KISA ISMS compliance framework 2023

Information protection and personal information protection reporting system (e.g., communication plan)

Minutes of the Information Protection and Personal Information Protection Committee

Information protection and personal information protection policies/guidelines (including executive approval records)

Information protection plans and internal management plans (including executive approval records)

Information protection and personal information protection organization chart

Is there documentation outlining the responsibilities and roles of executives to ensure their participation in the establishment and operation of the information protection and personal information protection management system?

Is there a reporting, review, and approval process in place to ensure that executives actively participate in decision-making regarding information protection and personal information protection activities?

Case 1: Although it is stated in the information protection and personal information protection policy to report the status of information protection and personal information protection to the executives on a quarterly basis, no such reports have been made for an extended period.

Case 2: In performing major information protection activities (e.g., risk assessment, determining risk acceptance levels, reviewing information protection measures and implementation plans, reviewing the results of information protection measures, security audits, etc.), executives or those authorized by the executives did not participate in decision-making or there was no evidence of their involvement.

Documents related to the appointment of the CISO and CPO (e.g., personnel orders, personnel records)

Information protection and personal information protection organization chart

Information protection and personal information protection policies/guidelines

Job descriptions (roles and responsibilities of the CISO and CPO)

Records of CISO reports

Internal management plans (regarding the appointment of the CPO)

Has the CEO officially designated a chief officer responsible for overseeing information protection and personal information protection?

Are the CISO and CPO appointed at an executive level with authority to allocate resources such as budget and personnel, and do they meet the qualifications required by relevant laws?

Case 1: Failure to appoint and report a CISO as required under the Information and Communications Network Act, even though the organization is obligated to do so.

Case 2: Appointing a person without substantial authority and status as the CPO, making it difficult to believe that they are responsible for overseeing personal information processing.

Case 3: Although the organization chart specifies the CISO and CPO, the formal appointment process, such as issuing personnel orders, was not followed.

Case 4: Although the entity is subject to ISMS certification and had over 5 trillion won in assets at the end of the previous year, the CISO also holds the position of CIO, in violation of the ISMS requirements.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures), Article 31 (Designation of a Personal Information Protection Officer)

Information and Communications Network Act, Article 45-3 (Designation of a Chief Information Security Officer, etc.)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Information protection and personal information protection committee regulations/minutes

Information protection and personal information protection working group regulations/minutes

Information protection and personal information protection organization chart

Internal management plan

Job descriptions

Has the organization established and operated a working group with expertise to support the work of the CISO and CPO and systematically implement the organization's information protection and personal information protection activities?

Has the organization established and operated a committee that can review, approve, and make decisions on important information protection and personal information protection matters across the organization?

Has the organization established and operated a working group composed of information protection and personal information protection officers and department-level personnel for enterprise-wide information protection and personal information protection activities?

Case 1: The Information Protection and Personal Information Protection Committee was established, but it consists only of department heads without the inclusion of executives, making it difficult to make decisions on the organization's key information and personal information protection matters.

Case 2: Although a working group for information protection and personal information protection was established, including heads of departments that handle important information and personal data, it has not been active for an extended period.

Case 3: Although the Information Protection and Personal Information Protection Committee was convened, major matters such as the annual information protection and personal information protection plan, training plan, budget, and personnel were not reviewed or decided upon.

Case 4: Although an Information Protection Committee was established for deliberation and decision-making on information protection and personal information protection matters, only the operations and IT security departments participated, without the involvement of departments responsible for personal information protection, leaving personal information protection matters undecided.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Scope definition document for information protection and personal information protection management system

List of information assets and personal information

Document list

Service flowchart

Personal information flowchart

Organization-wide organizational chart

System and network configuration diagram

Has the organization set the scope of the management system to include key assets that may affect core services and personal information processing?

If there are exceptions within the defined scope, are clear reasons documented, and are consultations with relevant stakeholders and approvals from responsible parties recorded and managed?

Is the organization maintaining documentation that includes the major services, operational status, and systems, allowing for clear verification of the scope of the information protection and personal information protection management system?

Case 1: The development and test systems, external staff, PCs, and test devices related to the development work for information systems and personal information processing systems were omitted from the management system's scope.

Case 2: Key organizations (personnel) in departments and business units that play critical roles in decision-making for services or businesses within the scope of the information protection and personal information protection management system were not included in the certification scope.

Case 3: The development and test systems, developer PCs, test devices, and development organizations related to the development work for information systems and personal information processing systems were omitted from the management system's scope.

Information protection and personal information protection policies/guidelines/procedures (including records of new/revised versions)

Meeting minutes of stakeholder reviews of newly established/revised information protection and personal information protection policies/guidelines/procedures

Internal management plans for personal information

Notifications of new/revised information protection and personal information protection policies/guidelines (via groupware, intranet, etc.)

Minutes of the Information Protection and Personal Information Protection Committee

Has the organization established a top-level information protection and personal information protection policy that serves as the foundation for all information protection and personal information protection activities?

Has the organization established detailed guidelines, procedures, and manuals specifying the methods, processes, and frequencies required to implement the information protection and personal information protection policies?

Are the information protection and personal information protection policies and implementation documents approved by the CEO or by someone delegated by the CEO when newly established or revised?

Are the latest versions of the information protection and personal information protection policies and implementation documents provided to relevant employees in an easily understandable format?

Case 1: Although internal regulations stipulate that revisions to the information protection and personal information protection policies must be approved by the Information Protection and Personal Information Protection Committee, recent revisions were made solely based on the approval of the CISO and CPO without presenting the revisions to the committee.

Case 2: The information protection and personal information protection policies and guidelines were recently revised, but these changes were not communicated to relevant departments and employees, leading some departments to continue operating based on outdated guidelines.

Case 3: The information protection and personal information protection policies and guidelines are managed solely by the security department and are not made available for employees to access through bulletin boards or documents.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Annual action plan for information protection and personal information protection activities (including budget and personnel plans)

Reports on the results of information protection and personal information protection activities

Records of investments in information protection and personal information protection

Information protection and personal information protection organization chart

Has the organization secured personnel with expertise in the fields of information protection and personal information protection?

Has the organization evaluated and allocated the necessary resources, including budget and personnel, for the effective implementation and continuous operation of the information protection and personal information protection management system?

Has the organization established and implemented an annual detailed action plan for information protection and personal information protection, and conducted audits, analyses, and evaluations of the results?

Case 1: The organization assembled an information protection and personal information protection team, but the team consisted only of personnel without expertise in information protection or IT, resulting in inadequate security staffing.

Case 2: The CEO failed to allocate sufficient resources, such as budget and security solutions, for implementing the technical and managerial safeguards required for personal information processing systems.

Case 3: After obtaining certification, the organization significantly reduced personnel and budget support, reassigned existing staff to other departments, and repurposed part of the budget for other uses.

Information asset and personal information asset classification criteria

Information asset and personal information asset list (from asset management system screen)

Information asset and personal information security levels

Asset audit details

Risk analysis report (including asset identification)

Has the organization established classification criteria for information assets and identified all assets within the scope of the information protection and personal information protection management system, maintaining them in a list?

For the identified information assets, does the organization determine their importance by considering legal requirements and their impact on operations, and assign security levels?

Does the organization regularly review the status of information assets to keep the list up-to-date?

Case 1: The list of assets within the scope of the information protection and personal information protection management system omits internal information leakage control systems, such as print security, document encryption, and USB media control, which are used to manage PCs handling important information and personal information.

Case 2: Personal information provided by third parties within the scope of the information protection and personal information protection management system has not been identified as an asset.

Case 3: The asset classification criteria in the internal guidelines and the classification criteria in the asset management register are inconsistent.

Case 4: Although on-premises assets have been identified, assets related to externally entrusted IT services (web hosting, server hosting, cloud, etc.) have been omitted (only for assets within the certification scope).

Case 5: The backup server storing unique identification information and other personal data has been classified with a low confidentiality rating, raising concerns about the reasonableness and reliability of the importance assessment.

Information service status table

Information service workflow charts and process maps

Personal information processing status table (for ISMS-P certification)

Personal information flowcharts (for ISMS-P certification)

Has the organization identified and documented the status and workflows of information services across all areas of the management system?

Has the organization identified and documented the status of personal information processing within the scope of the management system, and mapped out personal information flows in flowcharts?

Does the organization regularly review procedures and workflows in response to changes in services, operations, and information assets, and keep the flowcharts and related documents up-to-date?

Case 1: There are no documents outlining the workflows and procedures for major services within the scope of the management system.

Case 2: The personal information flowchart contains significant discrepancies from the actual personal information flow, or important personal information flows are missing.

Case 3: After the initial creation of the personal information flowchart, it has not been updated to reflect changes in the personal information flow.

Risk management guidelines

Risk management manuals/guides

Risk management plan

Risk assessment report

Minutes of the Information Protection and Personal Information Protection Committee

Minutes of the Information Protection and Personal Information Protection Working Group

Information asset and personal information asset list

Information service and personal information flowcharts

Has the organization defined methods for identifying and assessing risks that could arise from various aspects, depending on the characteristics of the organization or service?

Does the organization annually develop a risk management plan that specifies the personnel, timeline, targets, methods, and budget for risk management activities?

Does the organization conduct regular or ad-hoc risk assessments at least once a year according to the risk management plan?

Has the organization established an acceptable target risk level and identified risks that exceed that level?

Are the results of risk identification and assessment reported to the executives?

Case 1: The risk management plan specifies the risk assessment period and the targets and methods for risk management, but lacks details on the personnel and budget required for execution.

Case 2: While a risk assessment was conducted in the previous year, no risk assessment was conducted this year due to a lack of changes in assets.

Case 3: The organization conducted risk identification and assessment according to the risk management plan, but failed to assess the risks of important information assets within the scope, or failed to assess compliance with legal requirements related to information protection.

Case 4: The organization identified and assessed risks and set an acceptable target risk level according to the risk management plan, but did not report and seek approval from the executives (e.g., the Chief Information Security Officer).

Case 5: The method defined in the internal guidelines for risk assessment differs from the method actually used.

Case 6: The organization failed to identify and assess risks in the administrative and physical areas related to the information protection management system, and used only the results of technical vulnerability assessments as the risk assessment outcome.

Case 7: The organization set the acceptable target risk level (DoA) unreasonably high, designating risks that required action as acceptable risks, even though these risks were significant and required immediate or short-term action.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Information protection and personal information protection implementation plans/risk management plan

Information protection and personal information protection measures

Information protection and personal information protection master plan

Records of management reports and approvals for the information protection and personal information protection implementation plan

Has the organization developed risk treatment strategies (e.g., risk reduction, avoidance, transfer, acceptance) and selected protective measures to address the identified risks?

Has the organization established and reported to management an implementation plan that includes priority, schedule, responsible department/personnel, and budget for the protective measures?

Case 1: Although an implementation plan for the information protection and personal information protection measures was established, it was not reported to the CISO and CPO.

Case 2: Some risk mitigation actions that were required were missing from the implementation plan.

Case 3: Mandatory legal requirements and risks with high security vulnerabilities were accepted without additional protective measures, instead of being addressed by a risk treatment plan.

Case 4: The rationale and validity for risk acceptance were insufficient, and some risks that could have been addressed immediately or in the short term due to urgency or ease of implementation were classified under long-term plans without specific justification.

Information protection and personal information protection implementation plans/risk management plans

Information protection and personal information protection measures

Information protection and personal information protection implementation progress reports (including reports to management)

Information protection and personal information protection implementation completion reports (including reports to management)

Information protection and personal information protection operating statements

Are the protective measures effectively implemented according to the implementation plan, and are the implementation results reported to management to verify their accuracy and effectiveness?

Has the organization created and documented detailed operating statements recording the implementation and operation status of protective measures according to the certification standards of the management system?

Case 1: The results of the completion of the information protection and personal information protection measures were not reported to the CISO and CPO.

Case 2: The risk action implementation result report indicated 'completed,' but related risks still existed, or the accuracy and effectiveness of the implementation results were not verified.

Case 3: Risks classified as medium- to long-term in the previous year's information protection measures implementation plan were not implemented in the current year, or the results were not reviewed and verified by management.

Case 4: The actual operating status described in the operating statements did not match reality, and related documents, approvals, and meeting minutes mentioned in the operating statements did not exist.

Case 5: Although the implementation results were reported to the CISO and CPO, some incomplete items were not followed up with reasons and corrective actions.

List of operating or implementing departments for each protective measure

Evidence of internal sharing of information protection and personal information protection plans (e.g., notices, training materials, shared documents)

Has the organization clearly identified the departments and personnel responsible for the operation or implementation of the protective measures?

Has the organization shared or provided training to the departments and personnel responsible for the operation or implementation of the protective measures?

Case 1: Although protective measures were developed and implemented, the relevant information was not sufficiently shared or provided through training, so the departments or personnel responsible for the actual operation or implementation were unaware of the details.

Annual plan for information protection and personal information protection

Operation status report for information protection and personal information protection

Results of inspections on the implementation of information protection and personal information protection activities

Are information protection and personal information protection activities that need to be performed periodically or continuously for the operation of the management system documented and managed?

Does management periodically review the effectiveness of the operation of the management system and manage it accordingly?

Case 1: Failure to document activities that are required to be performed periodically or continuously as part of the operation of the information protection and personal information protection management system.

Case 2: Although documentation of the operational status of the information protection and personal information protection management system has been completed, periodic reviews have not been conducted, resulting in the omission of some required monthly and quarterly activities, and some activities have not been verified for implementation.

Personal Information Protection Act, Article 31 (Designation of a Personal Information Protection Officer)

Information and Communications Network Act, Article 45-3 (Designation of a Chief Information Security Officer, etc.)

Records of legal compliance reviews

Records of reviews and revisions of information protection and personal information protection policies and guidelines

Comparison tables of revised policies and guidelines

Internal sharing documents of legal revisions

Proof of personal information liability insurance or equivalent guarantees (e.g., cyber insurance contracts)

Information protection disclosure records

Is the organization regularly identifying and maintaining up-to-date legal requirements related to information protection and personal information protection?

Is the organization conducting regular reviews of compliance with legal requirements at least once a year?

Case 1: Although the Information and Communications Network Act and Personal Information Protection Act were recently revised, the organization did not review the impact of the changes on the organization, and as a result, the policy documents, implementation documents, and legal compliance checklists were not updated, leading to inconsistencies between the documents and the law.

Case 2: Although legal requirements that the organization must comply with were amended, the organization failed to conduct legal compliance reviews for an extended period.

Case 3: Inadequate legal compliance reviews resulted in numerous violations of the Personal Information Protection Act and other regulations.

Case 4: The organization was subject to the Personal Information Liability Compensation Guarantee system under the Personal Information Protection Act but failed to recognize this, resulting in non-compliance with insurance or reserve requirements. In cases where insurance was obtained, the organization failed to meet the minimum coverage requirements based on the number of users and revenue.

Case 5: Although the organization was required by law to disclose information protection status, it failed to do so within the legally mandated timeframe.

Case 6: The organization used a mobile app to receive personal location information from a location-based service provider, but failed to report its location-based service business.

Case 7: A foreign personal information controller without a domestic address or business office, whose personal information of domestic subjects stored and managed in the previous three months averaged over one million persons per day, failed to appoint a domestic representative in writing as required.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Management system audit plan (internal audit plan, internal inspection plan)

Management system audit report

Minutes of the Information Protection and Personal Information Protection Committee

Has the organization established a management system audit plan that includes the criteria, scope, frequency, and qualifications for audit personnel to audit the management system's effectiveness in accordance with legal requirements and established policies?

Has the organization conducted audits at least once a year with personnel who have independence, objectivity, and expertise, and reported any identified issues to management?

Case 1: The audit team included personnel from the IT department, which was also the subject of the audit, compromising the independence of the audit.

Case 2: Although a management system audit was conducted this year, the audit scope was limited to certain areas, failing to cover the full scope of the information protection and personal information protection management system.

Case 3: The management system audit team was composed solely of internal staff and external consultants who participated in the development of the management system, compromising the independence of the audit.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Management system inspection result reports

Management system inspection action plans and implementation result reports

Preventive measures

Effectiveness measurement indicators and results (including reports to management)

Are the root causes of the issues identified during legal compliance reviews and management system inspections analyzed, and are preventive and improvement measures established and implemented?

Are there criteria and procedures in place to verify the accuracy and effectiveness of preventive and improvement results?

Case 1: The same issues in the operation of the information protection and personal information protection management system, identified during internal inspections, are repeated each time.

Case 2: Although internal regulations require the analysis of root causes and the establishment of preventive measures for issues identified during internal inspections, recent internal inspections failed to include root cause analysis and preventive measures.

Case 3: Preventive measures for the issues in the management system were established, and key performance indicators (KPIs) were developed for periodic measurement, but the results were not reported to management for a long period.

Case 4: Action plans were not established or the completion of actions was not confirmed for issues identified during management system inspections.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Information protection and personal information protection policies and implementation documents (e.g., guidelines, procedures, manuals)

Results of regular and ad hoc validity reviews of policies and guidelines

Meeting minutes and circulation records with relevant departments regarding policies and guidelines

Revision history of policies and guidelines

Has the organization established and implemented a procedure for regularly reviewing the validity of information protection and personal information protection policies and implementation documents?

When there are significant changes in the internal and external environment, are the impacts on information protection and personal information protection policies and implementation documents reviewed and revised as necessary?

Are stakeholders consulted when revising information protection and personal information protection policies and implementation documents?

Is there a system in place to track the revision history of information protection and personal information protection policies and implementation documents?

Case 1: There is inconsistency between password setting rules in guidelines and procedures.

Case 2: Information protection activities (e.g., training, encryption, backup) have different targets, frequencies, levels, and methods described in internal regulations, guidelines, and procedures, leading to inconsistency.

Case 3: A new database access control solution was introduced to effectively record and manage access and operation logs for the database, but internal security guidelines such as those for security systems and database security management have not been updated to reflect these new controls.

Case 4: Although the personal information protection policy was revised, the policy implementation date was not specified, and information such as the author, creation date, and approval date were missing from the relevant policy.

Case 5: Although significant changes occurred in laws and regulations related to personal information protection, these changes were not reviewed or reflected in the personal information protection policy and implementation documents.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Information protection and personal information protection organization chart

Job descriptions for the information protection and personal information protection organization

Assignment tables for information protection and personal information protection roles

Information protection and personal information protection policies/guidelines and internal management plans

Information protection and personal information protection communication management plans

Records of communication activities (e.g., monthly/weekly reports, internal notices)

Communication channels (e.g., information protection portal, bulletin boards)

Are the roles and responsibilities of those responsible for and involved in information protection and personal information protection clearly defined?

Has the organization established a system for evaluating the activities of those responsible for and involved in information protection and personal information protection?

Has the organization established and implemented systems and procedures for communication between the information protection and personal information protection organization and its members?

Case 1: Although the roles and responsibilities of the CISO, CPO, and related personnel are defined in internal guidelines and job descriptions, they do not align with the actual operating status.

Case 2: There are no goals, criteria, or performance indicators in place for the periodic evaluation of the activities of the CISO and related personnel.

Case 3: Although internal guidelines require departments to set KPIs related to information protection for the information protection officers in each department to be reflected in performance evaluations, no information protection-related KPIs were set for any of the departmental information protection officers.

Case 4: Although the CISO and CPO are designated, the roles and responsibilities required by law are not specifically defined in internal guidelines or job descriptions.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures), Article 31 (Designation of a Personal Information Protection Officer)

Information and Communications Network Act, Article 45-3 (Designation of a Chief Information Security Officer, etc.)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

List of information assets (designation of responsible persons and managers)

Handling procedures for information assets (documents, information systems, etc.)

Information asset management system screen

Security classification indicators for information assets

Are handling procedures (creation, introduction, storage, use, disposal) and protection measures defined and implemented according to the security classification of information assets?

Have responsible persons and managers been designated for identified information assets?

Case 1: Although internal guidelines require security classification to be indicated on documents, this has not been followed.

Case 2: Responsible persons and managers for information assets have not been identified, or the asset list has not been updated, leading to changes in responsible personnel due to resignations, transfers, etc., not being reflected.

Case 3: Although security classifications were assigned to identified information assets after evaluating their importance, handling procedures based on the security classification were not defined.

Criteria for key duties

List of key personnel

List of personal information handlers

Account and authority management ledger for key information systems and personal information processing systems

Management status of key personnel (e.g., training results, security pledges)

Are the criteria for key duties, such as handling personal information and important information or accessing key systems, clearly defined?

Are employees and external personnel performing key duties designated as key personnel, and is the list kept up-to-date?

Are personnel handling personal information designated as personal information handlers, and is the list kept up-to-date?

Is the designation of key personnel and personal information handlers minimized based on business needs, and are management plans established and implemented?

Case 1: Although a list of key personnel (e.g., personal information handlers, secret information managers) has been created, some employees who handle large volumes of personal information (e.g., DBAs, DLP managers) were omitted.

Case 2: Although the list of key personnel and personal information handlers is being managed, it has not been updated, including resigned employees and newly hired personnel.

Case 3: Personal information handler privileges were granted collectively to entire departments, leading to personnel without the need to handle personal information being excessively designated as personal information handlers.

Case 4: Although internal guidelines require approval from the security team and the signing of security pledges when granting key personnel privileges, many key personnel were registered without following this process.

Personal Information Protection Act, Article 28 (Supervision of Personal Information Handlers), Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Guidelines on the separation of duties (e.g., personnel security guidelines)

Job descriptions (e.g., system operation/management, development/operation)

Status of supplementary controls when duties are not separated

Are criteria for the separation of duties established and applied to prevent potential harm from the misuse or abuse of authority?

If separation of duties is difficult, have supplementary controls such as mutual review between personnel, regular monitoring and approval of changes by senior management, and ensuring accountability been established?

Case 1: Although the organization has sufficient size and personnel to enable separation of duties, the established internal separation of duties criteria were not followed due to operational convenience.

Case 2: Although the organization received approval from senior management to combine development and operation duties due to the organization's characteristics, supplementary control measures such as mutual review between personnel, regular monitoring and review of changes by senior management, and ensuring accountability were not established.

Security and personal information protection pledge (for employees and external personnel)

Confidentiality agreement (for resigned employees)

When hiring new personnel, is there a signed security and personal information protection agreement that specifies their responsibilities?

If temporary or external personnel are granted access to information assets, is there a signed agreement outlining their responsibilities for information protection and confidentiality?

Upon the resignation of an employee, is a separate confidentiality agreement obtained?

Are security, personal information protection, and confidentiality agreements stored safely and managed in a way that they can be easily retrieved when necessary?

Case 1: While it is stipulated that new hires must sign a security pledge, some recently hired employees have not completed the pledge.

Case 2: Although employees sign a security pledge, external personnel with direct access to information systems have not signed such an agreement.

Case 3: Submitted security and personal information protection pledges are poorly managed, with documents left accessible on desks where unauthorized personnel can access them.

Case 4: Although personal information handlers have signed security pledges, the content only covers confidentiality and does not include specific responsibilities related to personal information protection.

Information protection and personal information protection training plan

Training result report

General and job-specific training materials

List of training attendees

Is an annual training plan approved by management, detailing the timing, duration, target audience, content, and method of information protection and personal information protection training?

Are all employees and external personnel within the scope of the management system provided with regular training at least once per year, and are additional training sessions provided when there are significant changes in relevant laws and regulations?

Is information protection and personal information protection training provided to new hires and external personnel before they begin their duties?

Are IT, information protection, and personal information protection staff receiving specialized training to enhance their job-specific expertise?

Are training records maintained, and is the effectiveness of the training evaluated and reflected in future training plans?

Case 1: Although an annual information protection and personal information protection training plan was established and implemented last year, no such plan was established for the current year without a valid reason.

Case 2: The annual information protection and personal information protection training plan includes the frequency and target audience but lacks details such as schedule, content, and method.

Case 3: Although the annual training plan includes general personal information awareness training for all employees, it does not include job-specific training for those responsible for personal information protection, such as the personal information protection officer.

Case 4: Upon reviewing the training plan and result reports, it was found that certain external contractors (e.g., cleaning staff and security guards who have access to critical facilities within the certification scope) were not included in the training.

Case 5: Although information protection and personal information protection training was conducted, some records (e.g., training materials, attendance lists, evaluation surveys, result reports) were not retained.

Case 6: There is no system in place to identify employees who did not complete the required training or to provide make-up sessions for them (e.g., additional training, online courses).

Personal Information Protection Act, Article 26 (Limitation on the Processing of Personal Information by Outsourcing), Article 28 (Supervision of Personal Information Handlers), Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)

Procedures for resignation and job changes

Asset (account) return management ledger upon resignation

Security checklists and inspection records for resigned employees

Are personnel changes (e.g., resignation, job changes, department transfers, leave of absence) shared among HR, information protection, personal information protection, and IT system operations departments?

Are procedures in place and implemented to promptly return information assets, revoke or adjust access rights, and confirm results when an employee (including temporary staff and external contractors) resigns or changes roles?

Case 1: Accounts and access rights for personnel no longer handling personal information due to job changes remain active in the personal information processing system.

Case 2: No records of asset returns or access rights revocation procedures were found for recently resigned key personnel and personal information handlers.

Case 3: While asset returns are properly managed for resigned employees, the security check and resignation confirmation forms required by HR regulations are not being completed.

Case 4: Although access rights to personal information processing systems were revoked promptly upon the resignation of personal information handlers, access rights to systems like physical access control and VPN were not revoked in a timely manner.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)

HR regulations (disciplinary measures for violations of information protection and personal information protection regulations)

Records of disciplinary actions for violations of information protection and personal information protection guidelines

Incident case studies (company-wide notices, training materials)

Has the organization established disciplinary measures for employees and relevant external parties in case of violations of information protection and personal information protection responsibilities and obligations under laws, regulations, and internal policies?

When violations of information protection and personal information protection are detected, are actions taken in accordance with internal procedures?

Case 1: No disciplinary measures or procedures are included in internal regulations for handling violations of information protection and personal information protection regulations.

Case 2: Although warning messages are sent to those who violate policies detected by security systems (e.g., DLP, database access control system, internal information leakage control system), follow-up actions such as explanations, additional investigations, or disciplinary actions are not carried out in accordance with internal regulations.

List of outsourced services and external facilities/services

Outsourcing contracts

Risk analysis reports and protective measures

Outsourcing security management guidelines, checklists, etc.

Has the organization identified the status of outsourcing and the use of external facilities and services within the scope of the management system?

Has the organization identified the legal requirements and risks associated with outsourcing and the use of external facilities and services, and established appropriate protective measures?

Case 1: Although the organization manages a list of outsourced services and external facilities/services as required by internal regulations, the list is outdated and does not reflect changes made to vendors several months ago.

Case 2: The organization has migrated some personal information processing systems to external cloud services within the scope of the management system, but no identification or risk assessment has been performed.

Personal Information Protection Act, Article 26 (Restrictions on the Processing of Personal Information by Outsourcing)

Information and Communications Network Act, Article 50-3 (Entrustment of the Transmission of Commercial Information for Profit)

Outsourcing contracts

Information protection and personal information protection agreements (agreements, annexes)

Internal guidelines on outsourcing

RFPs (Requests for Proposals), evaluation forms related to the selection of outsourcing vendors

When selecting external services or outsourcing vendors related to the handling of important information and personal information, does the organization follow procedures to consider the vendors' capabilities in information protection and personal information protection?

Has the organization identified the information protection and personal information protection requirements associated with the use of external services and outsourcing, and specified them in contracts or agreements?

When outsourcing the development of information systems and personal information processing systems, has the organization specified the information protection and personal information protection requirements that must be followed during development in the contract?

Case 1: No outsourcing contract exists for external vendors performing IT operations, development, or personal information processing tasks.

Case 2: The outsourcing contract with an external vendor handling personal information does not include some items required by the Personal Information Protection Act (e.g., management and supervision provisions).

Case 3: Although infrastructure operation and part of personal information processing tasks are outsourced to external vendors, the contract does not specify security requirements related to the nature of the outsourced work, but only includes general provisions on confidentiality and liability for damages.

Personal Information Protection Act, Article 26 (Restrictions on the Processing of Personal Information by Outsourcing)

Security inspection results for external parties and contractors

Training details for external parties and contractors (training outcomes, attendee list, training materials, etc.)

Personal information outsourcing contract

Evidence of consent for re-outsourcing of personal information processing tasks

Are periodic inspections or audits conducted to ensure external parties comply with information protection and personal information protection requirements specified in contracts, agreements, and internal policies?

When issues are identified during inspections or audits of external parties, are improvement plans established and implemented?

If a contractor entrusted with personal information processing re-outsources related tasks to a third party, does the contractor obtain the principal's consent?

Case 1: Failure to regularly conduct security inspections of external contractors who perform IT development and operations tasks on-site.

Case 2: Sending a notification to contractors entrusted with personal information processing to conduct security training, but failing to verify whether the training has been conducted.

Case 3: Allowing contractors to perform their own security inspections and report the results, without a verification process to ensure the inspections were properly conducted, thus undermining the reliability of the inspection results.

Case 4: Allowing contractors to re-outsource personal information processing tasks to a third party without the principal's consent.

Case 5: Failure to supervise contractors entrusted with transmitting commercial information for profit.

Personal Information Protection Act, Article 26 (Restrictions on the Outsourcing of Personal Information Processing)

Information and Communications Network Act, Article 50-3 (Outsourcing of the Transmission of Commercial Information for Profit)

Information protection and personal information protection agreements

Confidentiality agreements

Information and personal information destruction agreements

Internal policies and guidelines related to the termination of external party contracts

Has the organization established and implemented security measures to ensure the return of information assets, deletion of information system access accounts, and the acquisition of confidentiality agreements in accordance with official procedures when an external party contract expires, a task is completed, or there is a personnel change?

When an external party contract expires, has the organization established and implemented procedures to confirm whether the external party holds any sensitive or personal information related to the outsourced task, and to retrieve or destroy such information?

Case 1: Failure to delete accounts and permissions for external parties after their contract has expired, allowing access to certain information systems.

Case 2: During an outsourcing project, failure to take appropriate measures for some contractors who were replaced or whose contracts expired, including failing to obtain security agreements as required by internal regulations.

Case 3: After terminating a contract with a contractor entrusted with personal information processing, failure to verify whether the contractor destroyed any personal information they held.

Personal Information Protection Act, Article 26 (Restrictions on the Outsourcing of Personal Information Processing)

Information and Communications Network Act, Article 50-3 (Outsourcing of the Transmission of Commercial Information for Profit)

Physical security guidelines (criteria for designating protected zones)

List of designated protected zones

Protected zone signage

List of protection measures for each zone

Has the organization established criteria for designating physical protection zones such as controlled areas, restricted areas, and reception areas to protect personal and sensitive information, documents, storage media, key facilities, and systems from physical and environmental threats?

Has the organization designated physical protection zones in accordance with the criteria and established and implemented protection measures for each zone?

Case 1: Although internal physical security guidelines state that areas where personal information is stored and processed must be designated as controlled zones, certain document storage rooms containing membership application forms were omitted from the list of controlled zones.

Case 2: Internal physical security guidelines require that controlled zones be marked with specific signs, but some controlled zones do not have the required signage.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)

Access logbook and entry logs

Access registration application form and approval records

Entry record review report

Access control system management screen (status of registered personnel, etc.)

Is access to protected areas controlled so that only authorized personnel are allowed to enter according to access procedures?

Are entry records for internal and external personnel for each protected area retained for a certain period, and are entry records and access permissions reviewed periodically?

Case 1: Although control areas are defined, protective measures are established, and employees with access are managed, the entry records are not reviewed periodically, resulting in many inactive personnel (due to retirement, transfer, etc.) having long periods of no entry.

Case 2: Although access control devices are installed in controlled areas such as data centers and document storage rooms, they are left open for extended periods without valid reasons or approval.

Case 3: Some external partner employees are excessively granted all-area access cards for unrestricted entry.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)

Data processing facility diagram

Information system layout

Asset list

Are information systems placed in separated locations based on their importance, usage, and characteristics?

Are there measures in place to easily verify the actual physical location of the information systems?

Are power and communication cables protected from physical damage and electrical interference from external sources?

Case 1: The system layout is not updated to reflect the latest changes, making it difficult to quickly identify the information system that has experienced a failure.

Case 2: Many cables are tangled and not properly organized on the server room floor or in racks, increasing the risk of failure due to electrical interference, damage, leakage, or negligence.

Physical security guidelines (related to protective facilities

Data center facility status and inspection checklist

IDC outsourcing contract, SLA, etc.

Are necessary facilities established and operational procedures set up based on the importance and characteristics of each protected area to prevent disasters such as fire, flood, and power failure caused by human error or natural disasters?

If operating outsourced integrated data centers (IDC), are physical security requirements included in the contract, and is the operational status periodically reviewed?

Case 1: In some protected areas, such as the main office data center, the required protective facilities specified in internal guidelines are not installed.

Case 2: Although protective facilities such as UPS and fire suppression systems are in place in the data center, operational and inspection standards for the related facilities are not established.

Case 3: Although temperature and humidity control devices were installed in the data center according to operational guidelines, insufficient capacity means that the standard temperature and humidity levels are not maintained, increasing the risk of failure.

Information and Communications Network Act, Article 46 (Protection of Integrated Data Centers)

Guidelines for the Protection of Integrated Data Centers

Fire Facility Installation and Management Act, Article 12 (Management of Fire Protection Facilities in Specific Fire Protection Objects), Article 16 (Management of Evacuation Facilities, Fire Zones, and Fire Protection Facilities)

Operation request forms, operation logs

Entry logs for controlled areas

Records of review of entry and operation logs for controlled areas

When operations within secure zones, such as the introduction and maintenance of information systems, are required, are formal procedures for application and execution of such operations established and implemented?

Are the records of operations within secure zones periodically reviewed to confirm that the operations were carried out in accordance with the control procedures?

Case 1: The entry log of the data center shows the presence of external maintenance personnel, but there is no record of an operation request or approval for work within the secure zone (i.e., entry and work in the secure zone were carried out without an operation request as required by internal regulations).

Case 2: Although internal regulations state that the records of operations within secure zones must be reviewed at least once per quarter, the review of such records has not been conducted for a long period without a valid reason.

Inbound and outbound application forms for secure zones

Inbound and outbound management logs

Results of the review of inbound and outbound records

Are control procedures established and implemented to prevent security incidents such as information leakage and malware infection when information systems, mobile devices, storage media, etc., are brought into or taken out of secure zones?

Are records maintained and managed in accordance with the inbound and outbound control procedures, and is the compliance with the procedures periodically checked by reviewing the history of inbound and outbound activities?

Case 1: Although control procedures for the inbound and outbound of mobile computing devices are established, there is no control over the movement of such devices within the controlled area, allowing both internal and external personnel with access to the controlled area to use mobile computing devices without restriction.

Case 2: Although internal guidelines state that inbound and outbound details of IT equipment must be recorded in the operation plan and signed by the person responsible for management, many signatures of responsible managers are missing from the records.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)

Security inspection reports for offices and shared spaces

Security inspection checklists for offices and shared spaces

Actions taken for non-compliance (e.g., training, rewards and penalties)

Current status of protection measures for printed and copied materials

Are protection measures established and implemented for shared facilities and office equipment such as document storage, shared PCs, multifunction printers, file servers, etc.?

Are protection measures established and implemented to prevent the exposure or leakage of personal and sensitive information through individual work environments such as work PCs, desks, drawers, etc.?

Are appropriate protection measures in place to ensure the safe handling of printed or copied materials containing personal information, such as paper documents?

Is compliance with information protection requirements in both individual and shared work environments periodically reviewed?

Case 1: Although the internal management plan for personal information specifies that regular security inspections (e.g., clean desk policies) must be conducted, no such inspections have been carried out.

Case 2: Documents containing personal information, such as membership application forms, are stored in an office cabinet without a lock.

Case 3: Employee computers do not have screen savers or passwords set, and important documents have been left on vacationing employees' desks for an extended period.

Case 4: No protection measures are in place for shared PCs installed in shared office spaces such as meeting rooms, resulting in personal information files being stored unencrypted, or security updates not applied, or antivirus software not installed, leaving the systems vulnerable.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures), Article 12 (Safety Measures for Printing and Copying)

User account and access request forms

User account and access management log or screen

Access classification table for information systems and personal information processing systems

Lists of users, administrators, and personal information handlers for each information system and personal information processing system

Has the organization established and implemented formal procedures for registering, changing, and deleting user accounts and access rights to information systems, personal information, and critical information?

When creating and registering user accounts and access rights to information systems, personal information, and critical information, is access limited to the minimum necessary for each job based on the job-specific access classification system?

When granting users accounts and access rights, are they made fully aware that they are responsible for the security of those accounts?

Case 1: User registration, termination, and approval procedures for accounts and permissions for users and personal information handlers were processed through verbal requests, email, etc., without proper approval and handling records.

Case 2: A personal information handler shared their account with an unauthorized individual for backup purposes during vacations, business trips, or other absences without going through official procedures.

Case 3: Users of information systems or personal information processing systems were granted excessive permissions, allowing access to unnecessary information or personal data.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)

Login screen for information systems and personal information processing systems

Lists of administrators, users, and personal information handlers for information systems and personal information processing systems

Records of approvals for exceptions

Are unique identifiers assigned to users and personal information handlers in information systems and personal information processing systems, and is the use of easily guessable identifiers restricted?

If the same identifier is shared by multiple users for unavoidable reasons, has the justification been reviewed and have supplementary measures such as approval from the responsible party been established?

Case 1: The account status of information systems (servers, networks, firewalls, DBMS, etc.) shows that default administrator accounts provided by the manufacturer are still in use, despite being technically modifiable.

Case 2: Developers are sharing personal information processing system accounts for common use without any justification or approval from responsible parties.

Case 3: External personnel maintaining information systems are using operational accounts like personal accounts without going through the required approval procedures.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)

Login screen for information systems and personal information processing systems

Login attempt limitation setting screen

Login failure message screen

Procedures for external access (e.g., external access request forms, list of external accessors)

Is access to information systems and personal information processing systems controlled through secure user authentication procedures, login attempt limitations, and warnings for illegal login attempts?

When accessing personal information processing systems from outside via a communication network, are secure authentication methods or secure access measures applied in accordance with legal requirements?

Case 1: When a personal information handler accesses a personal information processing system through the public external internet, secure authentication methods are not applied, and authentication is done only through ID and password.

Case 2: In the login process for information systems and personal information processing systems, detailed messages are displayed about whether the ID exists or the password is incorrect, and there is no limit on login failure attempts.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights), Article 6 (Access Control)

Password setting screens for web pages, information systems, and personal information processing systems

Password management policies and procedures

Are procedures for managing and creating secure user passwords for information systems established and implemented?

Are password creation rules established and enforced to ensure that users can use secure passwords?

Are authentication methods for personal information handlers and users securely applied and managed?

Case 1: Although password creation rules are set in policies and guidelines related to information protection and personal information protection, some information systems and personal information processing systems use passwords that differ from internal guidelines.

Case 2: Internal regulations state that when passwords are reset, temporary passwords must be assigned and forced to be changed, but in practice, temporary passwords are being used without change.

Case 3: Although internal regulations require users and personal information handlers to change their passwords periodically, passwords are being used without change.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)

Guidelines related to special privileges

Records of special privilege requests and approvals

List of special privilege holders

Records of special privilege reviews

Is there a formal privilege request and approval process established and implemented to ensure that special privileges, such as administrative privileges, are only granted to a minimal number of people?

Is there a control procedure established and implemented to identify and manage accounts and privileges granted for special purposes in a separate list?

Case 1: The approval history for granting administrator and special privileges in the information system and personal information processing system is not documented or does not match the special privileges list.

Case 2: Internal regulations require that personal information administrators and special privilege holders be documented and managed in a list, but the list is not maintained or some special privileges, such as security system administrators, are not identified or managed.

Case 3: A maintenance special account for visiting maintenance once a quarter remains active at all times without a time limit on usage.

Case 4: Regular reviews of administrator and special privilege usage are not conducted, and some individuals retain special privileges even after their roles have changed.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)

Access rights review standards and procedures

History of access rights reviews

Access rights review reports and follow-up action records

Are the histories of account and access right creation, registration, granting, use, modification, and deletion for information systems, personal information, and important information being recorded?

Are standards, review subjects, review methods, and periodic review schedules established to regularly review the appropriateness of user accounts and access rights to information systems, personal information, and important information?

When issues such as excessive access rights, failure to follow access right granting procedures, or misuse of access rights are identified in the review results, are appropriate response procedures established and implemented?

Case 1: The methods, review periods, reporting structure, and misuse criteria related to access rights reviews are not clearly defined in the relevant guidelines, leading to irregular performance of access rights reviews.

Case 2: Although internal policies and guidelines require locking (deactivating) or deleting long-unused accounts, some accounts that have not been accessed for more than six months remain active (indicating that the access rights review was not thoroughly conducted, failing to identify these accounts).

Case 3: During the access rights review, cases of excessive privileges or suspected misuse were identified, but no detailed investigation, internal reporting, or follow-up actions were taken.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)

Network diagram

Information asset list

Firewall rules

Has the organization identified all access paths to its network and ensured that internal networks are controlled so that only authorized users can access them according to the access control policy?

Has the organization physically or logically segmented the network based on services, user groups, information asset importance, and legal requirements, and applied access control between different network segments?

Has the organization established IP address allocation standards for each network segment, and applied measures such as assigning private IPs to systems like database servers that do not require external connections?

Has the organization implemented protective measures for communication paths when connecting networks between physically separated locations, such as IDCs, branches, and agents?

Case 1: The network configuration and interviews revealed that data transmission and reception between external sites and the servers located in the IDC are being processed through the general internet line, rather than using VPN or dedicated lines as specified in internal regulations.

Case 2: The IP addresses of some important servers, such as database servers located in the internal network, were set to public IPs instead of private IPs as per internal regulations, and network access blocking was not applied.

Case 3: Although a server farm was established, access from the internal network to the server farm was excessively allowed due to insufficient network access control settings.

Case 4: The network provided to external parties (e.g., external developers, visitors) was not separated from the internal business network without appropriate controls.

Case 5: Contrary to internal regulations, the organization's network could be accessed and used simply by connecting a network cable without applying protective measures such as MAC address authentication and mandatory security software installation.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)

List of operating system accounts of information systems

Server security settings

Server access control policy (e.g., SecureOS management screen)

Server and network configuration diagram

Information asset list

Have users, access locations, and access means allowed to access operating systems (OS) of information systems such as servers, network systems, and security systems been defined and controlled?

Is the system automatically disconnected when there is no work processed after accessing the information system for a certain period?

Are services unrelated to the purpose of using the information system removed?

Are information systems that provide key services operated on independent servers?

Case 1: When a server administrator accesses a Windows server located in the IDC from the office using terminal services, session timeout settings are not configured, allowing the session to remain open for a long period without any activity.

Case 2: Due to improper restrictions on server-to-server access, a user authorized to access a particular server can access other unauthorized servers via that server.

Case 3: Unsafe access protocols (e.g., telnet, ftp) are being used without valid reasons or compensatory measures, and unnecessary services and ports are open.

Case 4: Although the access control policy requires all access to servers to go through a server access control system, bypass routes exist that allow access to servers without going through the system.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)

Application access rights classification system

Application account and rights management screen

Application user and administrator screens (e.g., personal information viewing, etc.)

Application session time and concurrent session restriction settings

Application administrator access log monitoring details

Information asset list

Personal information processing system's personal information viewing and search screens

Are access rights to applications granted differentially based on the user's tasks to control access to sensitive information?

Are sessions automatically disconnected after a certain period of inactivity, and is the number of simultaneous sessions per user restricted?

Is access to administrator-exclusive applications (e.g., admin web pages, admin consoles) restricted to unauthorized users?

Are criteria established and applied to ensure consistency in protection measures for limiting the display of personal and sensitive information?

Are applications implemented and operated to minimize unnecessary exposure (e.g., viewing, screen display, printing, downloading) of personal and sensitive information?

Case 1: There is a flaw in the authorization control function of certain personal information processing screens in the application, allowing users without permission to view personal information.

Case 2: The administrator page of the application is open to the public internet without secure authentication methods applied.

Case 3: Session timeouts or concurrent logins for the same user account are not restricted without valid reasons.

Case 4: When personal information is downloaded through the application, the file contains excessive unnecessary information such as resident registration numbers.

Case 5: The application excessively allows 'like' searches, allowing all users to retrieve all customer information by searching only for a surname, even beyond their work scope.

Case 6: Due to the lack of criteria for limiting the display of personal information or failure to adhere to them, different masking standards are applied to the same personal information items on different screens of the personal information processing system.

Case 7: Although personal information is masked on the screen of the personal information processing system, unmasked personal information is exposed by viewing the web browser source.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights), Article 6 (Access Control), Article 12 (Safety Measures for Printing and Copying)

Database status (e.g., tables, columns)

List of database user accounts and permissions

Database access control policy (e.g., database access control system management screen)

Network diagram (e.g., database zone)

Information asset list

Are you identifying the information stored and managed in the database, such as the table list?

Are you clearly identifying the applications, information systems (servers), and users that need access to information in the database and controlling access according to the access control policy?

Case 1: A database that stores and processes a large amount of personal information is operated on the same physical server as a web application accessible via the Internet, without separating them.

Case 2: Developers and operators share accounts used by the application to access the production database.

Case 3: Although internal regulations require database access rights to be restricted by object, access rights to the database are granted uniformly to administrators, even those who do not need access to personal information tables.

Case 4: A database access control solution has been implemented, but access to the database is not properly restricted by IP address, allowing users to bypass the access control solution.

Case 5: The table status of a database storing personal information has not been identified, resulting in the unnecessary retention of personal information in temporary tables that have not been deleted.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights), Article 6 (Access Control)

Network diagram

AP security settings history

Inspection records of unauthorized wireless networks

Wireless network usage application and approval records

When using a wireless network for business purposes, are you establishing and implementing protection measures such as authentication and encryption of transmitted and received data to ensure the security of the wireless AP and network segment?

Have you established and implemented procedures for applying for and terminating access to ensure that only authorized employees can use the wireless network?

Have you established and implemented protection measures against unauthorized wireless networks, such as detecting and blocking AD Hoc connections and unauthorized wireless APs within the organization?

Case 1: The wireless network segments for external users and internal users are the same, allowing external users to access the internal network without separate control via the wireless network.

Case 2: Although the encryption function for information transmission and reception was enabled when configuring the wireless AP, it was set in an insecure manner.

Case 3: A wireless AP connected to the internal network for business purposes has security settings that are insufficient, such as exposure of the administrator password (using the default password) and lack of access control.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)

Remote access application form (e.g., VPN)

VPN account list

VPN access control policy settings

IP management log

Remote access control settings (server settings, security system settings, etc.)

Designation and management of management terminals

Network diagram

Is remote operation of information systems through external networks such as the internet prohibited in principle, and are compensatory measures in place if allowed for unavoidable reasons such as incident response?

Is access through remote operation of information systems allowed only for specific devices when done through internal networks?

Are protective measures established and implemented to prevent security incidents such as data breaches and hacking during remote work, such as telecommuting, remote collaboration, and smart work?

Are the devices used for remote access to personal information processing systems for management, operation, development, and security purposes designated as management terminals, and are safety measures such as prohibiting unauthorized operations and use for purposes other than those intended being applied?

Case 1: Although internal regulations state that remote access to the system is prohibited in principle and, when allowed, access is restricted through IP-based access control, remote desktop connections and SSH access to the system are not limited by IP addresses, allowing access from any PC.

Case 2: A VPN has been established for remote management, but it is always available without usage approval or access period restrictions.

Case 3: Work-related mobile apps have been installed on personal smart devices for external workers, but appropriate protective measures (e.g., antivirus, encryption, wiping in case of loss or theft) to prevent personal information leaks are not being applied.

Case 4: VPN access for external users is not limited by network segments and information systems, allowing excessive access to the entire internal network and information systems for authenticated remote users.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)

Policy for blocking non-work-related sites (e.g., P2P) (management screen of non-work-related site blocking system)

Internet access monitoring history

List of individuals subject to internet access restriction measures

Procedures and records for data transfer between networks (e.g., application and approval records)

Network diagram

Is there an established and implemented policy to control internet access for work PCs used for key duties and personal information handling terminals?

Is unnecessary external internet access from key information systems (e.g., database servers) being controlled?

Are internet access restrictions being applied in a secure manner for individuals who are required by law to have their internet access restricted?

Case 1: Internet access restriction measures were applied according to the Personal Information Protection Act, but the restriction was not applied to some individuals with the authority to set access rights for personal information processing systems.

Case 2: Although internet access restriction measures were applied as required under the Personal Information Protection Act, it was possible to bypass the restriction by accessing the system through another server, allowing the download and deletion of personal information.

Case 3: Some servers located in the DMZ and internal network were unnecessarily able to access the internet directly.

Case 4: Although a physical network separation system was applied between internet PCs and internal work PCs, and a data transfer system was established, there was no approval process for data transfers, and there was no periodic review of the data transfer records.

Case 5: Internal regulations require that individuals handling personal information obtain approval from a responsible person before accessing P2P or web hard drive sites, and access is only permitted for a specific period, but there are numerous cases of exceptions being made without going through the approval process.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)

Encryption control policy (targets, methods, algorithms, etc.)

Encryption application status (during storage and transmission)

Risk analysis results (if encryption is not applied to unique identifiers other than resident registration numbers in the internal network)

Encryption solution management screen

Has an encryption policy been established that includes encryption targets, encryption strength, and encryption usage in consideration of legal requirements for the protection of personal and important information?

Is encryption applied to personal and important information during storage, transmission, and transfer according to the encryption policy?

Case 1: Internal policies and guidelines do not properly specify encryption targets, encryption strength, encryption methods during storage and transmission, or the roles and responsibilities of those responsible for encryption, considering legal requirements.

Case 2: The company applied incorrect regulations during the creation of its encryption policy, leading to non-compliance with legal encryption requirements (e.g., storing user account numbers without encryption).

Case 3: Although one-way encryption was applied to the passwords of both personal information handlers and data subjects, an insecure MD5 algorithm was used.

Case 4: Although a security server was applied to an internet shopping mall in accordance with relevant laws and internal regulations, encryption was missing in some sections where users' personal information is transmitted (e.g., viewing or modifying member information, password retrieval, password changes).

Case 5: Passwords for accessing information systems, authentication keys, and other values were stored in plaintext in system configuration files and source code.

Personal Information Protection Act, Article 24-2 (Restrictions on Processing of Resident Registration Numbers), Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 7 (Encryption of Personal Information)

Cryptographic Key Management Policy

Cryptographic Key Management Log and System Screens

Are procedures for the generation, use, storage, distribution, modification, recovery, and destruction of cryptographic keys established and implemented?

Are cryptographic keys securely stored in a separate location to ensure they can be recovered if necessary, and is access to the use of cryptographic keys minimized?

Case 1: If encryption policies do not specify procedures and methods for managing cryptographic keys, leading to varying levels and methods of cryptographic key management among personnel, resulting in vulnerabilities.

Case 2: Internal regulations require the generation of encryption keys under the approval of a responsible person when encrypting important information, and to maintain a key management log, but some keys are either missing or outdated in the log.

Case 3: The encryption key applied in the development system is the same as the one applied in the production system, making it easy to decrypt actual data through the development system.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 7 (Encryption of Personal Information)

Information System Acquisition Standards and Procedures

RFP (Request for Proposal) and Purchase Contracts for Information System Introduction

Development Outputs (Project Execution Plans, Requirements Definition, Screen Design, Security Architecture Design, Test Plans, etc.)

Secure Coding Standards

When introducing, developing, or modifying an information system, are procedures for reviewing the validity of information protection and personal information protection aspects and for acquisition established and implemented?

When introducing, developing, or modifying an information system, are security requirements, including legal requirements and the latest vulnerabilities, clearly defined and reflected from the design stage?

Are coding standards for secure implementation of the information system established and applied?

Case 1: Lack of established security verification standards and procedures prior to acquiring an information system.

Case 2: Internal regulations require the review of the security impact and the operating environment when introducing a new system, but recent acquisitions of some information systems lacked detailed standards and plans, and therefore, no security review was conducted during the acquisition.

Case 3: Internal development guidelines do not define key security requirements related to development (authentication and encryption, security logging, etc.).

Case 4: In the 'Development Standards Definition Document', user passwords are to be encrypted using insecure algorithms (MD5, SHA1), resulting in failure to comply with relevant legal requirements.

Information System Acceptance Test Results

Requirements Traceability Matrix

Test Plans, Test Results

Vulnerability Assessment Results

Personal Information Impact Assessment Report

Confirmation of Implementation of Corrective Actions for Personal Information Impact Assessment

When introducing, developing, or modifying an information system, are tests conducted to verify whether the security requirements defined during the analysis and design stages have been effectively applied?

Are vulnerability assessments conducted to confirm that the information system has been securely developed according to secure coding standards?

Are procedures established and implemented to ensure that issues identified during testing and vulnerability assessments are promptly addressed through corrective action plans and follow-up checks?

For public institutions, are impact assessments conducted during the analysis and design stages when developing or modifying personal information processing systems, as required by relevant laws, and are the results reflected during development and modification?

Case 1: Failure to test security requirements defined in internal guidelines and documents after implementing an information system.

Case 2: In the application program test scenario and technical vulnerability checklist, important validation items such as input validation checks were omitted.

Case 3: Failure to assess whether known technical vulnerabilities exist during implementation or testing, or failure to address identified vulnerabilities without valid reasons or approval.

Case 4: A public institution failed to conduct an impact assessment when developing a personal information file or personal information processing system subject to an impact assessment requirement, such as processing unique identifiers of more than 50,000 data subjects.

Case 5: A public institution failed to submit the impact assessment report to the Personal Information Protection Commission within two months after receiving the report from the impact assessment agency.

Case 6: Internal guidelines require reviewing the security and impact on the operating environment when introducing a new system (e.g., vulnerability assessments), but recent acquisitions of some information systems lacked security reviews during the acceptance process.

Personal Information Protection Act, Article 33 (Personal Information Impact Assessment)

Notification on Personal Information Impact Assessment

Network diagrams (including test environment configuration)

Current application of access control between the production environment and the development/test environment

Are development and test systems separated from the production system?

If separation of development and production environments is difficult due to unavoidable reasons, have security measures such as mutual review, monitoring by supervisors, approval for changes, and ensuring accountability been implemented?

Case 1: Source code changes are being made directly in the production environment without a separate development environment or proper approval.

Case 2: Although it is unavoidable to operate the development and production systems without separation, records of mutual review or monitoring are missing.

Case 3: Although a separate development system is in place, access from the development environment to the production environment is not controlled, allowing developers unnecessary access to the production system through the development system.

Test data status

Test data generation rules

If operational data was used in a test environment, the approval history

Is the use of actual operational data restricted during the development and testing of information systems?

If it is inevitable to use operational data in a test environment, are control procedures such as approval by the responsible person, monitoring of access and leakage, and deletion of data after testing established and implemented?

Case 1: There are no specific standards and procedures established for generating test data for use on the development server.

Case 2: Operational data is being used as test data without proper processing and without approval from the responsible person for a valid reason.

Case 3: Although operational data was approved in advance for use as test data for unavoidable reasons, the same level of access control as the operational database is not applied to the test database.

Case 4: After using operational data for testing purposes, the data was not deleted from the test database even though the testing was completed.

Status of configuration management systems such as SVN (e.g., list of authorized personnel)

History of changes to the source program

Have procedures been established and implemented to control access to source programs by unauthorized persons?

Is the source program stored safely in a non-operational environment for emergencies such as system failures?

Is the history of changes to the source program being managed?

Case 1: There is no separate backup or configuration management system for source programs, and previous versions of the source code are stored on the operational server or developer's PC without approval or history management.

Case 2: A configuration management system has been established, but access control, access and change history for the system or the source code stored in the system are not properly managed.

Case 3: The internal regulations require version control of source programs through a configuration management system, but the latest version of the source program is only stored on the developer's PC, and no separate backup is performed.

Transition procedures

Transition records (requests, approvals, tests, transitions, etc.)

Have control procedures been established and implemented to safely transition newly introduced, developed, or modified systems to the operational environment?

Are contingency plans in place to address issues that may arise during the transition to the operational environment?

Are only the files necessary for service execution installed in the operational environment?

Case 1: There are no procedures in place to review and approve the transition of developed or modified source programs to the operational environment.

Case 2: Unnecessary files (source code, distribution modules, backups, development-related documents, manuals, etc.) exist in the operational server.

Case 3: The internal guidelines require the preparation of change request and result documents for safe transition and recovery during transitions to the operational environment, but such documents are not available.

Case 4: The internal guidelines require internal review and approval before distributing mobile apps to the app market, but developers are bypassing these procedures and distributing the apps directly.

Change management procedures

Change management records (requests, approvals, change details, etc.)

Impact analysis results of changes

Have procedures been established and implemented for changes to assets related to information systems (hardware, operating systems, commercial software packages, etc.)?

Are the performance and security impacts analyzed before making changes to information system-related assets?

Case 1: A recent change to the DMZ section for redundancy was made, but there is no evidence of performing and approving the security risk and performance evaluation that may occur after the change.

Case 2: A recent network change was made, but the review and notification were not sufficiently carried out, so the changes were not properly reflected in the network diagram or some access control systems (e.g., firewalls, database access control systems) ACLs.

Case 3: Although a change management system was established to analyze and discuss the impact on performance and security when information systems are introduced or changed, changes can still be made outside the system, and related changes are not properly reviewed.

Procedures for performance and capacity monitoring

Evidence of performance and capacity monitoring (e.g., internal reporting results)

Fault response procedures

Fault response report

Have procedures been established and implemented to continuously monitor performance and capacity to ensure the availability of information systems?

Are response procedures in place and implemented to address cases where the performance and capacity requirements (thresholds) of the information system are exceeded?

Have procedures been established and implemented to immediately recognize and respond to information system faults?

Are procedures in place to record and manage actions taken in response to faults through fault response reports?

For serious faults, are measures being taken to prevent recurrence through cause analysis?

Case 1: Failure to define requirements (e.g., thresholds) for managing performance and capacity for each target, or the absence of records in regular inspection reports, making it difficult to assess the current status.

Case 2: Performance or capacity standards were exceeded, but no related reviews or follow-up measures were taken or implemented.

Case 3: Fault response procedures for IT equipment have been established, but internal and external environmental changes such as network configuration or vendor changes are not adequately reflected.

Case 4: Inconsistencies exist between fault handling procedures and fault type-specific response methods, or there is a lack of rationale for estimating response times, making swift, accurate, and systematic responses difficult.

Backup and recovery procedures

Recovery test results

Disaster recovery backup status

Have backup and recovery procedures been established and implemented, including targets, frequency, methods, and procedures?

Is regular recovery testing conducted to verify the completeness and accuracy of the backed-up information and the adequacy of the recovery procedures?

For backup media containing critical information, is the media stored in physically separate locations to address disaster recovery?

Case 1: Backup and recovery procedures, including targets, frequency, methods, and procedures, have not been established.

Case 2: Although a backup policy is in place, information required to be stored for a long period (6 months, 3 years, 5 years, etc.) according to legal requirements is not being stored according to the backup policy.

Case 3: Some systems (e.g., security system policies and logs) that are required to be separately backed up according to higher-level or internal guidelines are not being backed up.

Case 4: Although higher-level or internal guidelines stipulate that recovery tests for backup media should be conducted periodically, recovery tests have not been performed for an extended period.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 11 (Safety Measures for Disaster Recovery)

Log management procedures

Log record details

Access control records for log storage devices

Access records of personal information

Has the organization established log management procedures for information systems such as servers, applications, security systems, and network systems, and is it generating and storing the necessary logs accordingly?

Are log records of information systems securely stored to prevent tampering, theft, or loss, and is access to the log records minimized?

Are access records for personal information processing systems securely stored for a specified period in accordance with legal requirements, including all necessary items?

Case 1: The detailed criteria and procedures for log recording, retention periods, review frequency, and responsible personnel have not been established.

Case 2: The maximum size for critical logs such as security event logs, application, and service logs (for Windows Server 2008 or later) is not sufficiently configured, resulting in logs not being recorded and retained for the period specified by internal standards.

Case 3: The log records of important Linux/UNIX servers are not separately backed up or adequately protected, allowing users to arbitrarily delete command execution histories and access logs.

Case 4: Upon reviewing access records for the personal information processing system, while the account, access time, and IP address of the user were logged, details about the data subject information handled and the tasks performed (e.g., view, modify, delete, download) were not recorded.

Case 5: The capacity of the log server is insufficient, leaving only two months of access records for the personal information processing system.

Case 6: A personal information processing system handling personal information of 100,000 data subjects is only retaining access logs for one year.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 8 (Retention and Inspection of Access Records)

Log review and monitoring procedures

Log review and monitoring results (review details, reports, etc.)

Access record inspection details for personal information

Criteria and results for verifying reasons for personal information downloads

Evidence of responses to detected anomalies

Are there established log review and monitoring procedures, including the frequency, targets, and methods for detecting errors, misuse (unauthorized access, excessive queries, etc.), fraud, and other anomalies in the information system?

Are the results of log reviews and monitoring reported to the responsible person, and are responses taken following procedures when anomalies are detected?

Are access records of the personal information processing system regularly inspected according to the periods specified in relevant laws?

Case 1: Monitoring and alert policies (criteria) for abnormal access (e.g., early morning access on holidays, access via bypass routes) or abnormal behaviors (e.g., large-scale data queries or continuous small data queries) on information systems processing important information have not been established.

Case 2: Although periodic inspection/monitoring criteria for access and usage are established in internal guidelines or systems, there is no record of actual review of abnormal access or behavior.

Case 3: The personal information processor sets the inspection frequency of access records for personal information processing systems to once per quarter.

Case 4: The internal management plan for the personal information processor sets criteria for verifying reasons when more than 1,000 items of personal information are downloaded, but the reasons are not verified when such downloads occur.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 8 (Retention and Inspection of Access Records)

Time synchronization settings

Evidence of time synchronization for key systems

Is the system time synchronized with the standard time?

Is regular inspection conducted to ensure that time synchronization is functioning properly?

Case 1: The time of some critical systems (e.g., security systems, CCTV, etc.) is not synchronized with the standard time, and regular inspections for synchronization are not being conducted.

Case 2: Although internal NTP servers are configured for time synchronization, some systems are not synchronized, and there has been no cause analysis or response.

Procedures for the disposal and reuse of information assets

Storage media management ledger

Evidence of the disposal of information assets and storage media

Disposal-related outsourcing contracts for information assets and storage media

Are secure reuse and disposal procedures for information assets established and implemented?

When reusing or disposing of information assets and storage media, are personal and critical information processed to be irrecoverable?

If information assets and storage media are disposed of internally, are the disposal records maintained in a management ledger along with evidence of disposal?

If disposal is outsourced to an external company, are disposal procedures specified in the contract and is the complete disposal confirmed?

Are measures in place to protect data on storage media during maintenance, repairs, or replacements of systems and PCs?

Case 1: Although the policy and procedure require the complete deletion of data using a data deletion program when reusing PCs used by personal information handlers, in practice, PCs are reused without complete deletion or are only formatted before reuse, indicating that procedures are not being followed.

Case 2: Although storage media are disposed of through an external company, the contract lacks details on secure disposal procedures and protective measures, and there is no verification or supervision of the disposal process or evidence of compliance.

Case 3: Instead of recording the serial numbers of disposed HDDs, the system names are recorded, or the disposal ledger is not maintained, making it impossible to verify the disposal history and traceability.

Case 4: Discarded hard disks are left unsecured in an area without locks, and the data has not been fully deleted.

Personal Information Protection Act, Article 21 (Destruction of Personal Information)

Standards for Ensuring the Safety of Personal Information, Article 13 (Destruction of Personal Information)

Security system configuration

Network configuration

Security system operational procedures

Firewall policies

Firewall policy setup/modification request forms

Exception list for the security system

Management screens for each security system (firewall, IPS, server access control, DLP, DRM, etc.)

Security system policy review history

Has the organization established and implemented operational procedures for the security systems in use?

Is access to the security system administrators limited to a minimum, and is unauthorized access strictly controlled?

Has the organization established and implemented formal procedures for registering, modifying, and deleting policies for each security system?

Are exception policies for the security system managed according to procedures, and are users of exception policies managed with the minimum privileges?

Is the validity of the policies set on the security system periodically reviewed?

Has the organization installed and operated security systems that perform functions specified by law to prevent illegal access and data leakage in personal information processing systems?

Case 1: Regular reviews of the security policies for the intrusion prevention system were not conducted, resulting in unnecessary or excessively permissive policies.

Case 2: There are no procedures or criteria for applying, modifying, or deleting security policies, or such procedures exist but are not followed.

Case 3: The assignment and supervision of administrators for the security system were not properly implemented.

Case 4: Although internal guidelines stipulate that the information security officer must record and maintain the history of security policy changes for the security system, the policy management ledger was not periodically maintained, or the policies recorded in the ledger did not match those actually applied in the operating system.

Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)

Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)

Cloud service-related contracts and SLA

Cloud service risk analysis results

Cloud service security control policies

Cloud service administrator privilege assignment status

Cloud service architecture diagram

Cloud service security setting status

Cloud service security setting appropriateness review history

Is the responsibility and role for information protection and personal information protection clearly defined with the cloud service provider, and is it reflected in contracts (such as SLA)?

Are security risks based on the service type evaluated when using cloud services, and are security control policies established and implemented, including security configurations and setting standards, security setting changes and approval procedures, secure connection methods, and authority systems to prevent unauthorized access and configuration errors?

Are administrator privileges for cloud services granted minimally according to roles, and are enhanced protection measures such as strengthened authentication, encryption, access control, and audit logs applied to prevent unauthorized access and abuse of privileges?

Is the monitoring of cloud service security setting changes and operation status conducted, and is the appropriateness of these settings reviewed regularly?

Case 1: The cloud service contract does not include responsibilities and roles related to security.

Case 2: Employees without a business need have been excessively granted permissions to change the security settings of the cloud service.

Case 3: Internal guidelines require security officer approval when changing access control rules in the private network of the cloud, but many access control rules were registered or changed without following the approval procedure.

Case 4: Due to security setting errors in the cloud service, internal log files were exposed to the internet.

Network diagram

Website information disclosure procedures and history (e.g., requests, approvals, posting history)

Inspection history of personal and sensitive information exposure

Are protective measures established and implemented for the operation of public servers?

Are public servers installed in a DMZ separated from internal networks and protected by security systems such as firewalls?

When posting or storing personal or sensitive information on public servers, are approval and posting procedures, including obtaining approval from the responsible person, established and followed?

Does the organization regularly check whether sensitive information is being exposed through websites and web servers, and if exposure is detected, are measures taken immediately to block it?

Case 1: Due to vulnerabilities in publicly exposed websites, unauthorized individuals were able to access others' personal information through Google search.

Case 2: Although internal regulations require approval procedures before posting personal information on websites, there were multiple cases where personal information was posted without following these procedures.

Case 3: In web applications such as bulletin boards, it was possible to arbitrarily modify or delete posts made by others, or view password-protected posts.

Protection measures for electronic transaction and FinTech services

Security review results for payment system integration

Are protection measures established and implemented to ensure the safety and reliability of transactions when providing electronic transaction and FinTech services?

Are protection measures established and implemented to protect transmitted information when integrating with external systems, such as payment systems, and is the security of the integration checked?

Case 1: While a contract was made with a payment service provider and integration was established, all payment-related information was transmitted in plain text through a specific URL without appropriate authentication or access restrictions.

Case 2: Although the external payment system was connected via a dedicated network, internal business systems were not properly controlled by firewalls or other security measures.

Case 3: Although internal guidelines required a security review by the information protection team before integrating external FinTech services, the review was skipped due to scheduling reasons when integrating a new FinTech service.