Risk Assessment

Based on official sourcesISMSISMS-PCheckpoints 5Evidence 8Cases 7

Certification criterion

The organization shall collect threat information by type through analysis of its internal and external environment, select a risk assessment method suitable for the organization, assess risks across all areas of the management system at least once a year, and manage acceptable risks with the approval of management.

Key checkpoints

Is a method defined for identifying and assessing risks that may arise from various perspectives depending on the characteristics of the organization or service?
Is a risk management plan that specifies the risk management methods and procedures (personnel, period, scope, method, budget, etc.) established every year?
Is a risk assessment performed regularly at least once a year, or at necessary points in time, in accordance with the risk management plan?
Is an acceptable target risk level defined by the organization, and are risks exceeding that level identified?
Are the risk identification and assessment results reported to management?

Detailed explanation

Reflecting the characteristics of the organization, a risk assessment method shall be defined and documented so that risks related to information security and personal information protection that may arise from various perspectives, such as the administrative, technical, physical, and legal domains, can be identified and assessed.

Selection of a risk assessment method : baseline approach, detailed risk analysis, combined approach, threat and scenario based, etc.
Reflecting business and organizational characteristics : the organization's vision and mission, business objectives, service types, compliance, etc.
Considering various perspectives : hacking, insider leakage, negligent management/supervision of outsiders, violation of personal information related laws, etc.
Considering the latest vulnerabilities and threat trends
The risk assessment methodology may be defined and applied independently to suit the organization's characteristics, but the risk assessment process must be reasonable and the risk assessment results must be able to represent the actual severity of the risks.

A risk management plan that specifies the risk management methods and procedures (personnel, period, scope, method, budget, etc.) shall be established.

Personnel : participation of risk management experts, information security/personal information protection experts, legal experts, IT operational managers, operational managers of business departments, external professional consultants, etc. (participation of stakeholders is required)
Period : establish a schedule so that it can be performed at least once a year
Scope : include all services and assets within the certification scope (information assets, personal information, systems, physical facilities, etc.)
Method : define a risk assessment methodology that reflects the organization's characteristics
Budget : establish a budget plan each year for conducting risk identification and assessment, and obtain approval from management such as the Chief Information Security Officer

In accordance with the risk management plan, a risk assessment shall be performed across all areas within the scope of the information security and personal information protection management system regularly at least once a year, or at necessary points in time.

Perform systematically in accordance with the previously established risk management methods and plan
Perform the risk assessment regularly at least once a year, but when a significant reason such as an organizational change or the introduction of a new system arises, perform a separate risk assessment for the relevant part in addition to the regular risk assessment
Reflect the results of the status and flow analysis of services and information assets
Verify compliance with legal requirements related to information security and personal information protection based on the latest laws
Verify compliance with the certification criteria of the information security and personal information protection management system
Include a review of the effectiveness of previously applied information security and personal information protection measures

An acceptable target risk level shall be defined by the organization, and risks exceeding that level shall be identified.

Establish risk rating criteria by considering the impact of various risks on the organization (likelihood of occurrence, severity, etc.)
Calculate the risk level for identified risks in accordance with the risk rating criteria
Determine the acceptable target risk level (DoA, Degree of Assurance) through decision-making by management such as the Chief Information Security Officer and the Chief Privacy Officer
Identify and document risks that exceed the acceptable target risk level

The risk identification and assessment results shall be prepared and reported in a way that is easy for management, such as the Chief Information Security Officer and the Chief Privacy Officer, to understand.

Prepare an assessment report for the identified risks
Share and discuss the content with relevant stakeholders for each identified risk (working-level councils, committees, etc.)
Prepare and report the report so that management can easily understand and make decisions from their perspective, rather than using IT or legal technical terms

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Risk management guidelines
Risk management manual/guide
Risk management plan
Risk assessment results report
Minutes of the information security and personal information protection committee
Minutes of the information security and personal information protection working-level council
Inventory of information assets and personal information assets
Information service and personal information flow tables/flow diagrams

Nonconformity examples

The established risk management plan defines the risk assessment period and the risk management targets and methods, but specific execution plans such as risk management personnel and required budget are omitted
A risk assessment was performed in the previous year, but no risk assessment was performed in the current year on the grounds that there was no change in assets
Risk identification and assessment are being performed in accordance with the risk management plan, but risk identification and assessment for important information assets within the scope were not performed, or risks based on compliance with information security related legal requirements were not identified and assessed
Risk identification and assessment were performed and an acceptable target risk level was set in accordance with the risk management plan, but the relevant matters were not reported to and approved by management (such as the Chief Information Security Officer)
The risk assessment method defined in the internal guidelines differs from the risk assessment method actually performed
Risk identification and assessment of the administrative/physical domains related to the information security management system were not performed, and the results of a technical vulnerability assessment were simply substituted for the risk assessment results
The acceptable target risk level (DoA) was decided to be raised excessively without a valid reason, so that major risks that actually require a response were designated as risks that do not require action (acceptable risks)