Awareness Raising and Education/Training

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.2.4 Awareness Raising and Education/Training], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

The annual information security and personal information protection education plan shall be established by specifically including the timing, duration, targets, content, methods, etc. of education as follows, and shall be approved by management.

• Education types : employee awareness-raising education, education for key job holders and personal information handlers, education for entrusted parties (trustees), specialized education, etc.
• Education plan : education purpose, education targets, education content, education methods, education schedule, education hours, etc. (differentiated according to business scale, amount of personal information held, nature of work, education targets, education types, etc.)
• Education approval : reviewing and approving the education plan and supporting budget allocation, etc. so that it can be implemented according to the plan

Education shall be conducted regularly at least once a year according to the annual education plan for all employees and external parties within the scope of the management system, and additional education shall be conducted when there are significant changes to relevant laws and regulations.

• Includes all personnel who directly/indirectly access information assets, such as employees, temporary staff, and outsourcing service company staff

• In the case of entrusted parties (trustees) and dispatched staff, provide relevant materials so that the relevant company can conduct the education, and manage/supervise whether it is implemented

• Conduct education at least once a year (in particular, for personal information handlers, personal information protection education is required at least once a year in accordance with legal requirements)

• The education content shall include all content necessary for employees and relevant external parties to understand and comply with the organization's management system and policies

  ※ Content to be included in information security and personal information protection education (examples)

  • Basic overview of information security and personal information protection, management system establishment and methods, related laws
  • Internal regulations related to information security and personal information protection, administrative/technical/physical measures
  • Cases and response measures for infringement (leakage) incidents of important information and personal information, legal liability in case of violation of regulations, etc.

• Prepare and implement education methods for personnel who could not attend education due to business trips, vacations, work, etc. (additional education for absentees, cascade/relay education, online education, etc.)

• Conduct additional education when significant changes to internal regulations and procedures, internal/external security incidents, changes to relevant laws, etc. occur (however, if the matter is not important, it may be substituted with bulletin board notices, email guidance, booklet distribution, etc.)

When hiring employees and entering into new contracts with external parties, information security and personal information protection education shall be provided before work begins.

• Conduct information security and personal information protection education at the time new personnel arise or before work is performed, so that they become familiar with content such as organizational policies, precautions, and legal liability in case of violation of regulations

Employees within IT, information security, and personal information protection organizations shall be enabled to receive separate education to enhance job-specific expertise related to information security and personal information protection.

• Relevant job holders : IT job holders, Chief Information Security Officer, Chief Privacy Officer, personal information handlers, information security job holders, etc.
• Education courses : participation in conferences/seminars/workshops related to information security and personal information protection, education entrusted to specialized education institutions, internal education by inviting external experts, etc.

Records of education implementation shall be kept, and the effectiveness and appropriateness of education shall be evaluated and reflected in the next education plan.

• After conducting education, keep records such as education notices, education materials, and attendance sheets, and evaluate the appropriateness and effectiveness of the education content through surveys or tests according to predefined evaluation criteria
• Prepare measures for improvement points derived from the education evaluation results and reflect them when establishing the next education plan