Information Transmission Security
Certification criterion
When transmitting personal information and important information to another organization, a secure transmission policy shall be established, and through agreement between organizations, matters such as management responsibilities, transmission methods, and technical safeguards for the protection of personal information and important information shall be agreed upon and implemented.
Key checkpoints
- When transmitting personal information and important information to an external organization, is a secure transmission policy established?
- When personal information and important information are mutually exchanged between organizations for business purposes, are protective measures such as concluding agreements for secure transmission established and implemented?
Detailed explanation
When transmitting personal information and important information to an external organization, a secure transmission policy shall be established.
- Information transmission technical standards : encryption methods, key exchange and management, message rules, interlinkage and communication methods, etc.
- Information transmission review procedures : reporting and approval, roles and responsibilities among relevant organizations, security review, etc.
- Information transmission agreement criteria : standard security agreement or contract forms
- Application criteria for other protective measures : protective measure criteria reflecting legal requirements, etc.
When important information and personal information are mutually exchanged between organizations for business purposes, protective measures such as concluding agreements for secure transmission shall be established and implemented.
- When important information is electronically exchanged between organizations or affiliates for the performance of the following business tasks, an agreement for secure transmission (security agreement, contract, supplementary agreement, SLA, etc.) shall be concluded and implemented accordingly
- Definition of relevant tasks : delivery of personal information to a DM company for DM dispatch, delivery of collection information to a debt collection company, provision of personal information to a third party, delivery of credit card payment information to a VAN (Value Added Network) company, etc.
- Definition of the scope of information transmission : transmitting and receiving only the minimum information necessary for business purposes in order to comply with laws and regulations or to prevent the risk of information leakage
- Designation of personnel in charge and responsible persons
- Definition of information transmission technical standards
- Administrative/technical/physical protective measures during information transmission, storage, and destruction, etc.
※ DM (Direct Mail) : refers to promotional activities through mail; a communication means for delivering printed matter such as letters/postcards/notices/leaflets/catalogs/invoices, etc., in the form of mail either directly or by postal means
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Information transmission agreement or contract
- Information transmission technical standards
- Information transmission-related configuration diagrams, interface definition documents
Nonconformity examples
- The case where, when interlinking with external institutions, a dedicated network or VPN is applied and information is transmitted securely through the application of relay servers and certificates, but status management of the timing, methods, personnel in charge and responsible persons, interlinked information, legal basis, etc. for each external institution's interlinkage is not conducted appropriately
- The case where consultation on matters such as security review, establishment of security standards and countermeasures for the decryption sections during the relay process or the use of weak encryption algorithms (DES, 3DES) is not implemented