Maintenance of the Organization

Based on official sourcesISMSISMS-PCheckpoints 3Evidence 7Cases 4

Certification criterion

The organization shall assign information security and personal information protection roles and responsibilities to each of its members, and shall establish and operate a system for evaluating those activities as well as a system that enables mutual communication among the organization and its members.

Key checkpoints

Are the roles and responsibilities of the officers and staff responsible for information security and personal information protection clearly defined?
Is a system established for evaluating the activities of the officers and staff responsible for information security and personal information protection?
Are systems and procedures for mutual communication among the information security and personal information protection organization and its members established and implemented?

Detailed explanation

The roles and responsibilities of the relevant officers and staff shall be defined specifically in the implementing documents, taking into account the characteristics of the organization related to carrying out information security and personal information protection work.

Chief Information Security Officer and Chief Privacy Officer
Information security and personal information protection managers and staff
Information security and personal information protection officers and staff for each department
The Chief Information Security Officer and the Chief Privacy Officer perform the following duties, reflecting legal requirements and other considerations

Chief Information Security Officer	Chief Privacy Officer
Establishment, implementation, and improvement of the information security plan Periodic auditing and improvement of information security practices and conditions Identification and assessment of information security risks and preparation of information security countermeasures Establishment and implementation of information security education and simulation training plans Implementation of other measures necessary for information security in accordance with the Network Act or related laws	Establishment and implementation of the personal information protection plan Periodic investigation and improvement of the status and practices of personal information processing Handling of complaints and remedy of damages related to personal information processing Establishment of an internal control system to prevent leakage, misuse, and abuse of personal information Establishment and implementation of the personal information protection education plan Protection, management, and supervision of personal information files Establishment, modification, and implementation of the privacy policy Management of materials related to personal information protection Destruction of personal information whose processing purpose has been achieved or whose retention period has elapsed

Chief Information Security Officer

Chief Privacy Officer

Establishment, implementation, and improvement of the information security plan
Periodic auditing and improvement of information security practices and conditions
Identification and assessment of information security risks and preparation of information security countermeasures
Establishment and implementation of information security education and simulation training plans
Implementation of other measures necessary for information security in accordance with the Network Act or related laws

Establishment and implementation of the personal information protection plan
Periodic investigation and improvement of the status and practices of personal information processing
Handling of complaints and remedy of damages related to personal information processing
Establishment of an internal control system to prevent leakage, misuse, and abuse of personal information
Establishment and implementation of the personal information protection education plan
Protection, management, and supervision of personal information files
Establishment, modification, and implementation of the privacy policy
Management of materials related to personal information protection
Destruction of personal information whose processing purpose has been achieved or whose retention period has elapsed

The responsibilities and roles are defined specifically through job descriptions and similar documents so that the information security and personal information protection managers, protection staff, and protection practitioners can practically support and carry out the management duties of the Chief Information Security Officer and the Chief Privacy Officer

A system for evaluating the activities of the officers and staff responsible for information security and personal information protection shall be established.

Prepare methods for evaluating information security and personal information protection activities, such as key performance indicators (KPI), MBO (Management By Objectives), and personnel evaluations within the organization, and conduct periodic evaluations

Systems and procedures enabling mutual communication among the information security and personal information protection organization and its members shall be established and implemented.

Establishment and implementation of a communication management plan related to information security and personal information protection

※ Communication management plan related to information security and personal information protection (example)
- Overview of the communication management plan : purpose and scope
- Communication system : operation methods for reporting and consultative bodies such as company-wide consultative bodies, working-level consultative bodies, and committees, participants, roles and responsibilities of each participant, cycles, etc.
- Communication methods : reporting and meetings (monthly reports, weekly reports, etc.), announcements, email, messenger, information security portal, etc.
- Communication formats : report formats by type, meeting minutes formats, etc.

Related laws

Personal Information Protection Act Article 29 (Duty of Safety Measures), Article 31 (Designation of the Chief Privacy Officer, etc.)
Network Act Article 45-3 (Designation of the Chief Information Security Officer, etc.)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Information security and personal information protection organization chart
Job descriptions for the information security and personal information protection organization
Information security and personal information protection work division table
Information security and personal information protection policies/guidelines, internal management plan
Information security and personal information protection communication management plan
Communication execution records (monthly reports, weekly reports, internal announcements, etc.)
Communication channels (information security portal, bulletin board, etc.)

Nonconformity examples

The case where the roles and responsibilities of the Chief Information Security Officer, the Chief Privacy Officer, and related staff are defined in internal guidelines and job descriptions, but they do not match the actual operating conditions
The case where a system of goals, criteria, indicators, and the like for periodically evaluating the activities of the Chief Information Security Officer and related staff is not in place
The case where internal guidelines require the information security staff member of each department to set KPIs related to information security and reflect them in personnel evaluations, but no information security-related items are reflected at all in the KPIs of the departmental information security staff
The case where a Chief Information Security Officer and a Chief Privacy Officer are designated, but the roles and responsibilities required by the relevant laws are not specifically stated in internal guidelines, job descriptions, or the like