Malicious Code Control

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.10.9 Malicious Code Control], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

To protect information systems, business terminals, and the like from malicious code such as viruses, worms, Trojan horses, and ransomware, protective measures must be established and implemented, including the following contents.

• User PC usage guidelines (prohibition of opening unclear emails and files, prohibition of downloading and installing unauthorized programs, etc.)
• Malicious code response guidelines for information systems and personal information processing systems
• Scope of antivirus program installation (information assets subject to possible malicious program infection)
• Antivirus program installation procedures
• Latest malicious code prevention and detection activities through antivirus programs and the like
• Policy for periodic monitoring of malicious code infection through antivirus programs and the like
• Configuration of the automatic update function of security programs such as antivirus software, or a method of updating at least once per day
• Prohibition of installing unauthorized programs such as P2P and web hard drives on information systems and business computers
• User education and information provision, etc.

The latest malicious code prevention/detection activities must be continuously performed through security programs such as antivirus software.

• Scanning attachments in emails and the like for malicious code infection
• Real-time malicious code monitoring and treatment
• Periodic malicious code inspection: setting an automatic virus inspection schedule
• Maintaining the latest version of the antivirus engine: periodic updates, etc.

Security programs such as antivirus software must be kept up to date, and urgent security updates must be performed when necessary.

• Compliance with the antivirus update cycle: automatic updates or updates at least once per day
• Performing updates accordingly when a malicious program alert is issued or an urgent update notice is given
• When managing antivirus programs using an antivirus central management system, preparing protective measures such as access control for the management server and integrity verification of distributed files

When a malicious code infection is discovered, response procedures to minimize the spread and damage of malicious code must be established and implemented.

• Response procedures when a malicious code infection is discovered (e.g., disconnecting the network cable, etc.)
• Emergency contact network (e.g., antivirus vendor contact person, contacts of relevant institutions, etc.)
• Response report form (including date and time of discovery, response procedures and methods, responder, and preventive measures), etc.