Management of External Party Security Implementation
Certification criterion
In accordance with the information security and personal information protection requirements specified in contracts, agreements, and internal policies, the organization shall manage and supervise whether external parties implement protection measures, through means such as periodic inspections or audits.
Key checkpoints
- Are periodic inspections or audits conducted to verify whether external parties comply with the information security and personal information protection requirements specified in contracts, agreements, and internal policies?
- Are improvement plans established and implemented for problems discovered during inspections or audits of external parties?
- When a trustee entrusted with personal information processing tasks re-entrusts the relevant tasks to a third party, is the consent of the entruster obtained?
Detailed explanation
Periodic inspections or audits shall be conducted to verify whether external parties comply with the information security and personal information protection requirements specified in contracts, agreements, and internal policies.
- Conduct periodic inspections or audits to verify whether the security requirements defined at the time of contracting with external parties are being complied with
- Inspections or audits of external parties shall be conducted before work begins, during the course of work, and at the point of completion, and additionally on an ad hoc basis when necessary
- Determine the cycle and method of status inspections by considering the trustee's information security and personal information protection capabilities, whether it possesses its own systems, and the quantity and sensitivity of the information it processes
Improvement plans shall be established and implemented for problems discovered during inspections or audits of external parties.
- Share the results of inspections and audits, and establish and implement improvement methods and recurrence prevention measures for discovered problems
- Conduct implementation checks on whether the improvement actions have been completed
When a trustee entrusted with personal information processing tasks re-entrusts the relevant tasks to a third party, the consent of the entruster shall be obtained.
-
A personal information processing trustee may re-entrust only when it has obtained the consent of the entruster, and shall manage and supervise the re-trustee so that it implements the same level of technical/administrative protection measures that the entruster requires of the trustee
[Reference] Measures required when re-entrusting personal information processing tasks (Article 26(6) of the Personal Information Protection Act)
(6) A trustee, when intending to re-entrust the processing of the entrusted personal information to a third party, shall obtain the consent of the entruster.
Related laws
- Personal Information Protection Act Article 26 (Restrictions on Processing of Personal Information Following Outsourcing of Tasks)
- Network Act Article 50-3 (Outsourcing, etc. of Transmission of Advertising Information for Commercial Purposes)
Evidence (examples)
- Results of security inspections of external parties and trustees
- Training records for external parties and trustees (training results, attendee lists, training materials, etc.)
- Personal information entrustment contract
- Evidence of the entruster's consent when re-entrusting personal information processing tasks
Nonconformity examples
- Where periodic security inspections are not conducted for an outsourcing company that resides on the premises and performs IT development and operation tasks
- Where an official letter is sent instructing a personal information trustee to conduct security training, but whether the training has been carried out is not verified
- Where the trustee is required to notify the results after conducting its own security inspection, but there is no procedure to verify whether the trustee is faithfully performing the security inspection, so that the reliability of the security inspection results is very low
- Where some of the personal information processing trustees re-entrusted the relevant tasks to a third party without the consent of the entruster
- Where the transmission of advertising information for commercial purposes is entrusted to another person, but management/supervision of the trustee is not conducted