2.11.5
Incident Response and Recovery
Based on official sourcesISMSISMS-PCheckpoints 4Evidence 5Cases 4
Certification criterion
When signs or occurrences of a security incident or personal information breach are recognized, the legal notification and reporting obligations must be complied with, response and recovery must be carried out promptly in accordance with the procedures, and after analyzing the incident, recurrence prevention measures must be established and reflected in the response system.
Key checkpoints
- When signs or occurrences of a security incident or personal information breach are recognized, are response and reporting carried out promptly in accordance with the defined security incident response procedures?
- When a personal information breach incident occurs, are the procedures for notifying data subjects (users) and reporting to relevant agencies carried out in accordance with the applicable laws?
- After a security incident is closed, is the cause of the incident analyzed, and are the results reported and shared with the relevant organizations and personnel?
- Using the information obtained through the analysis of the security incident, are measures established to prevent similar incidents from recurring, and where necessary, are the security incident response procedures and the like modified?
Detailed explanation
When signs or occurrences of a security incident or personal information breach are recognized, response and reporting must be carried out promptly in accordance with the defined security incident response procedures.
- Initial response to the security incident and evidence preservation measures
- Deleting/changing access rights to the information system suspected of intrusion, or blocking access
- Security inspection of internal and external systems such as networks and firewalls, and vulnerability remediation measures
- Preserving evidence such as external access records needed for the incident investigation
- Verifying whether personal information and important information have been leaked through log analysis and the like
- Preparing a security incident report including the following items, and reporting it internally
- Date and time the security incident occurred
- Reporter and date and time of the report
- Incident details (findings, damage details, etc.)
- Progress details of the incident response
- Time taken until the incident response, etc.
- If the impact of the security incident on the organization is severe, reporting promptly up to top management in accordance with the reporting procedures
When a personal information breach incident occurs, the procedures for notifying data subjects and reporting to relevant agencies must be carried out in accordance with the applicable laws.
- Requirements for notifying data subjects following loss/theft/leakage of personal information (hereinafter "leakage etc.")
| Field | Value |
|---|---|
| Matters to be notified | 1. The items of personal information subject to leakage etc. 2. The point in time and circumstances of the leakage etc. 3. Information on the methods that data subjects can use to minimize the damage that may arise from the leakage etc. 4. The response measures of the personal information controller and the damage relief procedures 5. The department in charge and contact point where data subjects can file reports and the like if damage occurs ※ If the specific details concerning matters 1 and 2 cannot be verified, the fact that personal information was leaked, the details verified up to that point, and matters 3 through 5 of the same paragraph must be notified first by written or other means, and additionally verified details must be notified immediately upon verification. |
| Method of notification | Written or other means (in writing, email, fax, telephone, text message, etc.) |
| Timing of notification | Within 72 hours from the time the leakage etc. becomes known However, in any of the following cases, data subjects may be notified without delay after the relevant reason is resolved: 1. Where urgent measures are needed to prevent the spread of and further leakage etc. of the leaked personal information, such as blocking access paths, inspecting/remediating vulnerabilities, or recovering/deleting the leaked personal information 2. Where notification within 72 hours is difficult due to a natural disaster or other unavoidable reasons |
| Exception to notification | Where there is a justifiable reason, such as being unable to ascertain the contact information of the data subject, notification may be replaced by posting the above five matters to be notified on the internet website for at least 30 days However, a personal information controller that does not operate an internet website must post the above five matters to be notified in a conspicuous place at the business premises and the like for at least 30 days. |
- Requirements for reporting to relevant agencies following leakage etc. of personal information
| Field | Value |
|---|---|
| Matters to be reported | 1. The items of personal information subject to leakage etc. 2. The point in time and circumstances of the leakage etc. 3. Information on the methods that data subjects can use to minimize the damage that may arise from the leakage etc. 4. The response measures of the personal information controller and the damage relief procedures 5. The department in charge and contact point where data subjects can file reports and the like if damage occurs ※ If the specific details concerning matters 1 and 2 cannot be verified, the fact that personal information was subject to leakage etc., the details verified up to that point, and matters 3 through 5 of the same paragraph must be reported first by written or other means, and additionally verified details must be reported immediately upon verification. |
| Reporting agency | Personal Information Protection Commission or Korea Internet & Security Agency |
| Method of reporting | Written or other means (in writing, email, fax, telephone, text message, etc.) ※ Reporting is possible through the Personal Information Portal (www.privacy.go.kr). |
| Timing of reporting | Within 72 hours from the time the leakage etc. becomes known However, where reporting within 72 hours is difficult due to a natural disaster or other unavoidable reasons, the report must be made without delay after the relevant reason is resolved. |
| Cases subject to reporting | 1. Where personal information of 1,000 or more data subjects is subject to leakage etc. 2. Where sensitive information or unique identifying information is subject to leakage etc. 3. Where personal information is subject to leakage etc. due to unlawful external access to the personal information processing system or to the information devices used by personal information handlers to process personal information ※ However, where the path of the personal information leakage etc. has been identified and the possibility of infringement on the rights and interests of data subjects has become significantly lower through measures such as recovering/deleting the relevant personal information, reporting may be omitted. |
After a security incident is closed, the cause of the incident must be analyzed, and the results must be reported and shared with the relevant organizations and personnel.
- After the security incident is handled and closed, performing an analysis of the cause of the incident, preparing a results report, and reporting it to the responsible person
- Sharing the security incident information and the discovered vulnerabilities, causes, and remediation measures with the relevant organizations and personnel
Using the information obtained through the analysis of the security incident, measures must be established to prevent similar incidents from recurring, and where necessary, the security incident response procedures and the like must be modified.
- Using the information obtained through the analysis of the security incident, establishing recurrence prevention measures so that similar incidents are not repeated
- Where necessary based on the analyzed results, modifying the security incident response system, including the security incident response procedures and the information security policies and procedures
Related laws
- Personal Information Protection Act Article 34 (Notification and Reporting of Personal Information Breaches, etc.)
- Network Act Article 48-3 (Reporting of Security Incidents, etc.), Article 48-4 (Cause Analysis of Security Incidents, etc.)
Evidence (examples)
- Security incident response procedures
- Intrusion incident response report
- Intrusion incident management ledger
- Personal information leakage report
- Emergency contact list
Nonconformity examples
- The internal security incident response guidelines stipulate that, when a security incident occurs, it must be reported to the internal information security committee and the relevant stakeholder departments; however, when a security incident occurred, the department in charge took response measures on its own and did not report to the information security committee and the relevant stakeholder departments
- There was a case in which part of the service was interrupted due to a security incident suspected to be a recent DDoS attack, but no cause analysis or recurrence prevention measures were established for it
- A personal information leakage incident occurred due to external hacking, but on the grounds that the number of leaked personal information records was small, notification and reporting were not carried out within 72 hours
- Due to an error by a person in charge, personal information of 1,000 or more data subjects was leaked through the internet website bulletin board, but leakage notification to the relevant data subjects was not carried out