Information Asset Management
Certification criterion
Handling procedures and protective measures according to the purpose and importance of information assets shall be established and implemented, and responsibility for each asset shall be clearly defined and managed.
Key checkpoints
- Are handling procedures (creation/acquisition, storage, use, disposal) and protective measures defined and implemented according to the security grade of information assets?
- Are a responsible person and an administrator designated for identified information assets?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.1.3 Information Asset Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
Handling procedures (creation/acquisition, storage, use, disposal, etc.) according to the security grade of information assets shall be defined, and based on these, appropriate protective measures such as encryption and access control shall be defined and implemented.
- Marking so that employees can identify the security grade (confidential, restricted/internal-only, general, etc.) of each information asset
- (Electronic) documents : marked via a document cover page or watermarking, etc.
- Hardware assets such as servers : security grade confirmed via an asset number or barcode marking, etc.
- Establish/implement handling procedures (creation/acquisition, storage, use, disposal, etc.) and security control standards for each security grade of information asset
For identified information assets, a responsible person who can be accountable for asset acquisition, change, disposal, carry-in/carry-out, security management, etc., and a responsible person and an administrator (or person in charge) who actually manage/operate the asset shall be designated to clarify where responsibility lies.
- Designate a responsible person and an administrator for each information asset and record them in the asset inventory
- When personnel changes such as departure or transfer occur, or when the information asset status changes due to acquisition/change/disposal of information assets, identify the responsible person and person in charge for each information asset and reflect them in the asset inventory
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Information asset inventory (designation of responsible person, person in charge)
- Information asset handling procedures (documents, information systems, etc.)
- Information asset management system screens
- Records of information asset security grade markings
Nonconformity examples
- Where internal guidelines require the security grade to be marked on documents, but this is not marked
- Where the person in charge and responsible person for each information asset have not been identified, or where the asset inventory is inadequately kept current so that, even though the person in charge and responsible person for major information assets have changed due to personnel changes such as departure or transfer, this is not identified
- Where importance assessments of identified information assets are conducted, security grades are assigned, and they are recorded in the information asset inventory, but handling procedures according to the security grade are not defined