한국어
2.3.4

Security upon Change or Expiration of External Party Contracts

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 4Cases 3

Certification criterion

Upon expiration of an external party contract, completion of work, or change of the responsible person, protection measures must be implemented, such as returning provided information assets, deleting information system access accounts, destroying important information, and obtaining a confidentiality pledge covering information acquired during the performance of the work.

Key checkpoints

  1. Are security measures established and implemented so that, upon expiration of an external party contract, completion of work, or change of the responsible person, the return of information assets, deletion of information system access accounts, and obtaining of confidentiality pledges are carried out in accordance with formal procedures?
  2. Upon expiration of an external party contract, are procedures established and implemented to verify whether the external party holds important information and personal information related to the entrusted work, and to recover or destroy it?

Detailed explanation

Security measures must be established and implemented so that, upon expiration of an external party contract, completion of work, or change of the responsible person, the return of information assets, deletion of information system access accounts, destruction of important information, and obtaining of confidentiality pledges are carried out in accordance with formal procedures.

  • Establish information-sharing arrangements so that the responsible organization can promptly recognize when an external party contract expiration, completion of work, or change of the responsible person has occurred
  • Establish and implement security measures in response to external party contract expiration, completion of work, or change of the responsible person

※ Security measures upon external party contract expiration, completion of work, or change of the responsible person (examples)

  • Return of information assets in use (work PCs, smart devices, etc.)
  • Deletion of information system access accounts (including all related accounts such as VPN)
  • Recovery or change of access rights
  • Change of shared account passwords
  • Recovery of access passes and deletion of access rights
  • Obtaining confidentiality pledges, etc.

Upon expiration of an external party contract, procedures must be established and implemented to verify whether the external party holds important information and personal information related to the entrusted work, and to recover or destroy it.

  • To recover or destroy important information such as personal information, either visit the trustee's office directly or destroy the personal information remotely, and then prepare a destruction pledge
  • Deletion measures are required not only for information systems and the responsible person's PC but also for all devices and media where the relevant information is stored, such as mail inboxes and outboxes
  • Destroy the relevant information by a secure method so that it cannot be recovered or reproduced

Related laws

  • Personal Information Protection Act Article 26 (Restrictions on Processing of Personal Information Following Outsourcing of Tasks)
  • Network Act Article 50-3 (Outsourcing, etc. of Transmission of Advertising Information for Commercial Purposes)

Evidence (examples)

  • Information security and personal information protection pledge
  • Confidentiality pledge
  • Information and personal information destruction pledge
  • Internal policies and guidelines related to the termination of external party contracts

Nonconformity examples

  • A case where the accounts and access rights of an external party whose contract has expired have not been deleted and still exist in some information systems
  • A case where, during the performance of an outsourced service project, some service provider personnel were replaced or departed due to contract expiration, but measures under internal rules, such as a security pledge upon departure, were not carried out for the relevant personnel
  • A case where, after the contract with a company entrusted with personal information processing was terminated, it was not verified or checked whether the personal information held was destroyed

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence4
Cases3
Related lawsYes