한국어
2.2.6

Actions in Case of Security Violations

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 3Cases 2

Certification criterion

When employees and relevant external parties violate laws, regulations, or internal policies, the organization shall establish and implement action procedures accordingly.

Key checkpoints

  1. Has the organization established disciplinary provisions for cases where employees and relevant external parties violate their information security and personal information protection responsibilities and obligations under laws, regulations, and internal policies?
  2. When a violation of information security or personal information protection is detected, are actions carried out in accordance with internal procedures?

Detailed explanation

The organization shall establish disciplinary provisions for cases where employees and relevant external parties violate their information security and personal information protection responsibilities and obligations under laws, regulations, and internal policies.

  • Establish standards and procedures for actions such as investigation, explanation/justification, and disciplinary measures when noncompliance with relevant laws and internal rules, failure to fulfill responsibilities, or damage, leakage/exposure, or misuse/abuse of important information and personal information is discovered
  • Also consider reward measures for cases where information security and personal information protection responsibilities and obligations have been faithfully fulfilled

When a violation of information security or personal information protection is detected, actions shall be carried out in accordance with internal procedures.

  • Carry out actions in accordance with the reward and punishment provisions and record the results
  • Where necessary, use them as company-wide announcements or as training case studies

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

  • HR regulations (disciplinary provisions for violations of information security and personal information protection regulations)
  • Records of disciplinary actions against violators of information security and personal information protection guidelines
  • Incident case records (company-wide announcements, training content)

Nonconformity examples

  • The case where handling standards and procedures for violators of information security and personal information protection regulations are not included at all in the internal rules
  • The case where warning messages are delivered to relevant persons whose policy violations were detected through security systems (DLP, database access control systems, internal information leakage control systems, etc.), but follow-up actions in accordance with internal rules, such as explanation/justification, additional investigation, and disciplinary measures, are not implemented

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence3
Cases2
Related laws-