한국어
2.10.7

Removable Storage Media Management

Based on official sourcesISMSISMS-PCheckpoints 5Evidence 3Cases 4

Certification criterion

Management procedures shall be established and implemented to prevent leakage of personal information or important information through removable storage media and to prevent malicious code infection, and removable storage media containing personal information or important information shall be stored in a secure location.

Key checkpoints

  1. Are policies and procedures for handling (use), storage, disposal, and reuse of removable storage media such as external hard drives, USB memory, and CDs established and implemented?
  2. Is the status of removable storage media holdings, use, and management periodically inspected?
  3. Is the use of removable storage media restricted in controlled areas, critical restricted areas, and similar zones where major information systems are located?
  4. Are measures in place to prevent malicious code infection and leakage of important information through removable storage media?
  5. Are removable storage media containing personal information or important information stored in a secure location equipped with a locking device?

Detailed explanation

Policies and procedures for handling (use), storage, disposal, and reuse of removable storage media such as external hard drives, USB memory, and CDs shall be established and implemented.

  • Method for managing removable storage media holding status : removable storage media management ledger, etc.
  • Procedures for authorizing and registering the use of removable storage media
  • Procedures for managing the removal/introduction of removable storage media
  • Procedures for disposal and reuse of removable storage media
  • Scope of use of removable storage media : usage policies and procedures by protected area, such as controlled areas and restricted areas
  • Protective measures for removable storage media, etc.

The status of removable storage media holdings, use, and management shall be periodically inspected.

  • Inspection of management status, including verification of evidence of use authorization for removable storage media, holding status, management ledger, and usage history

The use of removable storage media shall be restricted in controlled areas, critical restricted areas, and similar zones where major information systems are located.

  • When use is unavoidable, use in accordance with lawful procedures after going through the responsible person's authorization procedure
  • Periodic review of the status of removable storage media use within controlled areas and critical restricted areas

Measures shall be prepared to prevent malicious code infection and leakage of important information through removable storage media.

  • Establishment/implementation of protective measures such as preventing autorun of removable storage media and using them only after scanning with antivirus software

Removable storage media containing personal information or important information shall be stored in a secure location equipped with a locking device.

  • Removable storage media (portable hard disks, USB memory, SSDs, etc.) containing personal information or important information shall be stored in a safe, a secure location equipped with a locking device

Related laws

  • Personal Information Protection Act Article 29 (Duty of Safety Measures)
  • Standards for Measures to Ensure the Safety of Personal Information Article 10 (Physical Safety Measures)

Evidence (examples)

  • Policy for blocking removable storage media (USB, CD, etc.)
  • Removable storage media management ledger
  • History of status inspections of removable storage media

Nonconformity examples

  • A case where a policy restricting the use of removable storage media in the server room, a controlled area, is established and operated, but numerous instances of removable storage media being used without complying with the exception approval procedure are identified, and periodic inspection of the removable storage media management status is not performed, resulting in insufficient updating of the removable storage media management ledger
  • A case where removable storage media containing personal information are left in office drawers, etc. instead of being stored in a secure location equipped with a locking device
  • A case where a removable storage media control solution is introduced/operated, but for some users, write and other operations are permitted by being processed as exceptions without an appropriate approval procedure
  • A case where writing to ordinary USB memory is possible on some shared PCs and computing equipment located in the computer room, yet controls such as restrictions on media introduction and use, and recording and review of usage history, are not applied

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints5
Evidence3
Cases4
Related lawsYes