Designation and Management of Key Personnel

Based on official sourcesISMSISMS-PCheckpoints 4Evidence 5Cases 4

Certification criterion

Criteria and management measures for key duties, such as handling personal information and important information or accessing key systems, shall be established, and key personnel shall be designated to the minimum extent, with the list thereof kept up to date.

Key checkpoints

Are the criteria for key duties, such as handling personal information and important information and accessing key systems, clearly defined?
Are executives, employees, and external parties who perform key duties designated as key personnel, and is the list thereof kept up to date?
Are those who handle personal information in the course of their work designated as personal information handlers, and is the list thereof kept up to date?
Are management measures, such as minimizing the designation of key personnel and personal information handlers according to business necessity, established/implemented?

Detailed explanation

The criteria for key duties, such as handling personal information and important information and accessing key systems, shall be clearly defined.

※ Criteria for key duties (examples)

Handling important information (personal information, HR information, trade secrets, industrial secrets, financial information, etc.)
Operation/management of important information systems (servers, databases, applications, etc.) and personal information processing systems
Performance of information security and personal information protection management duties
Operation of security systems, etc.

Executives, employees, and external parties who perform key duties shall be designated as key personnel, and the list thereof shall be kept up to date.

Identify the status of key personnel and formally designate them as key personnel
Manage designated key personnel as a list
Update the list upon new designation, change, or release of key personnel
Periodically review the status and appropriateness of key personnel designations and keep the list up to date

Those who handle personal information in the course of their work shall be designated as personal information handlers, and the list thereof shall be kept up to date.

Manage personal information handlers who process personal information in the course of their work as a list
The list of personal information handlers shall also include the personal information handlers of the trustee entrusted with personal information processing duties (however, list management for those personal information handlers of the trustee who do not have access privileges to the personal information processing system may be performed by the trustee itself)
Periodically review the status and appropriateness of personal information handler designations and keep the list up to date

※ Definition of personal information handler

A person who processes personal information under the direction/supervision of the personal information controller, such as an executive or employee, dispatched worker, or part-time worker

Management measures, such as minimizing the designation of key personnel and personal information handlers according to business necessity, shall be established/implemented.

Designate key personnel and personal information handlers only when strictly necessary for work
Establish approval procedures for the application and granting of privileges for key personnel and personal information handlers
Establish/implement management and control measures for key personnel and personal information handlers (training, monitoring, etc.)

Related laws

Personal Information Protection Act Article 28 (Supervision of Personal Information Handlers), Article 29 (Duty of Safety Measures)
Standards for Measures to Ensure the Safety of Personal Information Article 4 (Establishment/Implementation and Inspection of the Internal Management Plan)

Evidence (examples)

Criteria for key duties
List of key personnel
List of personal information handlers
Account and privilege management ledger for important information systems and personal information processing systems
Management status for key personnel (training results, security pledges, etc.)

Nonconformity examples

Where a list of key personnel (list of personal information handlers, list of confidential information managers, etc.) is prepared, but some executives and employees who handle large volumes of personal information and other important information (DBAs, DLP administrators, etc.) are omitted from the list
Where lists of key personnel and personal information handlers are managed, but they are not kept up to date, for example including employees who have resigned and not including recently hired personnel
Where personal information handler privileges are granted collectively on a departmental basis, resulting in an excessive number of persons being designated as personal information handlers, including those who do not actually need to handle personal information
Where internal guidelines require approval from the security team and the preparation of a security pledge according to the key duty when granting key personnel privileges, but numerous key personnel have been registered without the security team's approval and without preparing a security pledge