Status and Flow Analysis

Status and flow analysis is a preliminary stage of risk analysis and provides the baseline material for conducting risk analysis from various perspectives. It can also be effectively used by management to understand the information security status and to make decisions for risk management.

• Status analysis identifies the differences between the certification criteria and the operational status through a GAP analysis table that compares the certification criteria with the operational status.
• Flow analysis is divided into information service flow analysis and stage-by-stage personal information processing flow analysis, and the results are diagrammed as a flow table or a flow diagram.

※ The information service flow diagram refers to an access control concept diagram that depicts, on a user basis, the interconnection of the organization's business procedures, information security requirements, and security controls. ※ The personal information flow diagram refers to a concept diagram that depicts the flow at a glance across the personal information processing stages of collection, retention, use/provision, and destruction.

The organization shall identify the information service status across all areas of the management system, and understand and document business procedures and flows.

• Identify the status of all information services within the scope of the management system.
• Understand the business procedures and flows for each information service.
• Document business procedures and flows: business status table, business flow diagram, etc.

  • Information service flow diagram (system operator example)

    flowchart LR
      subgraph EXT["External network"]
        subgraph EXT_PC["PC"]
          EPC["External PC<br>- Antivirus<br>- Screen capture prevention"]
        end
        subgraph EXT_NET["Network"]
          INET(("Internet"))
        end
        SSLVPN["SSL<br>VPN<br>- ID/PW + OTP"]
        subgraph EXT_SRV["Server"]
          EVDI["VDI for external access<br>- Antivirus<br>- E-DLP<br>- DRM<br>- PMS<br>- Output security"]
        end
      end
      subgraph INT["Internal network"]
        subgraph INT_PC["PC"]
          WPC["Work PC<br>- Antivirus<br>- EDR<br>- E-DLP<br>- PC security<br>- DRM<br>- NAC<br>- PMS<br>- Print output security"]
        end
        subgraph INT_NET["Network"]
          WVDI["VDI for work<br>- Antivirus<br>- E-DLP<br>- DRM<br>- PMS<br>- Print output security"]
        end
        subgraph INT_SRV["Server"]
          SAC["Server access control<br>- ID/PW<br>+OTP+<br>IP restriction"]
          DAC["DB access control<br>- ID/PW<br>+OTP+<br>IP restriction"]
          SRV["Server"]
        end
        subgraph INT_DB["DB"]
          DBSRV["DB server<br>- Secure<br>OS"]
          DBMS[("DBMS")]
        end
      end
      EPC -->|"VPN tunneling"| INET
      INET --> SSLVPN
      SSLVPN --> EVDI
      EVDI -->|"Server zone<br>firewall"| SAC
      WPC -->|"VDI zone<br>firewall"| WVDI
      WVDI --x|"VDI zone<br>firewall<br>Internet blocked"| INET
      WVDI -->|"Server zone<br>firewall"| SAC
      WVDI -->|"Server zone<br>firewall"| DAC
      SAC --> SRV
      SAC -->|"DB zone<br>firewall"| DBSRV
      DAC -->|"DB zone<br>firewall"| DBMS
    

    	PC	Network	Server	DB
    Description of key protective measures	Security programs such as antivirus and EDR installed on work PCs, and non-business sites, etc. blocked For external access, antivirus and screen capture prevention programs forcibly installed on the external PC	Servers and DBs accessed through the VDI for work (direct access controlled at the firewall) Internet blocked from the VDI for work through the VDI zone firewall External access : VPN (ID/PW+OTP) → VDI for external access	Servers accessible through the server access control system (direct access to servers blocked at the server zone firewall) DBMS accessible through the DB access control system (controlled by the DB zone firewall ACL) Server access control and DB access control authenticate with ID/PW + OTP + IP restriction	SecureOS installed on the DB server (logging, control of connections between servers, command control, etc.) Direct connection to the DBMS from the DB server is subject to command control in SecureOS (sqlplus, etc.)

The organization shall identify the status of personal information processing within the scope of the management system and understand the flow of personal information, documenting it in a personal information flow table, personal information flow diagram, etc. (in the case of ISMS-P certification).

• (Step 1) Identify the unit tasks in which personal information processing takes place.

• (Step 2) Prepare a personal information flow table by personal information life cycle for each unit task.

  • ※ Example of preparing a personal information flow table (source: Guide to Conducting Privacy Impact Assessments)

    • Example of a collection flow table

      Task name	Collection
      	Collection items	Collection route	Collection target	Collection cycle	Person in charge of collection	Basis for collection
      Member management (member registration)	Mandatory: name, date of birth, gender, disability type, member ID, password, address occupation, phone number, mobile phone, email, Optional: ○○○, disability certificate file, ○○○ name, field of interest, ○○○, nearby ○○○ information	Homepage (online)	Data subject	As needed	Person in charge of the homepage	Consent of the data subject

    • Example of a retention/use flow table

      Task name	Retention, use
      	Retention form	Encrypted items	Items used	Purpose of use	Personal information handler	Method of use
      Member management (member registration)	DB	Password (SHA-256)	Mandatory: name, date of birth, gender, disability type, member ID, password, address occupation, phone number, mobile phone, email, Optional: ○○○, disability certificate file, ○○○ name, field of interest, ○○○, nearby ○○○ information	The person in charge manages member information	Person in charge of the homepage	Accesses the homepage using a personal PC, selects the relevant menu, and views member information

    • Example of a destruction flow table

      Task name	Destruction
      	Retention period	Person in charge of destruction	Destruction procedure	Separate storage
      Member management (member registration)	Deleted without delay after membership withdrawal, or up to 3 years	Person in charge of the homepage	The relevant record is deleted from the table when the purpose is achieved. However, it is not destroyed after the period elapses

• (Step 3) Based on the prepared personal information flow tables, prepare an overall personal information flow diagram and business-specific personal information flow diagrams so that the flow can be grasped at a glance across the personal information processing stages of collection, retention, use/provision, and destruction.

  • ※ Example of preparing a personal information flow diagram (source: Guide to Conducting Privacy Impact Assessments)

    • Example personal information flow diagram: overall (integrated) flow diagram

      flowchart LR
        subgraph LIFE["Personal information life cycle"]
          subgraph COL["Collection"]
            subgraph COL_TASK["Related tasks"]
              TC1("Member management")
              TC2("Library tour<br>application management")
            end
            subgraph COL_SUBJ["Data subject/personal information handler"]
              SMEM("Member"):::subj
              SFOR("Foreign group<br>representative"):::subj
              SLIB("Library tour<br>staff PC"):::handler
            end
          end
          subgraph RET["Retention/use/provision"]
            subgraph RET_TASK["Related tasks"]
              TR1("Other event management")
              TR2("Member management")
              TR3("Library tour<br>application management")
              TR4("Community service<br>application management")
              TR5("Volunteer work<br>application management")
              TR6("Other<br>event management")
              TR7("Education program<br>management")
              TR8("Humanities on the Road<br>event management")
            end
            subgraph RET_SUBJ["Data subject/personal information handler"]
              SNON("Non-member"):::subj
              P1("Member/task<br>staff PC"):::subj
              P2("Member/task<br>staff PC"):::subj
              P3("Member/task<br>staff PC"):::subj
              P4("Member/task<br>staff PC"):::subj
              P5("Member/task<br>staff PC"):::subj
              P6("Member/task<br>staff PC"):::subj
              P7("Member/task<br>staff PC"):::subj
            end
            subgraph RET_FLOW["Personal information processing flow"]
              TDB[("Integrated member<br>DB")]
              HDB[("Homepage<br>DB")]
              BUS(( ))
              NTDB["When a member applies<br>to use a service, each<br>system transfers the basic<br>information in the<br>integrated member DB<br>to the homepage DB<br>and uses it"]:::note
            end
            subgraph RET_EXT["External linkage/provision"]
              SPON("Sponsor<br>(travel agency)"):::handler
              NSPON["For the purpose of<br>travel insurance enrollment"]:::note
            end
          end
          subgraph DES["Destruction"]
            D3Y["Destroyed when the 3-year<br>retention period elapses"]:::dashed
            NADD["Additional materials : foreign library tour application form, community service<br>information use consent form, Humanities on the Road on-site participation application form"]:::note
            subgraph DES_FLOW["Personal information processing flow"]
              DNOT("DB<br>not destroyed")
              DDEL("DB destruction")
            end
            subgraph DES_EXT["External linkage/provision"]
              DMEMO["Destroyed immediately after<br>membership withdrawal, but<br>not destroyed when the 3-year<br>validity period elapses"]
            end
          end
        end
        subgraph LEG["Legend"]
          LG1A[" "]:::note -->|"Online"| LG1B[" "]:::note
          LG2A[" "]:::note -.->|"Offline"| LG2B[" "]:::note
          LG3A[" "]:::note ==>|"Encryption"| LG3B[" "]:::note
          LG4("Data subject"):::subj
          LG5("Personal information handler"):::handler
        end
        TC1 --- SMEM
        TC2 --- SFOR
        SFOR -.-> SLIB
        SMEM ==>|"Member personal details"| TDB
        SLIB -->|"Proxy application entry"| HDB
        TR1 --- SNON
        SNON -->|"Event participation application information"| HDB
        TR2 --- P1
        TDB ==>|"Inquiry and<br>member information modification"| P1
        TR3 --- P2
        TR4 --- P3
        TR5 --- P4
        TR6 --- P5
        TR7 --- P6
        TR8 --- P7
        HDB ---|"Application and<br>approval,<br>inquiry<br>(similar for<br>each task)"| BUS
        BUS --> P2
        BUS --> P3
        BUS --> P4
        BUS --> P5
        BUS --> P6
        BUS --> P7
        TDB --> HDB
        TDB ~~~ NTDB
        HDB --> SPON
        SPON ~~~ NSPON
        TDB --> DDEL
        HDB -.- DNOT
        DDEL --> DMEMO
        D3Y ~~~ NADD
        classDef subj fill:#ffffff,stroke:#8c8c8c
        classDef handler fill:#b4c7e7,stroke:#8eaadb
        classDef dashed fill:#ffffff,stroke:#8c8c8c,stroke-dasharray:5 5
        classDef note fill:none,stroke:none
      

    • Example of a business-specific personal information flow diagram (detailed)

      flowchart LR
        subgraph LIFE["Personal information life cycle"]
          subgraph COL["Collection"]
            subgraph COL_SUBJ["Data subject/personal information handler"]
              FG("Foreign<br>group"):::subj
              EVT("Event task<br>staff"):::handler
            end
            subgraph COL_FLOW["Personal information processing flow"]
              M1("○○○<br>management task")
            end
          end
          MEM1("Member"):::subj
          M2("○○○<br>management task")
          subgraph RET["Retention/use/provision"]
            subgraph RET_SUBJ["Data subject/personal information handler"]
              GY("Tour task<br>staff"):::handler
              MEM2("Member"):::subj
              MEM3("Member"):::subj
            end
            subgraph RET_FLOW["Personal information processing flow"]
              M3("○○○<br>management task")
              OO("○○")
              M4("○○○<br>management task")
              HDB[("Homepage<br>DB")]
              MC["C"]:::note
              TDB[("Integrated member<br>DB")]
              XLS("Excel<br>file")
            end
            subgraph RET_EXT["External linkage/provision"]
              TRV("Travel agency"):::handler
            end
          end
          subgraph DES["Destruction"]
            subgraph DES_FLOW["Personal information processing flow"]
              D3Y["Destroyed when the 3-year<br>retention period elapses"]:::dashed
              DNOSET["Retention period<br>not set"]
              DNOT("DB not<br>destroyed")
            end
          end
        end
        subgraph LEG["Legend"]
          LG1A[" "]:::note -->|"Online"| LG1B[" "]:::note
          LG2A[" "]:::note -.->|"Offline"| LG2B[" "]:::note
          LG3A[" "]:::note ==>|"Encryption"| LG3B[" "]:::note
          LG4("Data subject"):::subj
          LG5("Personal information handler"):::handler
        end
        FG -.-> EVT
        EVT ---|"Tour reservation ❶<br>receipt A"| M1
        M1 --> HDB
        MEM1 ---|"○○○<br>tour reservation application<br>(some information<br>newly collected ❶ A"| M2
        M2 --> HDB
        MEM1 -->|"○○○<br>tour reservation application<br>(existing information<br>transferred) ❷"| M2
        M2 --> TDB
        EVT -.->|"Application form ❶"| D3Y
        M3 -->|"- Review/approval of<br>received details ❸ B<br>- Reservation cancellation<br>approval/application<br>status inquiry"| GY
        M3 --> HDB
        TDB -->|"❷"| HDB
        HDB ~~~ MC
        HDB --- OO
        OO -->|"Application result/ ❸<br>reservation cancellation<br>confirmation"| MEM2
        MEM3 ---|"Reservation cancellation<br>request ❸"| M4
        M4 --> HDB
        HDB --> XLS
        XLS -->|"❹ B"| TRV
        HDB -.-|"D"| DNOT
        classDef subj fill:#ffffff,stroke:#8c8c8c
        classDef handler fill:#b4c7e7,stroke:#8eaadb
        classDef dashed fill:#ffffff,stroke:#8c8c8c,stroke-dasharray:5 5
        classDef note fill:none,stroke:none
      

      Personal information processed
      ① Mandatory : affiliation (group name), group leader, mobile phone
      ② Mandatory : name (applicant), phone number, email, address Optional : mobile phone
      ③ Mandatory : name (applicant), phone number, email, address, affiliation (group name), group leader Optional : mobile phone

      Description of key business flows
      The applicant applies for a tour of the main building or the annex through the ○○ tour application screen (in the case of a foreign group, when the group asks the ○○○ tour person in charge to apply for tour participation, the person in charge applies on its behalf with his or her own ID
      The ○○○ task person in charge reviews the application details and registers the review result (review result - under review, approved, rejected, on hold, canceled)
      The applicant checks the application result through ‘○○’
      When a reservation that has been approved is to be canceled, the applicant asks the ○○○ tour task person in charge to cancel it, and the cancellation is processed

      Concerns
      A. Some newly collected personal information is collected without the consent of the data subject (3.1.1)
      B. Strengthened password composition rules are not applied, so a third party may be able to find out passwords (4.1.2)
      C. No separate processing log is recorded for personal information stored in the homepage DB, so traceability is not secured when a security incident occurs (4.4.1)
      D. The retention period of personal information is not set and the information is not destroyed, so personal information may be leaked or misused (3.5.1)

The organization shall periodically review (at least once a year) the business procedures and personal information flows in line with changes in services, business, information assets, etc., referring to the following perspectives, and shall manage them to keep them current.

• Whether existing services, business, and personal information flows have changed (opening or reorganization of new services, changes in business procedures, changes in personal information processing methods, organizational changes, changes in external linkage and provision flows, etc.)
• Whether the important information or personal information items being processed have changed
• Whether the type, configuration, functions, etc. of information systems and personal information processing systems have changed
• Whether new personal information processing tasks and flows have arisen
• Whether the external environment has changed, such as amendments to laws or the emergence of new vulnerabilities