Incident Response Training and Improvement
Certification criterion
To ensure that employees and stakeholders are familiar with the procedures for responding to security incidents and personal information leakage incidents, scenario-based simulation drills shall be conducted at least once a year, and the response system shall be improved by reflecting the results of the drills.
Key checkpoints
- Is a simulation drill plan for the procedures to respond to security incidents and personal information leakage incidents established, and are drills conducted periodically at least once a year in accordance with the plan?
- Is the response system for security incidents and personal information leakage incidents improved by reflecting the results of the security incident and personal information leakage incident drills?
Detailed explanation
A simulation drill plan for the procedures to respond to security incidents and personal information leakage incidents shall be established, and drills shall be conducted periodically at least once a year in accordance with the plan.
- Review the adequacy of the security incident response procedures and establish and implement a simulation drill plan to enable a swift response when an incident occurs
- Prepare realistic and practical simulation drill scenarios that reflect the latest security incident cases, hacking trends, business characteristics, etc.
- Organize the simulation drill team so that all organizations related to security incident response, such as information security, personal information protection, IT, legal, human resources, and public relations, can participate
- Conduct simulation drills periodically at least once a year so that relevant employees can become familiar with the security incident response procedures
The response system for security incidents and personal information leakage incidents shall be improved by reflecting the results of the security incident and personal information leakage incident drills.
- Prepare a results report after conducting the simulation drill and report it internally
- Derive improvement items based on the simulation drill results and reflect them in the response procedures when necessary
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Simulation drill plan for responding to security incidents and personal information leakage incidents
- Simulation drill results report for responding to security incidents and personal information leakage incidents
- Security incident response procedures
Nonconformity examples
- When security incident simulation drills were not conducted, or when the related plan and results report cannot be verified
- When an annual security incident simulation drill plan was established but the drill was not conducted within the applicable period without a valid reason or approval
- When a simulation drill was planned and conducted, but it was not carried out in accordance with the procedures and forms specified in the relevant internal guidelines