Review and Testing of Security Requirements

When introducing, developing, or changing an information system, review criteria and procedures shall be established to verify whether the security requirements defined in the analysis and design phases have been effectively applied, and testing shall be performed accordingly.

• Perform testing before acceptance of an information system to verify conformity with acceptance criteria
  • Establish acceptance criteria and procedures to verify whether the information system has been developed/changed and introduced in a way that satisfies the predefined security requirements
  • Before accepting the information system, verify conformity with the predefined acceptance criteria through testing and the like, then decide whether to accept it
  • It is necessary to verify system security settings, whether unnecessary default accounts have been removed, whether the latest security vulnerability patches have been applied, and so on
• Perform testing on whether the developed/changed and implemented functions satisfy the predefined security requirements
  • Reflect this in the test plan, checklists, test result reports, and the like

Vulnerability assessment shall be performed to verify whether the information system has been developed safely in accordance with secure coding standards and the like.

• After coding is completed, inspect compliance with secure coding standards and conventions, and inspect whether technical security vulnerabilities exist
  • Verify the source code to check whether the system is implemented in accordance with secure coding standards (e.g., using source code verification tools)
  • For programs whose coding is completed, inspect whether vulnerabilities are exposed through vulnerability assessment tools or simulated diagnosis in an environment identical to the operating environment

Procedures such as establishing improvement plans and checking their implementation shall be carried out so that problems found during testing and vulnerability assessment can be improved promptly.

• Establish and carry out procedures such as improvement planning, internal reporting, and implementation checking so that the problems found can be improved before the system goes live
• When improvement before the system goes live is difficult for unavoidable reasons, prepare measures to reduce the risk, such as impact assessment, supplementary measures, and internal reporting

Public institutions shall, in accordance with the relevant laws, perform a privacy impact assessment through an impact assessment agency in the analysis/design phase when newly developing or changing a personal information processing system, and reflect the results in the development and change.

• When public institutions establish a plan for the new development or change of a personal information processing system, they shall review whether it is subject to the mandatory privacy impact assessment, and if it is a mandatory target, establish an impact assessment plan and secure the related budget

  ★ Targets subject to mandatory privacy impact assessment (Article 35 of the Enforcement Decree of the Personal Information Protection Act)

  1. (Condition of 50,000 persons) A personal information file involving the processing of sensitive information or unique identifying information: where the personal information file to be built/operated or changed contains the personal information of 50,000 or more data subjects
  2. (Condition of 500,000 persons) Where linkage with another personal information file is intended: where, as a result of linkage with another personal information file built/operated inside or outside the relevant public institution, the personal information of 500,000 or more data subjects is included
  3. (Condition of 1,000,000 persons) A general personal information file: where the personal information file to be built/operated or changed contains the personal information of 1,000,000 or more data subjects
  4. (In case of change) Where the operating system of a personal information file, such as the personal information search system, is to be changed after receiving an impact assessment: the changed part of the relevant personal information file ※ Target personal information files: personal information files that can process personal information electronically

• Public institutions shall, in the analysis/design phase when newly developing or changing a personal information processing system, perform an impact assessment through an impact assessment agency designated by the Personal Information Protection Commission, and reflect the results in the development and change

  • The status of designated impact assessment agencies can be verified on the "Privacy Portal (www.privacy.go.kr)"
  • For the impact assessment performance procedures, assessment criteria, and the like, refer to the "Privacy Impact Assessment Performance Guide"

• Public institutions shall submit the privacy impact assessment report to the Personal Information Protection Commission before the personal information processing system goes live and within 2 months after the completion of the impact assessment

  • Register the impact assessment report in the Integrated Privacy Support System (intra.privacy.go.kr)
  • The Personal Information Protection Commission or the head of the public institution may disclose a summary of the impact assessment report

• Manage whether the improvement requirements resulting from the privacy impact assessment are implemented

  • Establish a detailed implementation plan for the improvement requirements
  • Regularly check the implementation status
  • Where measures within the period are unavoidably difficult, record/report the valid reasons and establish an implementation plan for future measures
  • The head of a public institution that has received an impact assessment report shall submit to the Personal Information Protection Commission, within 1 year, the implementation status of the parts identified as items for improvement (implementation check confirmation of the improvement plan)

※ Privacy impact assessment procedure

System construction	Impact assessment
Project planning	Project preparation stage
Analysis/design	Impact assessment performance stage
Development	Implementation stage
Testing	Implementation stage
Operation	Implementation stage

Impact assessment	Assessment procedure		Year of performance	Performing entity
Project preparation stage	Preparation of the project plan (securing the budget)	Review of the need for an impact assessment Preparation of the project plan document (securing the budget)	Year immediately before the assessment	Target institution (public institution)
Project preparation stage	Selection of the contractor	Preparation of the request for proposal Placement of the project order Selection of the impact assessment agency	Year of the assessment	Target institution (public institution)
Impact assessment performance stage	Establishment of the assessment performance plan	Establishment of the assessment performance plan Formation of the assessment team	Year of the assessment	Impact assessment agency (performance of the impact assessment and preparation of the impact assessment report) Target institution (work cooperation, submission of the impact assessment report, and implementation of the improvement plan)
Impact assessment performance stage	Collection of assessment materials	Analysis of internal materials Analysis of external materials Analysis of materials related to the target system	Year of the assessment	Impact assessment agency (performance of the impact assessment and preparation of the impact assessment report) Target institution (work cooperation, submission of the impact assessment report, and implementation of the improvement plan)
Impact assessment performance stage	Personal information flow analysis	Analysis of the status of personal information processing tasks Preparation of the personal information flow table Preparation of the personal information flow diagram Preparation of the system structure diagram	Year of the assessment	Impact assessment agency (performance of the impact assessment and preparation of the impact assessment report) Target institution (work cooperation, submission of the impact assessment report, and implementation of the improvement plan)
Impact assessment performance stage	Analysis of personal information infringement factors	Preparation of assessment items Identification of the status of personal information protection measures Derivation of personal information infringement factors Calculation of the personal information risk level	Year of the assessment	Impact assessment agency (performance of the impact assessment and preparation of the impact assessment report) Target institution (work cooperation, submission of the impact assessment report, and implementation of the improvement plan)
Impact assessment performance stage	Establishment of the improvement plan	Derivation of improvement items Establishment of the improvement plan	Year of the assessment	Impact assessment agency (performance of the impact assessment and preparation of the impact assessment report) Target institution (work cooperation, submission of the impact assessment report, and implementation of the improvement plan)
Impact assessment performance stage	Preparation of the impact assessment report	Preparation of the impact assessment report → Submission of the impact assessment report (Protection Commission)	Year of the assessment	Impact assessment agency (performance of the impact assessment and preparation of the impact assessment report) Target institution (work cooperation, submission of the impact assessment report, and implementation of the improvement plan)
Implementation stage	Reflection/check of the improvement plan	Reflection of the improvement plan (development stage) Check of the reflection of the improvement plan (test stage)	Year of the assessment	Target institution Audit contractor
Implementation stage	Confirmation of the implementation of improvement items	Confirmation of the implementation of improvement items (within 1 year) → Submission of the implementation confirmation (Protection Commission)	Year after the assessment	Target institution

<Source> Privacy Impact Assessment Performance Guide (Personal Information Protection Commission, KISA)