Work Environment Security

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.4.7 Work Environment Security], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Protective measures shall be established and implemented for shared facilities and office equipment such as document storage rooms, shared PCs, multifunction printers, and file servers.

• Document storage rooms : minimize the number of persons with access, grant access rights by department/task, manage access records
• Shared PCs : designate a person in charge, set up screen savers, set login passwords, change passwords periodically, restrict storage of important information, install antivirus software, apply security updates, etc.
• Shared office equipment : prohibit leaving important documents around shared office equipment such as fax machines, copiers, and printers
• File servers : grant access rights by department/task, minimize unnecessary disclosure of information, issue accounts per user
• Shared offices : prohibit leaving important information (personal information) documents around shared offices such as meeting rooms and project rooms
• Establish protective measures for other shared work environments

Protective measures shall be established and implemented to prevent the leakage/exposure of personal information and important information through individual work environments such as work PCs, desks, and drawers.

• Protective measures when away from the desk : prohibit leaving personal information, documents containing personal information, and auxiliary storage media unattended (clean desk), set up screen savers and passwords, etc.
• Prohibit exposing login information (passwords, etc.) on monitors, desks, etc.
• Store documents and auxiliary storage media containing personal information and important information in a secure location with locking devices
• Shred documents containing personal information and important information using a shredder, etc., so that they cannot be recovered
• Take measures to prevent unauthorized persons from accessing and arbitrarily operating management terminals, etc.

Necessary protective measures shall be taken to prevent the loss/theft/leakage of personal information through printed/copied materials of personal information, such as paper printouts containing personal information, and to safely manage printed/copied materials.

※ Protective measures for printed/copied materials (examples)

• Establish policies, regulations, and guidelines for the protection and management of printed/copied materials
• Prepare and maintain a production/management register for printed/copied materials
• Designate and operate a department that operates/manages printed/copied materials
• Control/report/restrict the external removal and reproduction of printed/copied materials
• Store and manage records of printed/copied materials, such as the person who printed them and the print date/time
• Establish a disposal plan that includes disposal procedures for paper printouts and confirmation of disposal, and conduct periodic inspections
• Apply security technologies for printed/copied materials, such as multifunction printer security and output watermarks, etc.

Compliance with information security requirements in individual and shared work environments shall be reviewed periodically.

• Manage persons who fail to comply with individual and shared work environment security regulations in accordance with the reward and penalty regulations

※ Office security inspection methods (examples)

• Individual work environment : self-diagnose compliance with information security requirements; the managing department periodically inspects compliance with information security requirements
• Shared work environment : periodically inspect compliance with shared work protective measures; announce or provide training on non-compliance matters