Resource Allocation
Certification criterion
The top management shall secure personnel with expertise in each field of information security and personal information protection, and shall allocate the budget and resources needed for the effective implementation and continuous operation of the management system.
Key checkpoints
- Are personnel with expertise in each field of information security and personal information protection secured?
- Are the resources needed for the effective implementation and continuous operation of the information security and personal information protection management system assessed, and are the necessary budget and personnel provided?
- Is a detailed annual action plan for information security and personal information protection work established and implemented, and are review, analysis, and evaluation conducted on its outcomes?
Detailed explanation
The top management shall secure personnel with expertise in each field in order to carry out information security and personal information protection activities smoothly.
- Holding of specialized knowledge and relevant qualifications (holding a degree or certificate related to information security and personal information protection)
- Holding of practical experience related to information security and personal information protection
- Completion of job training related to information security and personal information protection, etc.
The top management shall assess the resources needed for the effective implementation and continuous operation of the information security and personal information protection management system, and shall provide the necessary budget and personnel.
- Assessing the budget and resources needed each year for the effective establishment and continuous operation of the information security and personal information protection management system, and establishing and approving a budget and personnel operation plan
- Continuously providing the necessary resources (personnel, organization, budget, etc.) in accordance with the budget and personnel operation plan
A detailed annual action plan for information security and personal information protection work shall be established and implemented, and review, analysis, and evaluation shall be conducted on its outcomes.
- Establishing a detailed annual action plan for information security and personal information protection work to effectively carry out that year's information security and personal information protection work, reporting it to management, and implementing it
- Reviewing, analyzing, and evaluating the outcomes achieved under the detailed action plan, and reporting them to management
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Annual action plan for information security and personal information protection activities (budget and personnel operation plan)
- Result report on information security and personal information protection activities
- Records of information security and personal information protection investments
- Information security and personal information protection organization chart
Nonconformity examples
- A case where, in composing the information security and personal information protection organization, the security personnel are made up only of persons without expertise related to information security or IT, rather than personnel with expertise in each field
- A case where the top management does not provide the costs for introducing the minimum security solutions and applying safeguards needed to meet the requirements for technical/administrative protective measures of the personal information processing system
- A case where, after obtaining certification, personnel and budget support are drastically reduced and existing personnel are reassigned to other departments or part of the budget is used for other purposes