한국어
2.7.2

Cryptographic Key Management

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 2Cases 3

Certification criterion

Management procedures for the secure generation, use, storage, distribution, and destruction of cryptographic keys must be established and implemented, and a recovery plan must be prepared when necessary.

Key checkpoints

  1. Are procedures for the generation, use, storage, distribution, change, recovery, destruction, etc. of cryptographic keys established and implemented?
  2. Are cryptographic keys stored in a separate secure location so that they can be recovered when necessary, and are access rights for cryptographic key use minimized?

Detailed explanation

Policies and procedures that include the following content must be established for the generation, use, storage, distribution, and destruction of cryptographic keys.

  • Person in charge of cryptographic key management
  • Methods for generating and storing cryptographic keys (offsite backup, etc.)
  • Recipients and distribution methods for cryptographic keys (including granting decryption rights)
  • Validity period for cryptographic key use (change cycle) : determined by considering cost, business importance, etc. when changing cryptographic keys
  • Procedures and methods for cryptographic key recovery and disposal
  • Matters concerning the prohibition of recording cryptographic keys as hard-coded values in source code, etc.

Cryptographic keys must be stored in a separate secure location so that they can be recovered when necessary, and access rights for cryptographic key use must be minimized.

  • To recover the system or encrypted information in case of cryptographic key damage, cryptographic keys must be stored on a separate medium and then kept in a secure location (cryptographic key management system, physically separated location, etc.)
  • Minimizing access rights to cryptographic keys and monitoring access, etc.

Related laws

  • Personal Information Protection Act Article 29 (Duty of Safety Measures)
  • Standards for Measures to Ensure the Safety of Personal Information Article 7 (Encryption of Personal Information)

Evidence (examples)

  • Cryptographic key management policy
  • Cryptographic key management ledger and management system screens

Nonconformity examples

  • When procedures, methods, etc. related to cryptographic key management are not specified within the encryption policy, resulting in vulnerabilities in cryptographic key management such as differences in the level and method of cryptographic key management by person in charge
  • When internal regulations require that, when encrypting important information, encryption keys be generated with the approval of the relevant responsible party and a cryptographic key management ledger be prepared, but some cryptographic keys are omitted from the cryptographic key management ledger or the ledger is not kept up to date
  • When the cryptographic key applied to the development system is identical to the cryptographic key applied to the operational system, so that encrypted real data can be easily decrypted through the development system

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence2
Cases3
Related lawsYes