한국어
2.3.1

Management of the Status of External Parties

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 4Cases 2

Certification criterion

When part of the work (handling of personal information, information security, operation or development of information systems, etc.) is outsourced to an external party, or when external facilities or services (integrated information and communications facilities, cloud services, application services, etc.) are used, the organization shall identify the status thereof, ascertain the legal requirements and the risks arising from the external organization/service, and establish appropriate protective measures.

Key checkpoints

  1. Is the status of business outsourcing and the use of external facilities/services occurring within the scope of the management system identified?
  2. Are the legal requirements and risks arising from business outsourcing and the use of external facilities/services ascertained, and are appropriate protective measures established?

Detailed explanation

The status of business outsourcing and the use of external facilities/services occurring within the scope of the management system shall be clearly identified.

  • Ascertaining the status of business outsourcing and the use of external facilities/services within the scope of the management system

    ※ Business outsourcing and use of external facilities/services (examples)

    • Outsourcing of IT and security tasks: information system development/operation, maintenance, operation of servers/networks/security equipment, security control (monitoring), access control and security guarding, information security consulting, etc.
    • Outsourcing of personal information processing tasks: agency for personal information collection, customer counseling, operation of personal information processing systems, etc.
    • Use of external facilities: integrated information and communications facilities (IDC), etc.
    • Use of external services: cloud services, application services (ASP), etc.

  • Preparing a list of the status of business outsourcing and the use of external facilities/services, and continuously keeping it up to date

    ※ Matters that should be included in the list of the status of business outsourcing and the use of external facilities/services (examples)

    • Name of the trustee and of the external facility/service
    • Content of the outsourced work and content of the external service
    • Responsible department and name of the person in charge
    • Period of outsourcing and service use
    • Matters concerning management/supervision, such as whether a contract has been drawn up and whether security inspections are conducted, etc.

The legal requirements and risks arising from business outsourcing and the use of external facilities/services shall be ascertained, and appropriate protective measures shall be established.

  • Checking whether it corresponds to the outsourcing of personal information processing tasks

  • Checking whether it corresponds to the overseas transfer of personal information, etc.

  • Ascertaining the relevant legal requirements under the Personal Information Protection Act, the Network Act, etc.

  • Performing a risk assessment for business outsourcing and the use of external facilities/services, including legal requirements

  • Establishing and implementing appropriate protective measures reflecting the results of the risk assessment (for example, conducting intensive on-site inspections for high-risk trustees by varying the inspection cycle and inspection items, etc.)

Related laws

  • Personal Information Protection Act Article 26 (Restrictions on Processing of Personal Information Following Outsourcing of Tasks)
  • Network Act Article 50-3 (Outsourcing, etc. of Transmission of Advertising Information for Commercial Purposes)

Evidence (examples)

  • Status of external outsourcing and external facilities/services
  • External outsourcing contracts
  • Risk analysis reports and protective measures
  • Outsourcing security management guidelines, checklists, etc.

Nonconformity examples

  • The organization manages the status of external outsourcing and external facilities/services as a list in accordance with internal regulations, but the up-to-date management is inadequate, for example, an outsourcing vendor that was changed several months ago is not reflected in the list
  • Some personal information processing systems within the scope of the management system were migrated to an external cloud service, but identification and risk assessment for this were not performed

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence4
Cases2
Related lawsYes