Vulnerability Assessment and Remediation

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.11.2 Vulnerability Assessment and Remediation], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

A procedure for information system vulnerability assessment shall be established, and assessments shall be performed regularly.

• Matters to be included in the vulnerability assessment procedure
  • Targets of vulnerability assessment (e.g., servers, network devices, etc.)
  • Vulnerability assessment cycle (considering legal requirements, criticality, etc.)
  • Designation of persons in charge of and responsible for vulnerability assessment
  • Vulnerability assessment procedure and methods, etc.
  • Remediation criteria according to criticality
  • Procedure for reporting vulnerability assessment results
  • Security review of unremediated vulnerabilities, etc.
  • Other matters necessary for the prevention of and recovery from security incidents, etc.
• Targets of vulnerability assessment
  • Vulnerabilities in the configuration and settings of network systems such as routers and switches
  • Vulnerabilities in server OS security settings
  • Vulnerabilities in security systems such as firewalls
  • Application vulnerabilities
  • Web service vulnerabilities
  • Vulnerabilities in smart devices and mobile services (mobile apps, etc.), etc.
• When carrying out vulnerability assessments, consider performing penetration testing depending on the size of the company and the criticality of the information it holds
• Personal information controllers must include matters concerning vulnerability assessment for preventing the leakage or theft of personal information in their internal management plan and establish/implement it (Standards for Measures to Ensure the Safety of Personal Information Article 4(1)10)

Discovered vulnerabilities shall be remediated, and the results shall be reported to the responsible officer.

• During vulnerability assessment, prepare a report that includes the date and time of the assessment, the assessment target, the assessment method, the assessment content and results, findings, and remediation actions, etc., so that history management is possible
• After completing the response actions for each vulnerability, confirm completion through implementation checks, etc.
• For vulnerabilities that unavoidably cannot be remediated, clearly identify the reason and report the associated risk and supplementary measures to the responsible officer

The occurrence of the latest security vulnerabilities shall be continuously monitored, and their impact on information systems shall be analyzed and addressed.

• In addition to regular security vulnerability assessments, continuously monitor the latest security vulnerabilities
• When the latest security vulnerability is discovered, analyze the impact of that security vulnerability on information systems and take response actions as necessary

The vulnerability assessment history shall be recorded and managed, and protective measures shall be prepared for problems such as the recurrence of vulnerabilities identified in the previous year.

• Record management of the vulnerability assessment history
• During vulnerability assessment, compare and analyze against previous vulnerability assessment results to check whether vulnerabilities have recurred
• If similar vulnerabilities are recurring, analyze the root cause and prepare measures to prevent recurrence