Annex 7101 items
Applies to|General ISMS/ISMS-P applicants (full set applies)
1. Establishment and Operation of the Management System
- 1.1.1Participation of Executive Management1.1 Laying the Foundation for the Management System
- 1.1.2Designation of the Chief Officers1.1 Laying the Foundation for the Management System
- 1.1.3Organization Composition1.1 Laying the Foundation for the Management System
- 1.1.4Scope Definition1.1 Laying the Foundation for the Management System
- 1.1.5Policy Establishment1.1 Laying the Foundation for the Management System
- 1.1.6Resource Allocation1.1 Laying the Foundation for the Management System
- 1.2.1Information Asset Identification1.2 Risk Management
- 1.2.2Status and Flow Analysis1.2 Risk Management
- 1.2.3Risk Assessment1.2 Risk Management
- 1.2.4Selection of Protection Measures1.2 Risk Management
- 1.3.1Implementation of Protection Measures1.3 Management System Operation
- 1.3.2Sharing of Protective Measures1.3 Management System Operation
- 1.3.3Management of Operational Status1.3 Management System Operation
- 1.4.1Review of Compliance with Legal Requirements1.4 Management System Inspection and Improvement
- 1.4.2Management System Inspection1.4 Management System Inspection and Improvement
- 1.4.3Management System Improvement1.4 Management System Inspection and Improvement
2. Protective Measure Requirements
- 2.1.1Policy Maintenance2.1 Policy, Organization, and Asset Management
- 2.1.2Maintenance of the Organization2.1 Policy, Organization, and Asset Management
- 2.1.3Information Asset Management2.1 Policy, Organization, and Asset Management
- 2.2.1Designation and Management of Key Personnel2.2 Human Resource Security
- 2.2.2Separation of Duties2.2 Human Resource Security
- 2.2.3Security Pledge2.2 Human Resource Security
- 2.2.4Awareness Raising and Education/Training2.2 Human Resource Security
- 2.2.5Management of Departure and Job Change2.2 Human Resource Security
- 2.2.6Actions in Case of Security Violations2.2 Human Resource Security
- 2.3.1Management of the Status of External Parties2.3 External Party Security
- 2.3.2Security When Contracting with External Parties2.3 External Party Security
- 2.3.3Management of External Party Security Implementation2.3 External Party Security
- 2.3.4Security upon Change or Expiration of External Party Contracts2.3 External Party Security
- 2.4.1Designation of Protected Areas2.4 Physical Security
- 2.4.2Physical Entry Control2.4 Physical Security
- 2.4.3Information System Protection2.4 Physical Security
- 2.4.4Operation of Protective Facilities2.4 Physical Security
- 2.4.5Work within Protected Areas2.4 Physical Security
- 2.4.6Control of Devices Brought In and Out2.4 Physical Security
- 2.4.7Work Environment Security2.4 Physical Security
- 2.5.1User Account Management2.5 Authentication and Authorization Management
- 2.5.2User Identification2.5 Authentication and Authorization Management
- 2.5.3User Authentication2.5 Authentication and Authorization Management
- 2.5.4Password Management2.5 Authentication and Authorization Management
- 2.5.5Management of Special Accounts and Privileges2.5 Authentication and Authorization Management
- 2.5.6Review of Access Rights2.5 Authentication and Authorization Management
- 2.6.1Network Access2.6 Access Control
- 2.6.2Information System Access2.6 Access Control
- 2.6.3Application Access2.6 Access Control
- 2.6.4Database Access2.6 Access Control
- 2.6.5Wireless Network Access2.6 Access Control
- 2.6.6Remote Access Control2.6 Access Control
- 2.6.7Internet Access Control2.6 Access Control
- 2.7.1Application of Cryptographic Policy2.7 Application of Encryption
- 2.7.2Cryptographic Key Management2.7 Application of Encryption
- 2.8.1Definition of Security Requirements2.8 Information System Introduction and Development Security
- 2.8.2Review and Testing of Security Requirements2.8 Information System Introduction and Development Security
- 2.8.3Separation of Test and Operational Environments2.8 Information System Introduction and Development Security
- 2.8.4Test Data Security2.8 Information System Introduction and Development Security
- 2.8.5Source Program Management2.8 Information System Introduction and Development Security
- 2.8.6Transition to the Operational Environment2.8 Information System Introduction and Development Security
- 2.9.1Change Management2.9 System and Service Operation Management
- 2.9.2Performance and Fault Management2.9 System and Service Operation Management
- 2.9.3Backup and Recovery Management2.9 System and Service Operation Management
- 2.9.4Log and Access Record Management2.9 System and Service Operation Management
- 2.9.5Log and Access Record Review2.9 System and Service Operation Management
- 2.9.6Time Synchronization2.9 System and Service Operation Management
- 2.9.7Reuse and Disposal of Information Assets2.9 System and Service Operation Management
- 2.10.1Security System Operation2.10 System and Service Security Management
- 2.10.2Cloud Security2.10 System and Service Security Management
- 2.10.3Public Server Security2.10 System and Service Security Management
- 2.10.4Electronic Transaction and Fintech Security2.10 System and Service Security Management
- 2.10.5Information Transmission Security2.10 System and Service Security Management
- 2.10.6Security of Business Terminals2.10 System and Service Security Management
- 2.10.7Removable Storage Media Management2.10 System and Service Security Management
- 2.10.8Patch Management2.10 System and Service Security Management
- 2.10.9Malicious Code Control2.10 System and Service Security Management
- 2.11.1Establishment of an Incident Prevention and Response System2.11 Incident Prevention and Response
- 2.11.2Vulnerability Assessment and Remediation2.11 Incident Prevention and Response
- 2.11.3Analysis and Monitoring of Anomalous Behavior2.11 Incident Prevention and Response
- 2.11.4Incident Response Training and Improvement2.11 Incident Prevention and Response
- 2.11.5Incident Response and Recovery2.11 Incident Prevention and Response
- 2.12.1Safety Measures for Disaster/Emergency Preparedness2.12 Disaster Recovery
- 2.12.2Disaster Recovery Testing and Improvement2.12 Disaster Recovery
3. Requirements by Personal Information Processing Stage
- 3.1.1Collection/Use of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.2Limitation on Collection of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.3Restrictions on Processing Resident Registration Numbers3.1 Protective Measures When Collecting Personal Information
- 3.1.4Restrictions on Processing Sensitive Information and Unique Identifying Information3.1 Protective Measures When Collecting Personal Information
- 3.1.5Indirect Collection of Personal Information3.1 Protective Measures When Collecting Personal Information
- 3.1.6Installation/Operation of Video Information Processing Devices3.1 Protective Measures When Collecting Personal Information
- 3.1.7Collection/Use of Personal Information for Marketing Purposes3.1 Protective Measures When Collecting Personal Information
- 3.2.1Personal Information Status Management3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.2Ensuring Personal Information Quality3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.3Protection of User Device Access3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.4Use and Provision of Personal Information Beyond the Purpose3.2 Protective Measures When Retaining and Using Personal Information
- 3.2.5Processing of Pseudonymized Information3.2 Protective Measures When Retaining and Using Personal Information
- 3.3.1Provision of Personal Information to Third Parties3.3 Protective Measures When Providing Personal Information
- 3.3.2Outsourcing of Personal Information Processing Tasks3.3 Protective Measures When Providing Personal Information
- 3.3.3Transfer of Personal Information Due to Business Transfer, etc.3.3 Protective Measures When Providing Personal Information
- 3.3.4Cross-Border Transfer of Personal Information3.3 Protective Measures When Providing Personal Information
- 3.4.1Destruction of Personal Information3.4 Protective Measures When Destroying Personal Information
- 3.4.2Measures When Retaining Personal Information After the Processing Purpose Is Achieved3.4 Protective Measures When Destroying Personal Information
- 3.5.1Disclosure of the Privacy Policy3.5 Protection of Data Subject Rights
- 3.5.2Guaranteeing the Rights of Data Subjects3.5 Protection of Data Subject Rights
- 3.5.3Notification to Data Subjects3.5 Protection of Data Subject Rights