Skip to menu Skip to content

Korean e-government homepage mark This site is the official e-Government website of the Republic of Korea.

zoom
100%

Personal Information Protection Commission

URL LINK

COPY

ISMS-P

ISMS*P logo

The 'Personal information & Information Security Management System (ISMS-P)’ is an 'integrated certification system' that consolidated 'Personal Information Management System (PIMS) certification' and 'Information Security Management System (ISMS) certification' into one certification system, both of which were operated separately. ISMS-P has been enforced since November 7, 2018. Enterprises and institutions can expect to improve the external reliability of their personal information protection and security and reduce the risk of external and internal personal information infringements through the 'Personal information & Information Security Management System.'

Legal Ground

Article 32-2 of the Personal Information Protection Act (Certification of Personal Information Protection)

Procedure, certification system and criteria

Procedure

  1. Application for certification examination
  2. Certification examination
  3. Complementary measures
  4. Holding Certification Committee Meeting
  5. Issuance of certificate
  6. Follow-up management

Basic flow of the certification procedure

See below Enlarge image
  1. Certification Committee
  2. Certification institution
  3. Requesting organization
  4. Application
  5. Preliminary exam and contract
  6. Organizing an examination team
  7. Certification examination
  8. Submitting the results of supplementary measure
  9. Submitting the report on the examination result
  10. Deliberation on the result & Request for resolution (new/renew)
  11. Notification of the resolution result
  12. Issuance of certificate

Certification system

See below Enlarge image
  1. Policy-making institution
  2. Ministry of Science and ICT & PIPC
  3. Improving law and policy, and policy making
  4. Designating certification and examination institutions
  5. Certification institution
  6. Certification Committee
  7. Korea Internet Security Agency (KISA)
  8. Operating the system and certification quality control
  9. Certification examination on new and special areas
  10. Issuing certificate
  11. Training the certification examiners and qualification control
  12. Financial Security Institute (FSI)
  13. Certification examination on financial area
  14. Issuing financial certificate
  15. Examination institution
  16. Korea Association for ICT Promotion (KAIT)
  17. Telecommunications Technology Association (TTA)
  18. Online Privacy Association (OPA)
  19. Certification examination

Criteria for Certification Examination

See below Enlarge image
  1. Set-up and Operation of the Control System (16 items)
  2. Setting up of the basis of control system
  3. Risk control
  4. Operation of the control system
  5. Check-up and improvement of the control system
  6. Demands for Protection Measures (64 items)
    1. Policy, organization, asset management
    2. Personal security
    3. Outsider security
    4. Physical security
    5. Certification and authorization management
    6. Access control
    7. Application of encryption
    8. Data system introduction and development security
    9. System and service operation management
    10. System and service security management
    11. Accident prevention and response
    12. Disaster restoration
  7. Demands in Each Step of Personal Data Processing (22 items)
    1. Protection at the time of collecting personal data
    2. Protection when holding and using personal data
    3. Protection at the time of providing personal data
    4. Protection at the time of discarding personal data
    5. Protection of the rights of a data subject
Unified Certification
Classification Integrated certification Area (number of certification standards)
ISMS-P ISMS 1. Establishing and operating management system (16)
  • 1.1 Setting up foundation for management system (6)
  • 1.2 Risk management (4)
  • 1.3 Operation of management system (3)
  • 1.4 Inspection and improvement of management system (3)
2. Requirements for protection measures (64)
  • 2.1 Policy, organization, and asset management (3)
  • 2.2 Personal security (6)
  • 2.3 Outsider security (4)
  • 2.4 Physical security (7)
  • 2.5 Certification and authorization management (6)
  • 2.6 Access control (7)
  • 2.7 Application of encryption (2)
  • 2.8 Introduction of data system and development security(6)
  • 2.9 System and service operation management (7)
  • 2.10 System and service security management (9)
  • 2.11 Incident prevention and response (5)
  • 2.12 Disaster recovery (2)
- 3. Requirements in each step of personal information processing (22)
  • 3.1 Protection measures when collecting personal information (7)
  • 3.2 Protection measures when retaining and using personal information (5)
  • 3.3 Protection measures when providing personal information (3)
  • 3.4 Protection measures when destroying personal information (4)
  • 3.5 Protection of the rights of data subjects (3)

209 Sejong-daero, Jongno-gu, Seoul 03171, Korea

Copyright ⓒ Personal Information Protection Commission. All right reserved.

go to top