personal information protection education plan Protection, management, and supervision of personal information files Establishment, modification, and implementation of the privacy policy Management of materials related to personal information protection Destruction of personal information whose processing purpose has been achieved or whose retention period has elapsed |
- The responsibilities and roles are defined specifically through job descriptions and similar documents so that the information security and personal information protection managers, protection staff, and protection practitioners can practically support and carry out the management duties of the Chief Information Security Officer and the Chief Privacy Officer
A system for evaluating the activities of the officers and staff responsible for information security and personal information protection shall be established.
- Prepare methods for evaluating information security and personal information protection activities, such as key performance indicators (KPI), MBO (Management By Objectives), and personnel evaluations within the organization, and conduct periodic evaluations
Systems and procedures enabling mutual communication among the information security and personal information protection organization and its members shall be established and implemented.
-
Establishment and implementation of a communication management plan related to information security and personal information protection
※ Communication management plan related to information security and personal information protection (example)
- Overview of the communication management plan : purpose and scope
- Communication system : operation methods for reporting and consultative bodies such as company-wide consultative bodies, working-level consultative bodies, and committees, participants, roles and responsibilities of each participant, cycles, etc.
- Communication methods : reporting and meetings (monthly reports, weekly reports, etc.), announcements, email, messenger, information security portal, etc.
- Communication formats : report formats by type, meeting minutes formats, etc.
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures), Article 31 (Designation of the Chief Privacy Officer, etc.)
- Network Act Article 45-3 (Designation of the Chief Information Security Officer, etc.)
- Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)
Evidence (examples)
- Information security and personal information protection organization chart
- Job descriptions for the information security and personal information protection organization
- Information security and personal information protection work division table
- Information security and personal information protection policies/guidelines, internal management plan
- Information security and personal information protection communication management plan
- Communication execution records (monthly reports, weekly reports, internal announcements, etc.)
- Communication channels (information security portal, bulletin board, etc.)
Nonconformity examples
- The case where the roles and responsibilities of the Chief Information Security Officer, the Chief Privacy Officer, and related staff are defined in internal guidelines and job descriptions, but they do not match the actual operating conditions
- The case where a system of goals, criteria, indicators, and the like for periodically evaluating the activities of the Chief Information Security Officer and related staff is not in place
- The case where internal guidelines require the information security staff member of each department to set KPIs related to information security and reflect them in personnel evaluations, but no information security-related items are reflected at all in the KPIs of the departmental information security staff
- The case where a Chief Information Security Officer and a Chief Privacy Officer are designated, but the roles and responsibilities required by the relevant laws are not specifically stated in internal guidelines, job descriptions, or the like