Implementation of Protection Measures

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 5Cases 5

Certification criterion

The selected protection measures shall be effectively implemented in accordance with the implementation plan, and management shall verify the accuracy and effectiveness of the implementation results.

Key checkpoints

Are protection measures effectively implemented in accordance with the implementation plan, and are the results reported so that management can verify the accuracy and effectiveness of the implementation results?
Is a statement of operations that records the implementation and operation status of protection measures prepared in concrete terms for each management system certification criterion?

Detailed explanation

The protection measures selected in accordance with the implementation plan shall be effectively implemented, and their implementation results shall be reported to management, such as the Chief Information Security Officer and the Chief Privacy Officer, and the accuracy and effectiveness of the implementation results shall be verified.

Regarding the progress made according to the implementation plan, identify on a regular basis the completion status, progress, and, where there is non-implementation or delay, the reasons, and report to management such as the Chief Information Security Officer and the Chief Privacy Officer
Management reviews whether the information security and personal information protection measures have been implemented accurately and effectively in accordance with the implementation plan
Where non-implementation, schedule delay, or the like occurs, analyze the cause, revise the implementation plan if necessary, and report to management for approval
Where, as a result of reviewing the effectiveness and accuracy of the implementation results, a measure is difficult to judge as appropriate or substantial doubt is raised about its effectiveness, establish procedures to formulate alternatives or to supplement the measure through additional risk assessment

A statement of operations that records the implementation and operation status of protection measures for each management system certification criterion shall be prepared in concrete terms.

Confirmation of whether the certification criterion is selected (Yes/No): the 'Establishment and Operation of the Management System' domain is mandatory
Operation status: describe in detail the operation status against the organization's policies and the certification criteria
Related documents (policies, guidelines, etc.): clearly state the names of the related documents applicable to the relevant criterion and their detailed document numbers
Records (evidence): present documents or evidence generated in the course of the relevant criterion actually being operated, such as related documents, approval records, and meeting minutes
Reasons when a certification criterion is not selected: where the services, systems, etc. within the certification scope have no relevance at all to the relevant item, describe in detail the reasons for non-selection

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

Information security and personal information protection implementation plan/risk management plan
Information security and personal information protection measures document
Information security and personal information protection implementation progress report (including report to management)
Information security and personal information protection implementation completion report (including report to management)
Information security and personal information protection statement of operations

Nonconformity examples

Where the completed implementation results of information security and personal information protection measures were not reported to the Chief Information Security Officer and the Chief Privacy Officer
Where the risk treatment implementation results report states 'treatment completed', but the related risk still exists or the accuracy and effectiveness of the implementation results have not been verified
Where risks classified as medium/long term under the previous year's information security measures implementation plan are not being implemented in the relevant year, or management is not reviewing and verifying the implementation results
Where the operation status recorded in the statement of operations does not match the actual situation, and the related documents, approval records, meeting minutes, etc. recorded in the statement of operations do not exist
Where the results of executing the implementation plan were reported to the Chief Information Security Officer and the Chief Privacy Officer, but the reporting of reasons and follow-up actions for some non-implemented items was not carried out