한국어
2.9.1

Change Management

Based on official sourcesISMSISMS-PCheckpoints 2Evidence 3Cases 3

Certification criterion

Procedures shall be established and implemented so that all change histories of information system related assets can be managed, and the impact on system performance and security shall be analyzed before making a change.

Key checkpoints

  1. Are procedures for changes to information system related assets (hardware, operating systems, commercial software packages, etc.) established and implemented?
  2. Is the impact on performance and security analyzed before performing changes to information system related assets?

Detailed explanation

Procedures for changes to information system related assets (hardware, operating systems, commercial software packages, etc.) shall be established and implemented.

  • When changes to information system related assets are required, such as operating system upgrades, commercial software installation, functional improvement of applications in operation, network configuration changes, and expansion of CPU/memory/storage devices, establish and implement a formal procedure for the change

    ※ Items to be included in the change procedure (examples)

    • Change request
    • Review and approval by the responsible person
    • Change confirmation and verification
    • Identification and modification of related documents (asset list, operation manual, configuration diagram, etc.)
    • Change history management, etc.

The impact on performance and security shall be analyzed before performing changes to information system related assets.

  • When changes to information assets related to the information system are required, analyze the impact of the change on security, performance, business, etc. (necessity of policy changes for security systems such as firewalls, problems and impact when policies are changed, etc.)
  • Implement the change so as to minimize the impact of the change
  • Consider recovery measures for change failure in advance

Related laws

No individual legal provision directly corresponding to this item is specified.

Evidence (examples)

  • Change management procedure
  • Change management execution records (application/approval, change history, etc.)
  • Results of impact analysis due to changes

Nonconformity examples

  • A case where change work was recently performed due to DMZ segment redundancy, but no evidence of performing/approving the assessment of security risks and performance that could arise after the change was confirmed
  • A case where recent network change work was performed, but related review and notification were not sufficiently carried out, so the changes were not appropriately reflected in the network configuration diagram and in the access control lists (ACLs) of some access control systems (firewalls, database access control systems, etc.)
  • A case where a change management system was built so that the impact on performance and security is analyzed/consulted and the related history is managed when information systems are brought in or changed, but system changes are possible without going through that system, and the related changes are not appropriately reviewed

Source

Source: The certification criterion is based on [Annex 7] of the Notice on Certification, etc. of Information Security and Personal Information Protection Management Systems (2023.10.5); the key checkpoints are based on the "ISMS-P Certification Criteria Detailed Inspection Items" (2023.10.31); the detailed explanation, related laws, evidence, and nonconformity examples are based on the original text of the "ISMS-P Certification Criteria Guide" (2023.11.23). This English text is an unofficial translation for reference; the Korean original prevails.
On this page
Item info
SetAnnex 7
Applies toISMS / ISMS-P
Key checkpoints2
Evidence3
Cases3
Related laws-