Log and Access Record Review
Certification criterion
To ensure the normal use of information systems and to prevent user misuse/abuse (unauthorized access, excessive inquiries, etc.), the organization shall establish log review standards for access and use, periodically inspect the logs against those standards, and perform timely follow-up measures when problems occur.
Key checkpoints
- Are log review and monitoring procedures established/implemented, including the log review cycle, targets, and methods, so that anomalies such as information system errors, misuse/abuse (unauthorized access, excessive inquiries, etc.), and fraudulent acts can be recognized?
- Are the results of log review and monitoring reported to the responsible person, and when anomalies are found, are they responded to according to procedures?
- Are the access records of the personal information processing system inspected regularly according to the cycle prescribed by relevant laws?
Detailed explanation
Log review and monitoring procedures, including the log review cycle, targets, and methods, shall be established/implemented so that anomalies such as information system errors, misuse/abuse (unauthorized access, excessive inquiries, etc.), and fraudulent acts can be recognized.
- Review cycle
- Review targets
- Review standards and methods
- Reviewers and responsible persons
- Response procedures when anomalies are found, etc.
The results of log review and monitoring shall be reported to the responsible person, and when anomalies are found, they shall be responded to according to procedures.
- After conducting the review according to the log review and monitoring standards, report the results, including whether anomalies were found, to the relevant responsible person
- When anomalies are found, establish procedures to check whether information leakage, hacking, misuse/abuse, fraudulent acts, etc. have occurred, and respond according to the procedures
- When it is confirmed that personal information has been downloaded, verify the reason according to the log review standards prescribed in the internal management plan, etc., and if it is confirmed that the download was for the purpose of misuse/abuse or leakage of personal information, perform necessary measures without delay, such as retrieving and destroying the personal information downloaded by the personal information handler
The access records of the personal information processing system shall be inspected regularly according to the cycle prescribed by relevant laws.
- Personal information access record inspection cycle under the law: at least once per month
Related laws
- Personal Information Protection Act Article 29 (Duty of Safety Measures)
- Standards for Measures to Ensure the Safety of Personal Information Article 8 (Retention and Inspection of Access Records)
Evidence (examples)
- Log review and monitoring procedures
- Log review and monitoring results (review records, reports, etc.)
- Personal information access record inspection records
- Standards and results for verifying reasons when personal information is downloaded
- Evidence of response when anomalies are found
Nonconformity examples
- When a monitoring and warning/alert policy (standard) has not been established for anomalous access (access at dawn on holidays, access via detour routes, etc.) or anomalous behavior (bulk data inquiries, or continuous/consecutive inquiries of small amounts of data, etc.) to information systems that process important information
- When periodic inspection/monitoring standards for access and use are established in internal guidelines or systems, etc., but no review records of actual anomalous access and anomalous behavior can be confirmed
- When a personal information controller sets the inspection cycle for access records of the personal information processing system as once per quarter
- When the internal management plan of a personal information controller sets a standard to verify the reason when personal information of 1,000 or more data subjects is downloaded, but even though a download of 1,000 or more records of personal information occurred, the reason is not being verified