Control of Devices Brought In and Out
Certification criterion
Control procedures for bringing information systems, mobile devices, storage media, and similar items into and out of protected areas must be established and implemented, and reviewed periodically.
Key checkpoints
- When information systems, mobile devices, storage media, and similar items are brought into or taken out of protected areas, are control procedures established and implemented to prevent security incidents such as information leakage and malicious code infection?
- Are records maintained and managed in accordance with the control procedures for items brought in and out, and is the history of items brought in and out inspected periodically so that compliance with the procedures can be verified?
Detailed explanation
When information systems, mobile devices, storage media, and similar items are brought into or taken out of protected areas, control procedures must be established and implemented to prevent security incidents such as information leakage and malicious code infection.
- Targets of bring-in/bring-out control : information systems (servers, network equipment, etc.), mobile devices (laptops, smart pads, smartphones, etc.), storage media (HDD, SSD, USB memory, external hard disks, CD/DVD, tapes, etc.), and similar items
- Bring-in/bring-out control procedures : prior approval by the person responsible for access control of the protected area, recording in the bring-in/bring-out management log, performing security checks on devices brought in and out (whether antivirus is installed, whether security updates are applied, whether infected with malicious code, whether a security sticker is attached, whether important information has leaked, etc.), periodic review of the bring-in/bring-out records, etc.
- Exception use procedure : exception application/approval, recording in the bring-in/bring-out management log, etc.
※ Items recorded in the bring-in/bring-out management log (examples)
- Date, time, and location of bringing in/out
- User information
- Model (type), device identification information (serial number, etc.)
- Reason for bringing in/out
- Security check results
- Administrator confirmation signature, etc.
Records must be maintained and managed in accordance with the control procedures for items brought in and out, and the history of items brought in and out must be inspected periodically so that compliance with the procedures can be verified.
-
Maintaining records of the history of items brought in and out within protected areas (bring-in/bring-out management log, bring-in/bring-out control system logs, etc.)
-
Periodically inspect the bring-in/bring-out history to review whether bringing items in and out of protected areas was carried out properly in accordance with the control procedures.
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 10 (Physical Safety Measures)
Evidence (examples)
- Application for bringing items in and out of protected areas
- Bring-in/bring-out management log
- Results of reviewing the bring-in/bring-out history
Nonconformity examples
- A case where control procedures for bringing mobile computing devices in and out have been established, but no control is applied to bringing mobile computing devices into controlled areas, so internal/external personnel who are permitted to enter use mobile computing devices without restriction
- A case where, under internal guidelines, computing equipment brought in and out must be recorded in the work plan and signed off by the responsible manager, but the responsible manager's signature is missing from many of the bring-in/bring-out records in the work plan