한국어
1.4.3

Management System Improvement

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 4Cases 4

Certification criterion

For problems in the management system identified through the review of compliance with legal requirements and the inspection of the management system, the organization shall analyze the causes and establish/implement measures to prevent recurrence, and management shall confirm the accuracy and effectiveness of the improvement results.

Key checkpoints

  1. Are root causes of problems in the management system identified through the review of compliance with legal requirements and the inspection of the management system being analyzed, and are measures for preventing recurrence and for improvement being established/implemented?
  2. Are criteria and procedures in place to confirm the accuracy and effectiveness of the recurrence-prevention and improvement results?

Detailed explanation

The organization shall analyze the root causes of problems in the management system identified through the review of compliance with legal requirements and the inspection of the management system, and shall establish/implement measures for preventing recurrence and for improvement.

  • For problems found through inspection, establish/implement action plans and additionally confirm whether the actions have been completed

  • Analyze the root causes of the identified problems and deficiencies in the management system

  • Based on the results of the root-cause analysis, establish/implement measures to prevent recurrence of the identified problems and to improve

    ※ Recurrence-prevention measures (examples)

    • Revision of information security and personal information protection policies/guidelines/procedures
    • Strengthening or improving education for employees and outsiders
    • Strengthening monitoring of anomalous activity, etc.
    • Automation of information security and personal information protection operations (account management, etc.)
    • Improvement of review/approval procedures related to information security and personal information protection
    • Improvement of internal inspection checklists or methods, etc.

  • Share the established recurrence-prevention measures with relevant personnel and conduct education

The organization shall establish criteria and procedures to confirm the accuracy and effectiveness of the recurrence-prevention and improvement results.

  • To measure the accuracy and effectiveness of recurrence-prevention and improvement actions, derive key performance indicators (security performance indicators) from a management-system perspective

    ※ Security performance indicators related to recurrence-prevention and improvement actions (examples)

    • Rate of violations of security policies/guidelines (rate of violations of external transmission rules, rate of security bypass attempts, etc.)
    • Number of security exception approvals
    • Security program installation rate
    • Malware infection rate
    • Self-inspection execution rate, etc.

  • Establish/implement measurement and monitoring procedures for the key performance indicators (security performance indicators)

  • Report the confirmation and measurement results regarding the accuracy/effectiveness of recurrence-prevention and improvement actions to management

Related laws

  • Personal Information Protection Act Article 29 (Duty of Safety Measures)
  • Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

  • Management system inspection results report
  • Management system inspection action plan/action results report
  • Recurrence-prevention measures
  • Effectiveness measurement indicators and measurement results (including reports to management)

Nonconformity examples

  • A case where problems in the operation of the information security and personal information protection management system found through internal inspection recur identically each time
  • A case where internal rules require that, for problems found during internal inspection, root causes be analyzed and recurrence-prevention measures be established, but in a recently conducted internal inspection, root-cause analysis and recurrence-prevention measures were not established for the problems found
  • A case where recurrence-prevention measures for problems in the management system have been established and key performance indicators have been prepared and are measured periodically, but the results have not been reported to management for a long period
  • A case where, for problems found during management system inspection, an action plan was not established or whether the actions were completed was not confirmed

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence4
Cases4
Related lawsYes