한국어
2.4.5

Work within Protected Areas

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 3Cases 2

Certification criterion

Work procedures shall be established and implemented to prevent unauthorized acts and abuse/misuse of privileges within protected areas, and work records shall be reviewed periodically.

Key checkpoints

  1. When work within a protected area is required for purposes such as the introduction or maintenance of information systems, are formal work request and execution procedures established and implemented?
  2. Are work records reviewed periodically to verify whether work within a protected area was carried out appropriately in accordance with control procedures?

Detailed explanation

For cases where work within a protected area is required for purposes such as the introduction or maintenance of information systems, formal work request and execution procedures shall be established and implemented.

  • Work procedures: work request, approval, preparation of work records, etc. when performing work in a controlled area
  • Work records: date and time of work, purpose and content of work, work company and person in charge, reviewer and approver, etc.
  • Control measures: procedures for entering the protected area to perform work, securing accountability for work details, monitoring measures, etc.

Work records shall be reviewed periodically to verify whether work within a protected area was carried out appropriately in accordance with control procedures.

  • Work review: periodic review of prior approval records, entry records, work records, etc.
  • Review method: consistency between entry request forms and entry records (management ledgers, system logs, etc.), etc.

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

  • Work request forms, work logs
  • Controlled area entry ledger
  • Records of entry to the controlled area and review records of work records

Nonconformity examples

  • A case where the computer room entry logs show entry records of staff from an external maintenance company, but there are no protected-area work request and approval records for them (a case where entry to and work within a protected area are carried out without a protected-area work request as required by internal regulations)
  • A case where internal regulations require inspection of work records within a protected area at least once per quarter, but inspection of work records within the protected area has not been performed for a long period without any particular reason

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence3
Cases2
Related laws-