Management of Departure and Job Change
Certification criterion
Upon departure and job change, procedures such as asset return, revocation/adjustment of accounts and access rights, and result confirmation, which must be carried out by each relevant department (HR, information security, personal information protection, IT, etc.), shall be established and managed.
Key checkpoints
- Are personnel change details arising from departure, job change, department transfer, leave of absence, etc. shared among the HR department, the information security and personal information protection department, and the departments operating information systems and personal information processing systems?
- Upon the departure or job change of personnel within the organization (employees, temporary staff, outsourced service staff, etc.), are procedures such as prompt return of information assets, revocation/adjustment of access rights, and result confirmation established and implemented?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.2.5 Management of Departure and Job Change], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
Personnel change details arising from departure, job change, department transfer, leave of absence, etc. must be promptly shared among the relevant departments, such as the HR department, the information security department, the personal information protection department, and the system operation department.
-
Establish/implement procedures so that personnel change details can be promptly shared among related organizations and systems
※ Procedures for prompt sharing of personnel change details (examples)
- Linking information processing systems with the HR system to synchronize account information in real time or via a daily batch
- Building an integrated account registration/management system for partner company personnel to synchronize accounts with individual systems
- Including within the departure process a procedure to share departing employee information with the relevant departments, etc.
Upon the departure and job change of personnel within the organization (employees, temporary staff, outsourced service staff, etc.), procedures such as prompt return of information assets, revocation/adjustment of access rights, and result confirmation must be established and implemented.
- Establish/implement procedures such as return of access passes and assets, deletion or locking of accounts, revocation/adjustment of access rights, and security checks upon departure and job change
- If an account had unavoidably been shared, immediately change the password of that account
- Retain related records and periodically review compliance with the departure procedures, etc.
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 5 (Management of Access Rights)
Evidence (examples)
- Departure and job change procedure document
- Asset (account) return management ledger for departure
- Departing employee security check checklist and check records
Nonconformity examples
- A case where the account and rights of personnel excluded from the personal information handlers due to a job change still remain in the personal information processing system
- A case where, for key job holders and personal information handlers who recently departed, records of implementation of departure procedures such as asset return and rights revocation cannot be confirmed
- A case where asset return management upon an employee's departure is well implemented, but the departing employee security check and departure confirmation form specified in the HR regulations are not prepared
- A case where, upon the departure of a personal information handler, access rights to the personal information processing system were revoked without delay, but access rights to some systems such as the access control system and VPN were not revoked