urn: urn:intuitem:risk:library:k_isms_p
locale: en
ref_id: K ISMS-P
name: 'K ISMS-P Certification Standard Guide '
description: "Certification Standard Guide Information Security and Personal Information\
  \ Protection Management System (ISMS-P) \nThe 'Personal information & Information\
  \ Security Management System (ISMS-P)\u2019 is an 'integrated certification system'\
  \ that consolidated 'Personal Information Management System (PIMS) certification'\
  \ and 'Information Security Management System (ISMS) certification'.\n\nHere is\
  \ the link of the document :\nhttps://isms-p.kisa.or.kr"
copyright: KISA
version: 1
publication_date: 2024-08-29
provider: KISA
packager: intuitem
objects:
  framework:
    urn: urn:intuitem:risk:framework:k_isms_p
    ref_id: K ISMS-P
    name: 'K ISMS-P Certification Standard Guide '
    description: "Certification Standard Guide Information Security and Personal Information\
      \ Protection Management System (ISMS-P) \nThe 'Personal information & Information\
      \ Security Management System (ISMS-P)\u2019 is an 'integrated certification\
      \ system' that consolidated 'Personal Information Management System (PIMS) certification'\
      \ and 'Information Security Management System (ISMS) certification'.\n\nHere\
      \ is the link of the document :\nhttps://isms-p.kisa.or.kr"
    requirement_nodes:
    - urn: urn:intuitem:risk:req_node:k_isms_p:1
      assessable: false
      depth: 1
      ref_id: '1'
      name: 'Establishment and Operation of Management System '
      description: (16 Items)
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1
      ref_id: '1.1'
      name: Establishing the Foundation of the Management System
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      ref_id: 1.1.1
      name: Participation of Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node5
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.1
      description: The responsibilities and roles related to reporting, decision-making,
        etc., must be documented to ensure the participation of management, who have
        decision-making authority over the overall establishment and operation activities
        of the Information Security and Personal Information Protection Management
        System.
      annotation: 'Key Points for Verification:

        - Is the responsibility and role of reporting and decision-making documented
        to ensure the participation of management in the overall establishment and
        operation activities of the Information Security and Personal Information
        Protection Management System?

        - Have reporting, review, and approval procedures been established and implemented
        to enable management to actively participate in decision-making concerning
        information security and personal information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node6
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node5
      description: The basis for activities, such as the establishment and revision
        of information security and personal information protection policies, risk
        management, internal audits, etc., must be specified in the information security
        and personal information protection policy or implementation documents to
        allow management to participate in important matters related to the operation
        of the management system.
      annotation: 'Key Points for Verification:

        - Is the responsibility and role of reporting and decision-making documented
        to ensure the participation of management in the overall establishment and
        operation activities of the Information Security and Personal Information
        Protection Management System?

        - Have reporting, review, and approval procedures been established and implemented
        to enable management to actively participate in decision-making concerning
        information security and personal information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node7
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.1
      description: Reporting, review, and approval procedures must be established
        and implemented to enable management to actively participate in decision-making
        concerning information security and personal information protection activities.
      annotation: 'Key Points for Verification:

        - Is the responsibility and role of reporting and decision-making documented
        to ensure the participation of management in the overall establishment and
        operation activities of the Information Security and Personal Information
        Protection Management System?

        - Have reporting, review, and approval procedures been established and implemented
        to enable management to actively participate in decision-making concerning
        information security and personal information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node8
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node7
      description: Important activities within the Information Security and Personal
        Information Protection Management System that involve management should be
        defined, and corresponding reporting systems (e.g., regular and irregular
        reports, committee participation) should be established.
      annotation: 'Key Points for Verification:

        - Is the responsibility and role of reporting and decision-making documented
        to ensure the participation of management in the overall establishment and
        operation activities of the Information Security and Personal Information
        Protection Management System?

        - Have reporting, review, and approval procedures been established and implemented
        to enable management to actively participate in decision-making concerning
        information security and personal information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node9
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node7
      description: Reporting and decision-making procedures, targets, and frequencies
        should be determined in accordance with the organization's size and characteristics,
        ensuring that management can effectively participate in the establishment
        and operation of the management system.
      annotation: 'Key Points for Verification:

        - Is the responsibility and role of reporting and decision-making documented
        to ensure the participation of management in the overall establishment and
        operation activities of the Information Security and Personal Information
        Protection Management System?

        - Have reporting, review, and approval procedures been established and implemented
        to enable management to actively participate in decision-making concerning
        information security and personal information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node10
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node7
      description: In line with the established internal procedures, management should
        be informed about major matters within the Information Security and Personal
        Information Protection Management System and participate in decision-making.
      annotation: 'Key Points for Verification:

        - Is the responsibility and role of reporting and decision-making documented
        to ensure the participation of management in the overall establishment and
        operation activities of the Information Security and Personal Information
        Protection Management System?

        - Have reporting, review, and approval procedures been established and implemented
        to enable management to actively participate in decision-making concerning
        information security and personal information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      ref_id: 1.1.2
      name: Designation of the Chief Officer
    - urn: urn:intuitem:risk:req_node:k_isms_p:node12
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.2
      description: The Chief Executive Officer (CEO) must officially designate a Chief
        Information Security Officer (CISO) and a Chief Privacy Officer (CPO) through
        formal procedures such as personnel appointments to effectively oversee and
        be responsible for information security and personal information protection
        management activities within the organization.
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node13
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node12
      description: The CISO and CPO must be officially appointed through personnel
        appointments, and in cases of ex officio appointments, their positions must
        be specified in the information security and personal information protection
        policy document.
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node14
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.2
      description: The CISO and CPO must be designated at an executive level with
        the authority to allocate resources such as budget and personnel, and they
        must meet the qualifications required by relevant laws (Refer to Article 36-7
        of the Enforcement Decree of the Information and Communications Network Act).
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node15
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node14
      description: The CISO and CPO should be individuals with knowledge and competence
        in information security and personal information protection, designated at
        an executive level capable of allocating resources such as budget and personnel,
        to effectively oversee the organization's information security and personal
        information protection tasks.
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node16
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node15
      description: Information service providers must designate an executive who meets
        the criteria prescribed by Presidential Decree as the CISO to ensure the security
        and safe management of information and information systems, and report this
        to the Minister of Science and ICT. However, in cases where the criteria set
        by Presidential Decree are met, reporting may be exempted.
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node17
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node14
      description: Compliance with legal requirements for the designation of a CISO
        is necessary (Refer to Article 45-3 of the Information and Communications
        Network Act).
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node18
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node14
      description: Compliance with legal requirements for the designation of a Chief
        Privacy Officer (CPO) is necessary (Refer to Article 32 of the Enforcement
        Decree of the Personal Information Protection Act, etc.).
      annotation: 'Key Points for Verification

        - Has the Chief Executive Officer (CEO) officially designated a Chief Officer
        who will be responsible for overseeing and managing information security and
        personal information protection tasks?

        - Is the Chief Information Security Officer (CISO) and the Chief Privacy Officer
        (CPO) designated at an executive level with the authority to allocate resources
        such as budget and personnel, and do they meet the qualifications required
        by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      ref_id: 1.1.3
      name: Organization Structure
    - urn: urn:intuitem:risk:req_node:k_isms_p:node20
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.3
      description: Considering the characteristics such as the size of the organization
        and the importance of tasks, the basis for the organizational structure necessary
        to establish and continuously operate the Information Security and Personal
        Information Protection Management System should be specified in the Information
        Security and Personal Information Protection Policy or other relevant documents.
        Additionally, a working group with expertise should be formed and operated.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node21
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node20
      description: The composition and operation of the Information Security and Personal
        Information Protection organization, including the Chief Information Security
        Officer (CISO), Chief Privacy Officer (CPO), working groups, and committees,
        should be specified in policies, internal management plans, etc.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node22
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node20
      description: The structure and size of the working group should be determined
        by considering the overall size of the organization, the nature of its tasks
        and services, the importance and sensitivity of the information and personal
        data being processed, legal regulations, etc.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node23
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node20
      description: The working group can be composed of either a dedicated team or
        a combined team, but even if it is a combined team, roles and responsibilities
        must be officially assigned to ensure that the team can perform its duties
        effectively.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node24
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node20
      description: Members of the working group should be employees with expertise
        in information security and personal information protection, as well as a
        good understanding of various services and experience (e.g., holding relevant
        degrees and certifications, possessing practical experience, completing relevant
        training, etc.).
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node25
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.3
      description: A committee should be established and operated to review, approve,
        and make decisions on important information security and personal information
        protection matters across the organization.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node26
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node25
      description: The committee should be composed of individuals who represent the
        interests within the organization and have real authority for review and decision-making
        on information security and personal information protection, including management,
        executives, the CISO, and the CPO.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node27
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node25
      description: The committee should be convened regularly or as needed based on
        specific issues.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node28
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node25
      description: The committee should review, approve, and make decisions on major
        matters across the organization.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node29
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.3
      description: To oversee enterprise-wide information security and personal information
        protection activities, a working group composed of relevant officers and departmental
        representatives should be established and operated.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node30
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node29
      description: The composition of the working group and its organizational structure
        should be determined based on the size of the organization and the importance
        of the services within the scope of the management system.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node31
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node29
      description: The working group should share, coordinate, review, and improve
        information security and personal information protection matters at the practical
        level. If decision-making or management support is required, the issues should
        be submitted to the committee for discussion.
      annotation: 'Key Points for Verification

        - Is there a specialized working group with expertise that supports the duties
        of the Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO) and systematically implements the organization''s information security
        and personal information protection activities?

        - Has a committee been established and operated to review, approve, and make
        decisions on important information security and personal information protection
        matters across the organization?

        - Is there a working group composed of information security and personal information
        protection officers, as well as departmental representatives, that is established
        and operated to oversee enterprise-wide information security and personal
        information protection activities?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      ref_id: 1.1.4
      name: Setting the Scope
    - urn: urn:intuitem:risk:req_node:k_isms_p:node33
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.4
      description: The scope of the management system must be defined to include key
        assets that could impact the organization's core services and the processing
        of personal information.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node34
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node33
      description: The management system's scope should comprehensively include all
        key tangible and intangible assets related to the business (services), such
        as employees, information systems, information, and facilities, without omissions.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node35
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node33
      description: Particularly for those subject to mandatory information security
        management systems, the scope must include information and communication services
        and related information assets as required by legal obligations.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node36
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.4
      description: If there are any exceptions within the defined scope, clear reasons,
        consultation with relevant parties, and approval from responsible individuals
        must be documented and managed.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node37
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node36
      description: If the scopes of the Information Security Management System (ISMS)
        and the Personal Information Protection Management System (PIPMS) differ,
        the list of information assets within the certification scope (e.g., personal
        information, systems, networks) must be clearly identified and defined from
        both the ISMS and PIPMS perspectives.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node38
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node36
      description: For services and information systems excluded from the certification
        scope, the reasons and justifications must be recorded and managed after internal
        consultation and approval from the responsible parties.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node39
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.4
      description: Documents containing related content (e.g., key service and business
        status, list of information systems, list of documents) must be created and
        managed to clearly identify the scope of the Information Security and Personal
        Information Protection Management System.
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node40
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Key service and business status (including personal information
        processing tasks)
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node41
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Organizational status related to service provision (e.g., organizational
        charts)
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node42
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Status of information security and personal information protection
        organizations
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node43
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: List of key facilities
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node44
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: List of information systems and network configuration diagrams
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node45
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Criteria for identifying information assets and personal information-related
        assets, and the status of these assets
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node46
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: List of Information Security and Personal Information Protection
        Systems
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node47
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Service (System) Diagrams and the Flow of Personal Information
        Processing (collection, use, provision, storage, management, disposal)
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node48
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: List of Documents (e.g., policies, guidelines, manuals, operation
        specifications, etc.)
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node49
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Methods and procedures for establishing the Information Security
        and Personal Information Protection Management System, compliance review with
        related legal requirements, and internal audits
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node50
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node39
      description: Status of outsourced (entrusted) companies such as customer centers,
        IDC (Internet Data Centers), IT development, and operations
      annotation: 'Key Points for Verification

        - Is the scope of the management system set to include key assets that could
        impact the organization''s core services and the processing of personal information?

        - If there are exceptions within the defined scope, are clear reasons, consultations
        with relevant parties, and approvals from responsible individuals documented
        and managed?

        - Are documents created and managed that include related content (e.g., key
        service and business status, list of information systems, list of documents)
        to clearly identify the scope of the Information Security and Personal Information
        Protection Management System?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      ref_id: 1.1.5
      name: Policy Formulation
    - urn: urn:intuitem:risk:req_node:k_isms_p:node52
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.5
      description: 'The highest-level Information Security and Personal Information
        Protection policy, which includes the basis for all Information Security and
        Personal Information Protection activities conducted by the organization,
        must include the following elements:'
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node53
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node52
      description: The commitment and direction of the CEO and other executives regarding
        the organization's Information Security and Personal Information Protection.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node54
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node52
      description: The roles, responsibilities, targets, and scope for Information
        Security and Personal Information Protection within the organization
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node55
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node52
      description: The basis for the administrative, technical, and physical Information
        Security and Personal Information Protection activities carried out by the
        organization.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node56
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.5
      description: In order to specifically implement the Information Security and
        Personal Information Protection measures outlined in the policy, the organization
        must establish detailed guidelines, procedures, manuals, guides, and other
        subordinate execution documents that define the necessary methods, procedures,
        cycles, and responsible entities in accordance with the organization's characteristics.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node57
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node56
      description: Subordinate execution documents should provide a concrete basis
        for all Information Security and Personal Information Protection activities
        undertaken by the organization and be tailored to the organization's characteristics,
        whether from the perspective of the protection targets or the responsible
        entities.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node58
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node56
      description: Policies and implementation documents (such as guidelines and procedures)
        must reflect the legal requirements related to personal information protection
        (laws, enforcement decrees, enforcement rules, subordinate notices, guides,
        etc.) that are relevant to the services and businesses provided by the organization.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node59
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node56
      description: When processing personal information, the internal management plan
        must be established in accordance with the Personal Information Protection
        Act, including all requirements specified by the relevant legal regulations.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node60
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.5
      description: When creating or revising Information Security and Personal Information
        Protection policies and implementation documents, approval must be obtained
        from the CEO or an individual delegated by the CEO.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node61
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node60
      description: Ensure thorough consultation and review with stakeholders when
        creating or revising policies and implementation documents.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node62
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node60
      description: "Consider the impact of changes to policies and implementation\
        \ documents on the organization\u2019s operations, services, and legal compliance."
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node63
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node60
      description: Keep records of review discussions, such as meeting minutes, and
        reflect these considerations in the policies and guidelines.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node64
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node60
      description: Report the finalized policies and implementation documents to the
        management and obtain approval.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node65
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.5
      description: When creating or revising Information Security and Personal Information
        Protection policies and implementation documents, the latest version must
        be provided to relevant employees in an easily understandable format.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node66
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node65
      description: Provide the documents in a format that is easily accessible to
        employees and external parties (e.g., electronic bulletin boards, booklets,
        training materials, manuals).
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node67
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node65
      description: Immediately publish any changes to the policies and implementation
        documents and ensure that the latest version is maintained.
      annotation: "Key Points for Verification \n- Has the organization established\
        \ a top-level Information Security and Personal Information Protection policy\
        \ that includes the basis for all Information Security and Personal Information\
        \ Protection activities it undertakes?\n- Has the organization established\
        \ guidelines, procedures, manuals, etc., that define the detailed methods,\
        \ procedures, and cycles necessary for the implementation of the Information\
        \ Security and Personal Information Protection policy?\n- Is the approval\
        \ of the CEO or an individual delegated by the CEO obtained for the creation\
        \ or revision of Information Security and Personal Information Protection\
        \ policies and implementation documents?\n- Is the latest version of the Information\
        \ Security and Personal Information Protection policies and implementation\
        \ documents provided to relevant employees in an easily understandable format?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.1.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1
      ref_id: 1.1.6
      name: Resource Allocation
    - urn: urn:intuitem:risk:req_node:k_isms_p:node69
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.6
      description: The top management must ensure that personnel with expertise in
        information security and personal data protection are secured to facilitate
        smooth execution of activities.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node70
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node69
      description: Possess specialized knowledge and relevant qualifications (e.g.,
        degrees or certifications related to information security and personal data
        protection).
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node71
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node69
      description: Have practical experience in information security and personal
        data protection.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node72
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node69
      description: Complete job-related training in information security and personal
        data protection.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node73
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.6
      description: The top management must assess the necessary resources for effective
        implementation and continuous operation of the information security and personal
        data protection management system and provide the required budget and personnel.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node74
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node73
      description: Annually assess the necessary budget and resources for the effective
        establishment and ongoing operation of the information security and personal
        data protection management system, and develop and approve budget and personnel
        plans.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node75
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node73
      description: Continuously support the required resources (e.g., personnel, organization,
        budget) in accordance with the budget and personnel plans.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node76
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.1.6
      description: Develop and implement detailed annual plans for information security
        and personal data protection tasks and conduct review, analysis, and evaluation
        of the results.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node77
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node76
      description: Establish detailed annual plans for executing information security
        and personal data protection tasks, report to management, and implement them.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node78
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node76
      description: Review, analyze, and evaluate the results of the implementation
        according to the detailed plans and report to management.
      annotation: "Key Points for Verification\n- Are there personnel with expertise\
        \ in information security and personal data protection?\n- To effectively\
        \ implement and continuously operate the information security and personal\
        \ data protection management system, is there an evaluation of the necessary\
        \ resources, and is the required budget and manpower being provided?\n- Is\
        \ there a detailed annual plan for information security and personal data\
        \ protection tasks, and is there a review and analysis of the results of the\
        \ plan\u2019s implementation?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1
      ref_id: '1.2'
      name: Risk Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2
      ref_id: 1.2.1
      name: Identification of Information Assets
    - urn: urn:intuitem:risk:req_node:k_isms_p:node81
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.1
      description: Establish criteria for classifying information assets and identify
        and manage all assets within the scope of the information security and personal
        data protection management system as a list.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node82
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node81
      description: Develop classification criteria for information assets that match
        the characteristics of the organization and ensure that all information assets
        are identified according to these criteria.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node83
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node81
      description: Verify and list asset information such as asset name, purpose,
        location, responsible person and manager, and managing department.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node84
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node81
      description: Utilize an asset management system or manage assets in various
        forms (e.g., documents or spreadsheets) for efficient management.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node85
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node81
      description: When using cloud services, establish classification criteria reflecting
        the characteristics of the cloud service (e.g., virtual servers, object storage)
        and identify and manage cloud assets accordingly.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node86
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.1
      description: Determine the importance of identified information assets and assign
        security classifications based on legal requirements and their impact on business
        operations.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node87
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node86
      description: Establish security classification criteria tailored to the characteristics
        of each asset, considering legal requirements and their impact on business
        operations.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node88
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node86
      description: Assign and manage security classifications for each information
        asset according to the established security classification criteria.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node89
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.1
      description: Regularly review the status of information assets to keep the asset
        list up-to-date.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node90
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node89
      description: Establish procedures to track newly introduced, changed, and discarded
        assets.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node91
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node89
      description: Conduct regular reviews of the information asset status and maintain
        the asset list in an up-to-date condition.
      annotation: 'Key Points for Verification

        - Have you established criteria for classifying information assets and are
        you identifying and managing all assets within the scope of the information
        security and personal data protection management system as a list?

        - For identified information assets, do you determine their importance and
        assign security classifications considering legal requirements and the impact
        on business operations?

        - Do you regularly review the status of information assets and keep the asset
        list up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2
      ref_id: 1.2.2
      name: Analysis of Current Status and Flow
    - urn: urn:intuitem:risk:req_node:k_isms_p:node93
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.2
      description: Status and flow analysis serves as a preliminary step for risk
        analysis, providing foundational data that allows for risk analysis from various
        perspectives. It also enables executives to effectively understand the information
        security status and make decisions for risk management.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node94
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node93
      description: Status analysis involves comparing certification standards with
        operational status using a GAP analysis table to identify differences between
        the certification standards and the operational status.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node95
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node93
      description: Flow analysis is divided into information service flow analysis
        and personal data processing stage flow analysis, with the results being illustrated
        using flowcharts or diagrams.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node96
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.2
      description: Identify the status of information services across all areas of
        the management system, understand and document the business procedures and
        processes.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node97
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node96
      description: Identify the status of all information services within the scope
        of the management system.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node98
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node96
      description: Understand the business procedures and processes for each information
        service.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node99
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node96
      description: Document the business procedures and processes using tools such
        as status tables and flowcharts.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node100
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.2
      description: Identify the status of personal data processing within the scope
        of the management system and understand the flow of personal data, documenting
        it using personal data flow charts and diagrams (for ISMS-P certification).
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node101
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node100
      description: (Step 1) Identify the individual business processes where personal
        data processing occurs.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node102
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node100
      description: (Step 2) Create personal data flow charts for each business process,
        detailing the lifecycle of personal data.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node103
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node100
      description: '(Step 3) Based on the created personal data flow charts, develop
        an overarching personal data flow diagram and business-specific personal data
        flow diagrams. These diagrams should clearly illustrate the flow of personal
        data through different stages: collection, retention, use/provision, and disposal.'
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node104
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.2
      description: 'Regularly review and manage the business procedures and personal
        data flows to ensure they are up-to-date, considering the following aspects,
        at least once a year:'
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node105
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node104
      description: Changes in existing services, business operations, and personal
        data flows (e.g., new services or service revisions, changes in business procedures,
        alterations in personal data processing methods, organizational changes, modifications
        in external connections and data flows).
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node106
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node104
      description: Changes in critical information and personal data categories being
        processed.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node107
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node104
      description: Changes in the types, configuration, and functions of information
        systems and personal data processing systems.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node108
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node104
      description: Emergence of new personal data processing tasks and flows.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node109
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node104
      description: Changes in external conditions such as updates to regulations or
        the emergence of new vulnerabilities.
      annotation: 'Key Points for Verification

        - Have you identified the status of information services across all areas
        of the management system and documented the business procedures and processes?

        - Have you identified the status of personal data processing within the scope
        of the management system and documented the flow of personal data using diagrams
        such as data flow charts?

        - Do you regularly review business procedures and the flow of personal data
        in response to changes in services, business operations, and information assets,
        and keep related documents, such as flowcharts, up-to-date?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2
      ref_id: 1.2.3
      name: Risk Assessment
    - urn: urn:intuitem:risk:req_node:k_isms_p:node111
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.3
      description: Reflecting the characteristics of the organization, define and
        document methods for identifying and assessing information security and personal
        data protection risks from various aspects, including administrative, technical,
        physical, and legal fields.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node112
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node111
      description: 'Select risk assessment methods: baseline approach, detailed risk
        analysis, composite approach, threat and scenario-based methods, etc.'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node113
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node111
      description: 'Reflect the characteristics of the business and organization:
        organizational vision and mission, business objectives, service types, compliance,
        etc.'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node114
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node111
      description: 'Consider various perspectives: hacking, insider threats, external
        management or supervision lapses, violations of personal data regulations,
        etc.'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node115
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node111
      description: Consider the latest vulnerabilities and threat trends.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node116
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node111
      description: Risk assessment methodologies can be defined and applied according
        to the organization's characteristics, but the process must be rational, and
        the results should represent the seriousness of the actual risks.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node117
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.3
      description: Develop a risk management plan that specifies the risk management
        methods and procedures (including personnel, duration, scope, methods, budget,
        etc.).
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node118
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node117
      description: 'Personnel: Involve risk management experts, information security
        and personal data protection specialists, legal experts, IT operational managers,
        business unit managers, external consultants, etc. (Stakeholder involvement
        is necessary.)'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node119
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node117
      description: 'Duration: Establish a schedule to ensure that risk assessments
        are conducted at least once a year.'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node120
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node117
      description: 'Scope: Include all services and assets within the certification
        scope (information assets, personal data, systems, physical facilities, etc.).'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node121
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node117
      description: 'Methods: Define risk assessment methodologies that reflect the
        organization''s characteristics.'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node122
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node117
      description: 'Budget: Develop an annual budget plan for risk identification
        and assessment and obtain approval from executives, including the Chief Information
        Security Officer.'
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node123
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.3
      description: According to the risk management plan, perform risk assessments
        for all areas within the scope of the information security and personal data
        protection management system at least once a year or as needed.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node124
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node123
      description: Systematically execute assessments based on the pre-established
        risk management methods and plans.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node125
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node123
      description: Conduct risk assessments regularly at least once a year, but perform
        additional assessments if significant changes occur, such as organizational
        changes or the introduction of new systems.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node126
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node123
      description: Incorporate findings from the status and flow analysis of services
        and information assets.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node127
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node123
      description: Verify compliance with legal requirements related to information
        security and personal data protection based on the latest regulations.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node128
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node123
      description: Ensure compliance with the certification standards for the information
        security and personal data protection management system.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node129
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node123
      description: Include a review of the effectiveness of implemented information
        security and personal data protection measures.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node130
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.3
      description: Define an acceptable level of risk for the organization and identify
        risks that exceed this level.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node131
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node130
      description: Establish risk assessment criteria considering the impact of various
        risks on the organization (likelihood, severity, etc.).
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node132
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node130
      description: Assess the level of risk for identified risks according to the
        established criteria.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node133
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node130
      description: Determine the acceptable level of risk (Degree of Assurance) based
        on decisions by executives, including the Chief Information Security Officer
        and the Personal Data Protection Officer.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node134
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node130
      description: Identify and document risks that exceed the acceptable level of
        risk.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node135
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.3
      description: Report the results of risk identification and assessment in a manner
        that is easily understood by executives, including the Chief Information Security
        Officer and the Personal Data Protection Officer.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node136
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node135
      description: Prepare evaluation reports for identified risks.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node137
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node135
      description: Share and discuss the content with relevant stakeholders for each
        identified risk (e.g., operational committees, review boards).
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node138
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node135
      description: Prepare and report the findings in a way that is understandable
        and actionable for executives, avoiding technical jargon and focusing on clarity
        for decision-making.
      annotation: 'Key Points for Verification:

        - Have you defined methods for identifying and assessing risks from various
        perspectives, based on the characteristics of the organization or service?

        - Do you develop a detailed risk management plan annually, specifying risk
        management methods and procedures (including personnel, duration, scope, methods,
        budget, etc.)?

        - Do you perform risk assessments regularly (at least once a year) or as needed,
        in accordance with the risk management plan?

        - Have you established an acceptable level of risk for the organization and
        identified risks that exceed this level?

        - Do you report the results of risk identification and assessment to management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2
      ref_id: 1.2.4
      name: Selection of Protective Measures
    - urn: urn:intuitem:risk:req_node:k_isms_p:node140
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.4
      description: Establish risk treatment strategies (such as risk reduction, risk
        avoidance, risk transfer, or risk acceptance) for identified risks, and select
        appropriate information security and personal data protection measures for
        each risk based on these strategies.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node141
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node140
      description: It is common to develop risk treatment strategies with the goal
        of reducing the risk level. However, depending on the situation, strategies
        such as risk avoidance, risk transfer, and risk acceptance should also be
        considered.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node142
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node140
      description: When selecting protective measures, consider the alignment of information
        security and personal data protection measures with the certification standards
        for the management system.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node143
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node140
      description: If risk acceptance is chosen due to unavoidable reasons, avoid
        unconditional risk acceptance. Instead, carefully review the appropriateness
        of the unavoidable reasons and the feasibility of implementing supplementary
        measures, and base the decision on clear and objective evidence.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node144
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node140
      description: Be cautious to ensure that risks involving legal violations are
        not included in the acceptable risk category.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node145
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node140
      description: For risks that do not exceed the acceptable risk level but have
        a high potential for increased risk due to changes in internal or external
        environments, or are considered critical by the organization, consider establishing
        protective measures.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node146
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.2.4
      description: Considering the priority of information security and personal data
        protection measures, develop an implementation plan that includes a schedule,
        responsible departments and individuals, budget, and other relevant elements,
        and report this plan to the Chief Information Security Officer and the Personal
        Data Protection Officer, as well as other executives.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node147
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node146
      description: Determine priorities based on factors such as the severity and
        urgency of the risks, ease of implementation, budget allocation, availability
        of resources, and dependencies
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node148
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node146
      description: Prepare an implementation plan for information security and personal
        data protection measures that includes the schedule, responsible departments
        and individuals, budget, and other relevant details, and present it to executives
        for approval.
      annotation: 'Key Points for Verification:

        - Have you established risk treatment strategies (such as mitigation, avoidance,
        transfer, or acceptance) for identified risks and selected protective measures
        for risk management?

        - Have you developed and reported to management a risk treatment plan that
        includes a schedule, responsible departments and individuals, budget, and
        other relevant elements, considering the prioritization of protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1
      ref_id: '1.3'
      name: Operation of the Management System
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3
      ref_id: 1.3.1
      name: Implementation of Protective Measures
    - urn: urn:intuitem:risk:req_node:k_isms_p:node151
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3.1
      description: According to the implementation plan, ensure that the selected
        protective measures are effectively implemented and report the results to
        management, including the Chief Information Security Officer and the Personal
        Data Protection Officer, to verify the accuracy and effectiveness of the implementation.
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node152
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node151
      description: Regularly report on the progress of the implementation plan, including
        completion status, current progress, and reasons for any non-compliance or
        delays to the Chief Information Security Officer, the Personal Data Protection
        Officer, and other executives.
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node153
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node151
      description: Management should review whether the information security and personal
        data protection measures have been implemented accurately and effectively
        according to the plan.
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node154
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node151
      description: If non-compliance or delays occur, analyze the causes, adjust the
        implementation plan if necessary, and report to and obtain approval from management.
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node155
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node151
      description: If the results of the implementation are found to be ineffective
        or raise significant doubts about their effectiveness, establish alternatives
        or procedures for additional risk assessments to address the issues.
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node156
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3.1
      description: Prepare detailed operational specifications that document the implementation
        and operational status of protective measures for each certification standard.
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node157
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node156
      description: 'Confirm whether the certification standards have been selected
        (Yes/No): The ''Establishment and Operation of the Management System'' area
        is mandatory.'
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node158
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node156
      description: 'Operational Status: Provide a detailed account of the organization''s
        policies and operational status compared to the certification standards.**'
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node159
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node156
      description: 'Related Documents: Clearly specify the names and detailed document
        numbers of relevant documents (policies, guidelines, etc.) applicable to the
        standards.**'
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node160
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node156
      description: 'Records (Evidence): Present documents or evidence generated during
        the actual operation of the standards, such as related documents, approval
        details, and meeting minutes.**'
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node161
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node156
      description: 'Reasons for Not Selecting Standards: If a service or system within
        the certification scope is entirely unrelated to a given standard, provide
        a detailed explanation for not selecting that standard.**'
      annotation: 'Key Points for Verification:

        - Are you effectively implementing protective measures according to the implementation
        plan and reporting the results to management so they can verify the accuracy
        and effectiveness of the implementation?

        - Are you preparing detailed operational specifications that document the
        implementation and operational status of protective measures for each certification
        standard of the management system?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3
      ref_id: 1.3.2
      name: Sharing of Protective Measures
    - urn: urn:intuitem:risk:req_node:k_isms_p:node163
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3.2
      description: You must clearly identify the departments and individuals responsible
        for operating or implementing the implemented protective measures.
      annotation: 'Key Points for Verification:

        - Have you clearly identified the departments and individuals responsible
        for operating or implementing the implemented protective measures?

        ) Are you sharing or providing training on the relevant content to the departments
        and individuals responsible for operating or implementing the protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node164
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3.2
      description: To internalize the information security and personal data protection
        management system, you must share or provide training on the relevant content
        to the departments and individuals responsible for operating or implementing
        the implemented protective measures.
      annotation: 'Key Points for Verification:

        - Have you clearly identified the departments and individuals responsible
        for operating or implementing the implemented protective measures?

        ) Are you sharing or providing training on the relevant content to the departments
        and individuals responsible for operating or implementing the protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node165
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node164
      description: 'Shared Content: Revisions and updates to information security
        and personal data protection policies and implementation documents, implementation
        plans and results for information security and personal data protection measures,
        and new security system implementations and improvements.'
      annotation: 'Key Points for Verification:

        - Have you clearly identified the departments and individuals responsible
        for operating or implementing the implemented protective measures?

        ) Are you sharing or providing training on the relevant content to the departments
        and individuals responsible for operating or implementing the protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node166
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node164
      description: 'Recipients: Departments and individuals responsible for the actual
        operation or implementation of the relevant policies, guidelines, and protective
        measures.'
      annotation: 'Key Points for Verification:

        - Have you clearly identified the departments and individuals responsible
        for operating or implementing the implemented protective measures?

        ) Are you sharing or providing training on the relevant content to the departments
        and individuals responsible for operating or implementing the protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node167
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node164
      description: 'Sharing Methods: Bulletin boards and email notifications (for
        simple issues), meetings, briefings, and training sessions.'
      annotation: 'Key Points for Verification:

        - Have you clearly identified the departments and individuals responsible
        for operating or implementing the implemented protective measures?

        ) Are you sharing or providing training on the relevant content to the departments
        and individuals responsible for operating or implementing the protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.3.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3
      ref_id: 1.3.3
      name: Management of Operational Status
    - urn: urn:intuitem:risk:req_node:k_isms_p:node169
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3.3
      description: To ensure the effective operation of the management system, you
        must identify information security and personal data protection activities
        that are required to be performed daily, weekly, monthly, quarterly, semi-annually,
        or annually, or on an ongoing basis. You should create and manage a document
        (operational status table) that defines the performance cycle and timing,
        as well as the responsible parties (departments and individuals), to easily
        monitor the status of these activities.
      annotation: "Key Points for Verification:\n- Are you documenting and managing\
        \ information security and personal data protection activities that need to\
        \ be performed periodically or continuously for the operation of the management\
        \ system?\n- Does management periodically review and manage the effectiveness\
        \ of the management system\u2019s operational activities?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node170
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.3.3
      description: "Management must periodically verify the effectiveness of the management\
        \ system\u2019s operational activities and address any issues identified through\
        \ improvements."
      annotation: "Key Points for Verification:\n- Are you documenting and managing\
        \ information security and personal data protection activities that need to\
        \ be performed periodically or continuously for the operation of the management\
        \ system?\n- Does management periodically review and manage the effectiveness\
        \ of the management system\u2019s operational activities?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node171
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node170
      description: Regularly check to ensure that the operational activities are being
        performed periodically or continuously according to the operational status
        table, and report the findings to management.
      annotation: "Key Points for Verification:\n- Are you documenting and managing\
        \ information security and personal data protection activities that need to\
        \ be performed periodically or continuously for the operation of the management\
        \ system?\n- Does management periodically review and manage the effectiveness\
        \ of the management system\u2019s operational activities?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node172
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node170
      description: "Management should evaluate the effectiveness of the management\
        \ system\u2019s operational activities and, if necessary, take corrective\
        \ actions such as changing responsible parties, adjusting performance cycles,\
        \ or adding, modifying, or removing operational activities."
      annotation: "Key Points for Verification:\n- Are you documenting and managing\
        \ information security and personal data protection activities that need to\
        \ be performed periodically or continuously for the operation of the management\
        \ system?\n- Does management periodically review and manage the effectiveness\
        \ of the management system\u2019s operational activities?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1
      ref_id: '1.4'
      name: Inspection and Improvement of the Management System
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.4.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4
      ref_id: 1.4.1
      name: Review of Compliance with Legal Requirements
    - urn: urn:intuitem:risk:req_node:k_isms_p:node175
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4.1
      description: You must identify and keep up-to-date with the legal requirements
        related to information security and personal data protection that the organization
        must comply with.
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node176
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node175
      description: Identify the information security and personal data protection
        regulations that the organization is required to comply with.
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node177
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node175
      description: Continuously monitor the status of amendments and updates to relevant
        regulations. Analyze the impact of such changes on the organization and, if
        necessary, reflect these changes in internal policies, guidelines, and checklists
        to maintain up-to-date compliance
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node178
      assessable: false
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node175
      description: '[Reference] Information Security Disclosure System'
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node179
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4.1
      description: Compliance with legal requirements must be reviewed regularly at
        least once a year.
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node180
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node179
      description: Establish procedures for regularly reviewing compliance with legal
        requirements (including review cycle, scope, responsible parties, methods,
        etc.) and implement them.
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node181
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node179
      description: Promptly take corrective actions for any issues identified during
        the compliance review.
      annotation: 'Key Points for Verification:

        - Are you identifying and keeping up-to-date with the legal requirements related
        to information security and personal data protection that the organization
        must comply with?

        - Is compliance with legal requirements reviewed regularly at least once a
        year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.4.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4
      ref_id: 1.4.2
      name: Inspection of the Management System
    - urn: urn:intuitem:risk:req_node:k_isms_p:node183
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4.2
      description: You must establish a management system inspection plan that includes
        criteria, scope, frequency, and qualifications for inspection personnel to
        check whether the information security and personal data protection management
        system is operating effectively according to legal requirements and established
        policies, and report this plan to the management.
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node184
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node183
      description: 'Inspection Criteria: Include information security and personal
        data protection management system certification criteria.'
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node185
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node183
      description: 'Inspection Scope: Cover the entire organization or certification
        scope.'
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node186
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node183
      description: 'Inspection Frequency: Must be conducted at least once a year.'
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node187
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node183
      description: 'Inspection Personnel Qualifications: Define qualifications to
        ensure objectivity, independence, and expertise in the inspection.'
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node188
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4.2
      description: According to the management system inspection plan, you must form
        a team with ensured independence, objectivity, and expertise to perform inspections
        at least once a year and report any issues discovered to the Chief Information
        Security Officer, the Chief Privacy Officer, and other management members.
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node189
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node188
      description: Form a team to ensure objectivity, independence, and expertise
        in the inspection.
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node190
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node188
      description: Conduct inspections at least once a year as per the inspection
        plan.
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node191
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node188
      description: Prepare an inspection report and present it to the Chief Information
        Security Officer, Chief Privacy Officer, and other management members.
      annotation: 'Key Points for Verification:

        - Have you established a management system inspection plan that includes criteria,
        scope, frequency, and qualifications for personnel to check whether the information
        security and personal data protection management system operates effectively
        according to legal requirements and established policies?

        - According to the management system inspection plan, do you organize a team
        with ensured independence, objectivity, and expertise to conduct inspections
        at least once a year and report any issues discovered to the management?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:1.4.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4
      ref_id: 1.4.3
      name: Improvement of the Management System
    - urn: urn:intuitem:risk:req_node:k_isms_p:node193
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4.3
      description: You must analyze the root causes of issues identified through legal
        compliance reviews and management system inspections, and establish and implement
        preventive and corrective measures.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node194
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node193
      description: For issues identified during inspections, develop and implement
        action plans, and verify the completion of these actions.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node195
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node193
      description: Analyze the root causes of identified issues and defects in the
        management system.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node196
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node193
      description: Based on the results of the root cause analysis, establish and
        implement measures to prevent recurrence and improve the identified issues.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node197
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node193
      description: Share and provide training on the established preventive measures
        to relevant parties.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node198
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:1.4.3
      description: You must establish criteria and procedures to verify the accuracy
        and effectiveness of preventive and corrective actions.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node199
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node198
      description: Develop key performance indicators (KPIs) for the management system
        aspects (such as security performance indicators) to measure the accuracy
        and effectiveness of preventive and corrective actions.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node200
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node198
      description: Establish and implement procedures for measuring and monitoring
        key performance indicators (KPIs) and security performance indicators.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node201
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node198
      description: Report the results of the verification and measurement of the accuracy
        and effectiveness of preventive and corrective actions to the management.
      annotation: 'Key Points for Verification:

        - Are you analyzing the root causes of issues identified through compliance
        reviews and management system inspections, and establishing and implementing
        preventive and corrective measures?

        - Have you established criteria and procedures to verify the accuracy and
        effectiveness of the preventive and corrective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2
      assessable: false
      depth: 1
      ref_id: '2'
      name: Protection Requirements
      description: (64 items)
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.1'
      name: Policy, Organization, Asset Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1
      ref_id: 2.1.1
      name: Policy Maintenance
    - urn: urn:intuitem:risk:req_node:k_isms_p:node205
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.1
      description: Regularly establish and implement a process to review the validity
        of policies and implementation documents related to information security and
        personal data protection (including guidelines, procedures, and guide documents).
        When necessary, update or revise the relevant policies and implementation
        documents.
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node206
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node205
      description: 'Establishing Procedures: Develop and implement procedures for
        the regular validity review of information security and privacy protection
        policies and implementation documents.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node207
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node205
      description: 'Perform Validity Review: Conduct validity reviews considering
        the following aspects to ensure that information security and privacy protection
        policies and documents reflect changes in laws and regulations, align with
        policies from higher organizations and related institutions, and adapt to
        changes in the internal and external environment of the organization.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node208
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node207
      description: 'Alignment Analysis: Analyze the alignment with information security
        and privacy protection policies of higher organizations and related institutions
        to ensure mutual consistency. Review for the presence of inconsistencies and
        check the appropriateness of the hierarchical structure between policies.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node209
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node207
      description: 'Document Consistency: Ensure consistency in the periodicity, level,
        and method of information security and privacy protection activities across
        documents.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node210
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node207
      description: 'Legal Compliance: Review any changes (including upcoming ones)
        in information security and privacy protection laws and regulations to ensure
        they are appropriately reflected in policies and implementation documents.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node211
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node207
      description: 'Risk Assessment: Incorporate the results of risk assessments and
        management system inspections.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node212
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node207
      description: 'Environmental Changes: Consider new threats and vulnerabilities,
        changes in the business environment, the introduction of new technologies,
        and changes in the information security and privacy protection environment.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node213
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.1
      description: 'Review and Update During Significant Changes: When significant
        changes occur in the organization''s internal and external environment, the
        impact on information security and privacy protection policies and implementation
        documents should be reviewed and updated if necessary.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node214
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node213
      description: 'Legal Changes: Review and update according to changes in information
        security and privacy protection laws and regulations.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node215
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node213
      description: 'Business Environment Changes: Consider updates for significant
        changes in the business environment (e.g., entry into new business areas,
        large-scale organizational restructuring).'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node216
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node213
      description: 'Environmental Changes: Include significant changes in information
        security, privacy protection, and IT environments (e.g., introduction of new
        security systems or IT systems).'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node217
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node213
      description: 'Security Incidents: Review and update policies in response to
        significant internal or external security incidents.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node218
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node213
      description: 'New Threats: Address new threats or discovered vulnerabilities.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node219
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.1
      description: 'Stakeholder Review for Policy Updates: When revising or creating
        new information security and privacy protection policies and implementation
        documents, sufficient consultation and review with stakeholders are required.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node220
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node219
      description: 'Stakeholder Identification: Identify and consult with stakeholders,
        including the Chief Information Security Officer (CISO), the Chief Privacy
        Officer (CPO), relevant information security and privacy protection organizations,
        the IT department, departments handling critical information and personal
        data, and key information and personal data handlers.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node221
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node219
      description: 'Impact Assessment: Consider the impact of policy and document
        changes on operations, legal compliance, and other factors.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node222
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node219
      description: 'Documentation: Keep records of review discussions (e.g., meeting
        minutes) and incorporate relevant details into policies and guidelines.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node223
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.1
      description: 'Document Change History Management: Establish and implement a
        document management procedure to record and manage the history of changes
        (e.g., creation, revision, distribution, disposal) in information security
        and privacy protection policies and documents.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node224
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node223
      description: 'Version Control: Manage document versions, dates, reasons for
        changes, authors, and approvers by recording the revision history within the
        document.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node225
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node223
      description: 'Distribution and Access: Ensure that all relevant employees always
        refer to the latest version of the document through proper distribution and
        management.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented a procedure for regularly reviewing
        the validity of information security and personal data protection policies
        and implementation documents?

        - When significant changes occur in the internal or external environment of
        the organization, do you review the impact on information security and personal
        data protection policies and implementation documents, and make revisions
        as necessary?

        - Do you obtain review from stakeholders when revising or amending information
        security and personal data protection policies and implementation documents?

        - Do you maintain a history of revisions and amendments to information security
        and personal data protection policies and implementation documents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1
      ref_id: 2.1.2
      name: Organization Maintenance
    - urn: urn:intuitem:risk:req_node:k_isms_p:node227
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.2
      description: Considering the characteristics of the organization related to
        the performance of information security and privacy protection tasks, the
        roles and responsibilities of relevant managers and personnel must be specifically
        defined in the implementation documents.
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node228
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node227
      description: ' Chief Information Security Officer (CISO) and Chief Privacy Officer
        (CPO)'
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node229
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node227
      description: Information security and privacy protection managers and personnel
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node230
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node227
      description: Departmental information security and privacy protection managers
        and personnel
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node231
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node227
      description: The CISO and CPO should perform tasks that reflect legal requirements
      annotation: 'Conf page 56 of the guide '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node232
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node227
      description: Information security and privacy protection managers, protection
        officers, and practitioners should have their roles and responsibilities specifically
        defined through job descriptions and other relevant documents to ensure they
        can practically support and implement the management duties of the Chief Information
        Security Officer (CISO) and Chief Privacy Officer (CPO).
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node233
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.2
      description: A system for evaluating the activities of those responsible for
        information security and privacy protection must be established.
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node234
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node233
      description: Develop methods to regularly evaluate information security and
        privacy protection activities, such as through Key Performance Indicators
        (KPI), Management By Objectives (MBO), and performance appraisals within the
        organization.
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node235
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.2
      description: " A system and procedures for communication between the organization\u2019\
        s members and the information security and privacy protection teams must be\
        \ established and implemented"
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node236
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node235
      description: Develop and implement a communication management plan related to
        information security and privacy protection.
      annotation: 'Key Points for Verification:

        - Are the roles and responsibilities of those in charge of information security
        and privacy protection clearly defined?

        - Is there a system in place to evaluate the activities of those responsible
        for information security and privacy protection?

        - Are there established and implemented systems and procedures for communication
        between the information security and privacy protection teams and other members
        of the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.1.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1
      ref_id: 2.1.3
      name: Information Asset Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node238
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.3
      description: The handling procedures (creation, acquisition, storage, use, disposal,
        etc.) according to the security classification of information assets must
        be defined, and appropriate protection measures such as encryption and access
        control must be established and implemented accordingly.
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node239
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node238
      description: 'Indicate the security classification (confidential, secret, general,
        etc.) of each information asset to enable employees to identify them:'
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node240
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node239
      description: '(Electronic) Documents: Indicate on the document cover or through
        watermarking, etc.'
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node241
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node239
      description: 'Hardware assets such as servers: Confirm the security classification
        through asset numbers or barcode labels, etc.'
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node242
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node238
      description: Establish and implement handling procedures and security control
        standards according to the security classification of information assets (creation,
        acquisition, storage, use, disposal, etc.).
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node243
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.1.3
      description: For identified information assets, the person responsible for asset
        introduction, modification, disposal, transfer, security management, and the
        person in charge of the actual management and operation of the assets (or
        the administrator) must be designated to clearly define the responsibilities.
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node244
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node243
      description: Assign responsible persons and administrators for each information
        asset and record them in the asset inventory.
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node245
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node243
      description: In the event of personnel changes due to resignation, transfer,
        etc., or changes in the status of information assets due to introduction,
        modification, or disposal, update the asset inventory to reflect the responsible
        persons and administrators for each information asset.
      annotation: 'Key Points for Verification:

        - Are handling procedures (creation, acquisition, storage, use, disposal)
        and protection measures defined and implemented according to the security
        classification of information assets?

        - Are responsible persons and administrators designated for the identified
        information assets?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.2'
      name: Human Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      ref_id: 2.2.1
      name: Designation and Management of Key Personnel
    - urn: urn:intuitem:risk:req_node:k_isms_p:node248
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.1
      description: Clear criteria for handling personal information and sensitive
        information, as well as access to key systems, should be defined.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node249
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.1
      description: Employees and external parties performing key duties should be
        designated as key personnel, and their list should be kept up-to-date.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node250
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node249
      description: ' Identify key personnel and formally designate them as key personnel.'
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node251
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node249
      description: ' Maintain a list of designated key personnel.'
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node252
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node249
      description: Update the list when new key personnel are designated, or when
        there are changes or removals.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node253
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node249
      description: Regularly review the designation of key personnel for appropriateness
        and update the list accordingly.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node254
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.1
      description: Individuals handling personal information as part of their duties
        should be designated as personal information handlers, and their list should
        be kept up-to-date.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node255
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node254
      description: Maintain a list of personal information handlers who process personal
        information as part of their job.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node256
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node254
      description: The list of personal information handlers should include those
        handlers employed by subcontractors who have been entrusted with personal
        information processing tasks. (However, subcontractors may manage their own
        list for personal information handlers who do not have access rights to the
        personal information processing system.)
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node257
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.1
      description: Regularly review the designation of personal information handlers
        for appropriateness and update the list accordingly.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node258
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.1
      description: Management measures should be established and implemented to minimize
        the designation of key personnel and personal information handlers based on
        business necessity.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node259
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node258
      description: Designate key personnel and personal information handlers only
        when absolutely necessary for business purposes.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node260
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node258
      description: Establish approval procedures for the application and granting
        of key personnel and personal information handler privileges.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node261
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node258
      description: Develop and implement management and control measures for key personnel
        and personal information handlers, including training, monitoring, etc.
      annotation: 'Key Points for Verification:

        - Are the criteria for key tasks, such as handling personal information and
        sensitive information, as well as accessing critical systems, clearly defined?

        - Are employees and external parties who perform key tasks designated as key
        personnel, and is the list of such personnel kept up-to-date?

        - Are individuals who handle personal information in their job designated
        as personal information handlers, and is the list of such individuals kept
        up-to-date?

        - Do you establish and implement management measures to minimize the designation
        of key personnel and personal information handlers based on business necessity?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      ref_id: 2.2.2
      name: Job Role Separation
    - urn: urn:intuitem:risk:req_node:k_isms_p:node263
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.2
      description: 'To prevent potential harm from the misuse or abuse of privileges,
        the following job separation criteria must be established and applied:'
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node264
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Separation of development and operational roles
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node265
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Separation of information security officers, personal information
        handlers, and information security and personal information monitoring roles
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node266
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Separation of operational roles between information systems and
        personal information processing systems (servers, databases, etc.)
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node267
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Separation of information security and personal information protection
        management from information security and personal information protection audit
        functions
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node268
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Separation of personal information protection management from the
        operation of personal information processing systems
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node269
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Separation of personal information protection management from the
        development of personal information processing systems, etc.
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node270
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node263
      description: Prohibition of granting rights to external contractor staff for
        user account registration/deletion (deactivation) and access right registration/modification/deletion
        (with compensatory controls applied if unavoidable)
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node271
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.2
      description: 'If job separation is unavoidably difficult due to reasons such
        as a small organization size or lack of human resources, compensatory controls,
        such as mutual review among role holders and ensuring accountability, must
        be established:'
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node272
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node271
      description: Management to prevent misuse or abuse through mutual review among
        role holders and approval by senior management
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node273
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node271
      description: ' Ensuring accountability through the use of individual accounts,
        logging, and audits/monitoring'
      annotation: 'Key Points for Verification:

        - Are criteria for job separation established and applied to prevent potential
        damage from the misuse or abuse of privileges?

        - If job separation is difficult to implement, are there compensatory controls
        in place, such as mutual review between job holders, regular monitoring by
        senior management, approval of changes, and ensuring accountability?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      ref_id: 2.2.3
      name: Security Pledges
    - urn: urn:intuitem:risk:req_node:k_isms_p:node275
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.3
      description: New employees must sign an information security and personal data
        protection agreement that specifies their responsibilities in these areas.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node276
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node275
      description: When new employees join, they should sign an agreement outlining
        the necessity and responsibilities of information security and personal data
        protection, compliance with internal policies and relevant regulations, and
        confidentiality obligations.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node277
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node275
      description: In the event of significant changes such as changes in employment
        conditions, the agreement should be revised accordingly.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node278
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.3
      description: When granting access to information assets (including personal
        data) and information systems to external personnel such as temporary staff
        or outsourced workers, an agreement must be obtained that specifies their
        responsibilities for information security and personal data protection, as
        well as confidentiality obligations.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node279
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node278
      description: The agreement should include necessary details such as responsibilities
        for information security and personal data protection, confidentiality obligations,
        compliance with internal regulations and relevant laws, and liability for
        damages arising from non-compliance with these obligations.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node280
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.3
      description: Upon an employee's resignation, a separate confidentiality agreement
        must be obtained.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node281
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node280
      description: Ensure that departing employees are clearly aware of their legal
        responsibilities in case of information leakage by obtaining a confidentiality
        agreement (to be included in the resignation process).
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node282
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.3
      description: Information security, personal data protection, and confidentiality
        agreements should be securely stored and managed to be easily retrievable
        when needed.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node283
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node282
      description: Store and manage these agreements in a secure manner, such as in
        a locked cabinet or a document repository with access controls, to be used
        as evidence of legal responsibility in case of legal disputes.
      annotation: 'Key Points for Verification:

        - Are new employees required to sign an information security and personal
        data protection agreement that clearly specifies their responsibilities in
        these areas?

        - When granting access to information assets to external personnel such as
        temporary staff or outsourced workers, is an agreement obtained that outlines
        their responsibilities for information security, personal data protection,
        and confidentiality obligations?

        - Upon an employee''s resignation, is a separate confidentiality agreement
        obtained?

        - Are information security, personal data protection, and confidentiality
        agreements securely stored and managed in a way that they can be easily retrieved
        when needed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      ref_id: 2.2.4
      name: Awareness and Training
    - urn: urn:intuitem:risk:req_node:k_isms_p:node285
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.4
      description: 'The annual information security and personal data protection training
        plan must be developed with specific details including the timing, duration,
        target audience, content, and methods of training, and receive approval from
        management. This plan should include:'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node286
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node285
      description: 'Types of Training: Employee awareness training, training for key
        personnel, personal data handlers, contractors, and specialized training.'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node287
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node285
      description: 'Training Plan: Objectives, target audience, content, methods,
        schedule, and duration (differentiated based on business scale, amount of
        personal data held, nature of work, target audience, and type of training).'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node288
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node285
      description: 'Approval: Review and approval of the training plan, including
        budget allocation to ensure it is carried out as planned'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node289
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.4
      description: You must conduct regular training sessions at least once a year
        for all employees and external parties within the management system's scope,
        according to the annual training plan, and provide additional training in
        response to significant changes in relevant laws and regulations.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node290
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node289
      description: 'Inclusion: All personnel with direct or indirect access to information
        assets, including employees, temporary staff, and external service providers.'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node291
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node289
      description: 'Contractors and Delegated Employees: Provide relevant materials
        to ensure the contractor performs the training, and manage and supervise the
        implementation.'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node292
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node289
      description: 'Frequency: At least once a year (especially for personal data
        handlers, as legal requirements mandate annual personal data protection training).'
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node293
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node289
      description: "Content: Ensure that the training content includes all necessary\
        \ information for employees and relevant external parties to understand and\
        \ comply with the organization\u2019s management system and policies."
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node294
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node289
      description: Develop and implement methods for training personnel who missed
        sessions due to business trips, vacations, or work commitments (e.g., additional
        training sessions for absentees, supplementary training, online courses).
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node295
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node289
      description: Conduct additional training in the event of significant changes
        to internal regulations and procedures, security incidents within or outside
        the organization, or changes in relevant laws and regulations. However, if
        the issues are not critical, alternative methods such as bulletin board notices,
        email notifications, or distribution of booklets may be used.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node296
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.4
      description: Implement information security and personal data protection training
        before new employees and external contractors start their work.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node297
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node296
      description: Provide information security and personal data protection training
        either at the point of hiring or before commencing duties to ensure understanding
        of organizational policies, precautions, and legal responsibilities for violations.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node298
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.4
      description: Ensure that employees within IT and information security roles
        receive specialized training to enhance their expertise in information security
        and personal data protection.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node299
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node298
      description: IT staff, Chief Information Security Officer, Chief Personal Data
        Protection Officer, personal data handlers, and information security personnel.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node300
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node298
      description: Participation in conferences, seminars, and workshops related to
        information security and personal data protection; outsourced training from
        specialized institutions; internal training with external experts.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node301
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.4
      description: Keep records of training activities and assess the effectiveness
        and appropriateness of the training to incorporate findings into future training
        plans.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node302
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node301
      description: Maintain records such as training announcements, materials, and
        attendance logs. Evaluate the appropriateness and effectiveness of the training
        using pre-established criteria through surveys or tests.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node303
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node301
      description: Develop measures to address areas for improvement identified in
        training evaluations and reflect these measures in the next training plan.
      annotation: 'Key Points for Verification:

        - Have you established an annual training plan for information security and
        personal data protection that includes the timing, duration, target audience,
        content, and methods of training, and received approval from management?

        - Are you conducting regular training sessions at least once a year for all
        employees and external parties within the management system''s scope, in accordance
        with the annual training plan, and providing additional training in response
        to significant changes in relevant laws and regulations?

        - Are you implementing information security and personal data protection training
        before employees start their work and for new contracts with external parties?

        - Are employees in IT and information security, personal data protection organizations
        receiving additional training to enhance their expertise in their specific
        roles related to information security and personal data protection?

        - Are records of training activities maintained, and is the effectiveness
        and appropriateness of the training evaluated and reflected in the next training
        plan?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      ref_id: 2.2.5
      name: Management of Employee Termination and Role Changes
    - urn: urn:intuitem:risk:req_node:k_isms_p:node305
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.5
      description: Personnel changes due to retirement, job changes, departmental
        transfers, or leave of absence must be promptly communicated among relevant
        departments such as HR, information security, personal data protection, and
        systems operations.
      annotation: 'Key Points for Verification:

        - Are personnel changes due to retirement, job changes, departmental transfers,
        or leave of absence communicated and shared among the HR department, information
        security and personal data protection department, and information systems
        and personal data processing systems operational departments?

        - Have procedures been established and implemented to ensure the prompt return
        of information assets, retrieval or adjustment of access rights, and verification
        of these actions when an employee (including full-time employees, temporary
        staff, and outsourced personnel) retires or changes their job role?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node306
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node305
      description: Procedures must be established and implemented to ensure that personnel
        change information is quickly shared among the relevant organizations and
        systems.
      annotation: 'Key Points for Verification:

        - Are personnel changes due to retirement, job changes, departmental transfers,
        or leave of absence communicated and shared among the HR department, information
        security and personal data protection department, and information systems
        and personal data processing systems operational departments?

        - Have procedures been established and implemented to ensure the prompt return
        of information assets, retrieval or adjustment of access rights, and verification
        of these actions when an employee (including full-time employees, temporary
        staff, and outsourced personnel) retires or changes their job role?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node307
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.5
      description: When personnel (employees, temporary staff, outsourced workers,
        etc.) retire or change roles within the organization, procedures must be established
        and implemented for the prompt return of information assets, revocation or
        adjustment of access rights, and verification of these actions.
      annotation: 'Key Points for Verification:

        - Are personnel changes due to retirement, job changes, departmental transfers,
        or leave of absence communicated and shared among the HR department, information
        security and personal data protection department, and information systems
        and personal data processing systems operational departments?

        - Have procedures been established and implemented to ensure the prompt return
        of information assets, retrieval or adjustment of access rights, and verification
        of these actions when an employee (including full-time employees, temporary
        staff, and outsourced personnel) retires or changes their job role?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node308
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node307
      description: Procedures must be established and implemented for the return of
        access cards and assets, deletion or locking of accounts, revocation or adjustment
        of access rights, and security checks during retirement or job changes.
      annotation: 'Key Points for Verification:

        - Are personnel changes due to retirement, job changes, departmental transfers,
        or leave of absence communicated and shared among the HR department, information
        security and personal data protection department, and information systems
        and personal data processing systems operational departments?

        - Have procedures been established and implemented to ensure the prompt return
        of information assets, retrieval or adjustment of access rights, and verification
        of these actions when an employee (including full-time employees, temporary
        staff, and outsourced personnel) retires or changes their job role?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node309
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node307
      description: If account sharing was unavoidable, the password for the shared
        account must be changed immediately.
      annotation: 'Key Points for Verification:

        - Are personnel changes due to retirement, job changes, departmental transfers,
        or leave of absence communicated and shared among the HR department, information
        security and personal data protection department, and information systems
        and personal data processing systems operational departments?

        - Have procedures been established and implemented to ensure the prompt return
        of information assets, retrieval or adjustment of access rights, and verification
        of these actions when an employee (including full-time employees, temporary
        staff, and outsourced personnel) retires or changes their job role?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node310
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node307
      description: Records must be maintained, and compliance with the retirement
        procedures should be reviewed regularly.
      annotation: 'Key Points for Verification:

        - Are personnel changes due to retirement, job changes, departmental transfers,
        or leave of absence communicated and shared among the HR department, information
        security and personal data protection department, and information systems
        and personal data processing systems operational departments?

        - Have procedures been established and implemented to ensure the prompt return
        of information assets, retrieval or adjustment of access rights, and verification
        of these actions when an employee (including full-time employees, temporary
        staff, and outsourced personnel) retires or changes their job role?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.2.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2
      ref_id: 2.2.6
      name: Actions in Case of Security Violations
    - urn: urn:intuitem:risk:req_node:k_isms_p:node312
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.6
      description: ' Regulations must be established for penalizing employees and
        relevant external parties who violate information protection and privacy responsibilities
        and obligations as per laws, regulations, and internal policies.'
      annotation: 'Key Points for Verification:

        - Have regulations been established regarding the penalties for employees
        and relevant external parties who violate information protection and privacy
        responsibilities and obligations in accordance with laws, regulations, and
        internal policies?

        -  When violations of information protection and privacy are detected, are
        actions taken according to internal procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node313
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node312
      description: Establish investigation, clarification, and disciplinary action
        criteria and procedures for cases of non-compliance with relevant laws and
        internal regulations, failure to fulfill responsibilities, and damage, misuse,
        or exposure of important information and personal data.
      annotation: 'Key Points for Verification:

        - Have regulations been established regarding the penalties for employees
        and relevant external parties who violate information protection and privacy
        responsibilities and obligations in accordance with laws, regulations, and
        internal policies?

        -  When violations of information protection and privacy are detected, are
        actions taken according to internal procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node314
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node312
      description: Consider compensation measures for those who diligently fulfill
        their information protection and privacy responsibilities and obligations.
      annotation: 'Key Points for Verification:

        - Have regulations been established regarding the penalties for employees
        and relevant external parties who violate information protection and privacy
        responsibilities and obligations in accordance with laws, regulations, and
        internal policies?

        -  When violations of information protection and privacy are detected, are
        actions taken according to internal procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node315
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.2.6
      description: Actions must be taken according to internal procedures when violations
        of information protection and privacy are detected.
      annotation: 'Key Points for Verification:

        - Have regulations been established regarding the penalties for employees
        and relevant external parties who violate information protection and privacy
        responsibilities and obligations in accordance with laws, regulations, and
        internal policies?

        -  When violations of information protection and privacy are detected, are
        actions taken according to internal procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node316
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node315
      description: Implement actions based on the reward and punishment regulations
        and record the outcomes.
      annotation: 'Key Points for Verification:

        - Have regulations been established regarding the penalties for employees
        and relevant external parties who violate information protection and privacy
        responsibilities and obligations in accordance with laws, regulations, and
        internal policies?

        -  When violations of information protection and privacy are detected, are
        actions taken according to internal procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node317
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node315
      description: Use the incident for company-wide announcements or as a case in
        training if necessary.
      annotation: 'Key Points for Verification:

        - Have regulations been established regarding the penalties for employees
        and relevant external parties who violate information protection and privacy
        responsibilities and obligations in accordance with laws, regulations, and
        internal policies?

        -  When violations of information protection and privacy are detected, are
        actions taken according to internal procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.3'
      name: External Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3
      ref_id: 2.3.1
      name: Management of External Parties
    - urn: urn:intuitem:risk:req_node:k_isms_p:node320
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.1
      description: You must clearly identify the status of outsourcing and the use
        of external facilities and services within the scope of the management system.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node321
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node320
      description: Identify the status of outsourcing and the use of external facilities
        and services within the management system's scope.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node322
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node320
      description: Develop and continuously update a list of the status of outsourcing
        and the use of external facilities and services.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node323
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.1
      description: 'Identify Legal Requirements and Risks Associated with Outsourcing
        and the Use of External Facilities/Services and Implement Appropriate Safeguards:'
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node324
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node323
      description: Determine if the outsourcing involves personal data processing.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node325
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node323
      description: Assess if there is any transfer of personal data abroad.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node326
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node323
      description: Identify relevant legal requirements such as those under the Personal
        Information Protection Act and the Information and Communications Network
        Act.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node327
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node323
      description: Perform a risk assessment related to outsourcing and the use of
        external facilities/services, including compliance with legal requirements.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node328
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node323
      description: Develop and implement appropriate protective measures based on
        the risk assessment results. For example, perform concentrated on-site inspections
        with different frequencies and checklists for high-risk service providers.
      annotation: 'Key Points for Verification:

        - Are you identifying the current status of outsourcing and the use of external
        facilities and services within the scope of the management system?

        - Are you identifying the legal requirements and risks associated with outsourcing
        and the use of external facilities and services, and implementing appropriate
        protective measures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3
      ref_id: 2.3.2
      name: Security in External Contracts
    - urn: urn:intuitem:risk:req_node:k_isms_p:node330
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.2
      description: When selecting external services and contractors related to the
        processing of critical information and personal data, procedures must be established
        to consider their information security and privacy protection capabilities
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node331
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node330
      description: Ensure that vendors with information security and privacy protection
        capabilities are selected by incorporating relevant requirements into the
        Request for Proposal (RFP) and evaluation criteria.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node332
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.2
      description: 'When outsourcing organizational information processing tasks or
        using external services, the following security requirements must be defined
        and reflected in the contract:'
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node333
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Compliance with information security and privacy protection laws,
        and submission of an information security and privacy protection pledge.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node334
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Regular information security training and periodic security inspections
        for employees performing outsourced tasks.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node335
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Measures to prevent the leakage of critical information acquired
        during task performance.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node336
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Restrictions on external internet access, physical protection measures
        (e.g., equipment and media access control), endpoint security (e.g., antivirus
        installation, secure password setup and periodic changes, screen saver settings),
        and restrictions on wireless network usage.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node337
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Procedures for granting and revoking access permissions to prevent
        excessive privileges when accessing information systems.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node338
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Restrictions on subcontracting, and procedures and security requirements
        for any necessary subcontracting.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node339
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node332
      description: Penalties for non-compliance with security requirements, liability
        for damages, and reporting obligations in the event of security incidents.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node340
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.2
      description: When outsourcing the development of information systems and personal
        data processing systems, the contract must specify the information security
        and privacy protection requirements that must be adhered to during development.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node341
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node340
      description: Compliance with legal requirements related to information security
        and privacy protection.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node342
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node340
      description: Application of development security procedures, including adherence
        to secure coding standards.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node343
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node340
      description: Vulnerability assessments and remediation for the completed information
        systems and personal data processing systems.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node344
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node340
      description: Security management of development-related deliverables, source
        code, and development data within the development environment.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node345
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node340
      description: Obligation to maintain confidentiality regarding information acquired
        during the development process.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node346
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node340
      description: Liability for damages and other responsibilities in case of violations.
      annotation: 'Key Points for Verification:

        - When selecting external services and contractors related to the processing
        of critical information and personal data, have procedures been established
        to consider their information security and privacy protection capabilities?

        - Are the information security and privacy protection requirements for using
        external services and outsourcing tasks identified and specified in contracts
        or agreements?

        - When outsourcing the development of information systems and personal data
        processing systems, are the information security and privacy protection requirements
        to be followed during development specified in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.3.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3
      ref_id: 2.3.3
      name: Management of Security Compliance by External Parties
    - urn: urn:intuitem:risk:req_node:k_isms_p:node348
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.3
      description: External parties must undergo periodic checks or audits to ensure
        compliance with the information security and privacy protection requirements
        specified in contracts, agreements, and internal policies.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node349
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node348
      description: Regularly conduct checks or audits to ensure adherence to the defined
        security requirements when engaging with external parties.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node350
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node348
      description: Checks or audits should be conducted before the commencement of
        work, during the ongoing process, and at the end of the work, with additional
        checks as needed.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node351
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node348
      description: Determine the frequency and method of inspections based on factors
        such as the external party's information security and privacy protection capabilities,
        possession of their own systems, and the volume and sensitivity of the information
        being processed.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node352
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.3
      description: When issues are identified during checks or audits of external
        parties, a corrective action plan must be developed and implemented.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node353
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node352
      description: Share the results of inspections and audits, establish and implement
        measures to address identified issues and prevent recurrence.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node354
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node352
      description: Perform follow-up checks to ensure the completion and effectiveness
        of corrective actions.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node355
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.3
      description: When a subcontractor entrusted with personal data processing tasks
        subcontracts the work to a third party, the principal must give consent.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node356
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node355
      description: A personal data processing subcontractor may only subcontract to
        a third party with the principal's consent and must ensure that the subcontractor
        implements the same level of technical and managerial protective measures
        as required by the principal.
      annotation: 'Key Points for Verification:

        - Are periodic checks or audits conducted to ensure that external parties
        comply with the information security and privacy protection requirements specified
        in contracts, agreements, and internal policies?

        - When issues are found during checks or audits of external parties, is a
        corrective action plan developed and implemented?

        - When a subcontractor to whom personal data processing tasks are entrusted
        subcontracts the work to a third party, is the consent of the principal obtained?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.3.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3
      ref_id: 2.3.4
      name: Security in Contract Changes and Expiration
    - urn: urn:intuitem:risk:req_node:k_isms_p:node358
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.4
      description: Security measures must be established and implemented to ensure
        that, upon the expiration of external contracts, completion of work, or changes
        in responsible personnel, procedures are followed for the return of information
        assets, deletion of information system access accounts, destruction of important
        information, and collection of confidentiality agreements.
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node359
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node358
      description: Develop information-sharing mechanisms to ensure that the responsible
        organization can promptly recognize the expiration of external contracts,
        completion of work, or changes in responsible personnel.
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node360
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node358
      description: Establish and implement security measures related to the expiration
        of external contracts, completion of work, or changes in responsible personnel.
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node361
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.3.4
      description: Upon the expiration of external contracts, procedures must be established
        and implemented to verify whether the external party retains important information
        and personal data related to the contracted work and to ensure that such information
        is recovered and disposed of.
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node362
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node361
      description: "To recover and dispose of personal data and other important information,\
        \ either visit the contractor\u2019s office in person or remotely delete the\
        \ personal data and obtain a confirmation of destruction."
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node363
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node361
      description: Ensure deletion measures are applied not only to information systems
        and responsible personnel's PCs but also to all devices and media where the
        relevant information is stored, including email inboxes.
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node364
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node361
      description: Dispose of the information using secure methods to prevent recovery
        or reconstruction.
      annotation: 'Key Points for Verification:

        - Are security measures established and implemented to ensure that upon the
        expiration of external contracts, completion of work, or changes in responsible
        personnel, official procedures are followed for the return of information
        assets, deletion of information system access accounts, and collection of
        confidentiality agreements?

        - Upon the expiration of an external contract, do you have procedures in place
        to confirm whether the external party retains any important information or
        personal data related to the contracted work, and to ensure its return or
        destruction?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.4'
      name: Physical Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.1
      name: Designation of Protected Areas
    - urn: urn:intuitem:risk:req_node:k_isms_p:node367
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.1
      description: To protect personal information, important information, documents,
        storage media, major equipment, and systems from physical and environmental
        threats, criteria for designating physical protection zones, such as control
        zones, restricted areas, and visitor areas, must be established.
      annotation: 'Key Points for Verification:

        - To protect personal information, important information, documents, storage
        media, major equipment, and systems from physical and environmental threats,
        are criteria for designating physical protection zones, such as control zones,
        restricted areas, and visitor areas, established?

        - Are protection zones designated according to the physical protection zone
        criteria, and are protection measures established and implemented for each
        zone?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node368
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node367
      description: Designate physical protection zones such as visitor areas, restricted
        areas, and control zones.
      annotation: 'Key Points for Verification:

        - To protect personal information, important information, documents, storage
        media, major equipment, and systems from physical and environmental threats,
        are criteria for designating physical protection zones, such as control zones,
        restricted areas, and visitor areas, established?

        - Are protection zones designated according to the physical protection zone
        criteria, and are protection measures established and implemented for each
        zone?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node369
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node367
      description: Select and define the terminology and distinctions for protection
        zones according to the organization's environment.
      annotation: 'Key Points for Verification:

        - To protect personal information, important information, documents, storage
        media, major equipment, and systems from physical and environmental threats,
        are criteria for designating physical protection zones, such as control zones,
        restricted areas, and visitor areas, established?

        - Are protection zones designated according to the physical protection zone
        criteria, and are protection measures established and implemented for each
        zone?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node370
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.1
      description: According to the criteria for designating physical protection zones,
        the zones must be designated and protection measures for each zone must be
        established and implemented.
      annotation: 'Key Points for Verification:

        - To protect personal information, important information, documents, storage
        media, major equipment, and systems from physical and environmental threats,
        are criteria for designating physical protection zones, such as control zones,
        restricted areas, and visitor areas, established?

        - Are protection zones designated according to the physical protection zone
        criteria, and are protection measures established and implemented for each
        zone?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node371
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node370
      description: Apply protection measures for each zone, including access control
        methods (such as ID cards or biometric authentication), authorized personnel,
        access procedures, and video surveillance.
      annotation: 'Key Points for Verification:

        - To protect personal information, important information, documents, storage
        media, major equipment, and systems from physical and environmental threats,
        are criteria for designating physical protection zones, such as control zones,
        restricted areas, and visitor areas, established?

        - Are protection zones designated according to the physical protection zone
        criteria, and are protection measures established and implemented for each
        zone?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node372
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node370
      description: Since control zones are designed to limit access to authorized
        personnel even within the organization, mark these zones as controlled when
        necessary to prevent unauthorized access attempts, and periodically review
        for any illegal access attempts.
      annotation: 'Key Points for Verification:

        - To protect personal information, important information, documents, storage
        media, major equipment, and systems from physical and environmental threats,
        are criteria for designating physical protection zones, such as control zones,
        restricted areas, and visitor areas, established?

        - Are protection zones designated according to the physical protection zone
        criteria, and are protection measures established and implemented for each
        zone?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.2
      name: Access Control
    - urn: urn:intuitem:risk:req_node:k_isms_p:node374
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.2
      description: You must establish access control procedures to ensure that only
        authorized individuals can enter each protected area and manage the list of
        authorized personnel.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node375
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node374
      description: Define the departments, roles, and tasks that are permitted to
        access each protected area, identify employees who have been granted access
        rights, and manage their status.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node376
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node374
      description: For controlled areas, ensure that only a minimal number of individuals
        are allowed entry based on work needs.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node377
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node374
      description: 'Access control procedures should include: access request, approval
        by the responsible person, granting and revoking access rights, recording
        access history, and regular review of access records.'
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node378
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node374
      description: Install access control devices such as password-based, ID card-based,
        or biometric-based systems.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node379
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node374
      description: Establish and operate access control procedures, including registration
        and deletion of access, management of access rights, visitor management, and
        access log management.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node380
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.2
      description: Entry records for each protected area should be preserved for a
        specified period, and access records and permissions should be reviewed periodically.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node381
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node380
      description: Preserve entry records for a specified period to enable post-event
        monitoring, either in paper or electronic form.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node382
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node380
      description: Review access records and permissions for issues such as long-term
        non-access, abnormal access attempts, or excessive access permissions.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node383
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node380
      description: Identify unauthorized access attempts and long-term non-access,
        investigate the reasons, and take appropriate actions.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node384
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node380
      description: Through periodic reviews, recover access cards from former employees
        and remove their access rights, and adjust access rights due to job changes.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node385
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node380
      description: If the system cannot log access, maintain a manual access log to
        verify entry records.
      annotation: 'Key Points for Verification:

        - Are access controls in place to ensure that only authorized individuals
        can enter the protected areas according to the access procedures?

        - Are entry records for each protected area, including those for internal
        and external personnel, preserved for a specified period, and are access records
        and permissions reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.3
      name: Protection of Information Systems
    - urn: urn:intuitem:risk:req_node:k_isms_p:node387
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.3
      description: You should separate the physical locations of information systems
        based on their importance, purpose, and characteristics.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node388
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node387
      description: For information systems such as personal data processing systems,
        network equipment, security systems, and backup equipment, use server racks
        to protect the systems from external threats.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node389
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node387
      description: For high-importance systems like personal data processing systems,
        install locking mechanisms on server racks and manage them in cages with additional
        physical security measures to restrict access to only essential personnel.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node390
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.3
      description: You should establish a means to easily verify the actual physical
        locations of information systems (e.g., layout diagrams, asset lists).
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node391
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node390
      description: Manage physical layout diagrams (facility cross-sections, layout
        diagrams, etc.) and asset lists to facilitate prompt action in case of security
        incidents or failures.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node392
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node390
      description: Include physical location information in asset lists and keep them
        updated to maintain the most current records.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node393
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.3
      description: You should protect power and communication cables from physical
        damage and electrical interference.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node394
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node393
      description: Implement measures such as physical separation and wiring, identification
        marking, maintaining distance to avoid mutual interference, and cable burial.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node395
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node393
      description: Restrict access to distribution panels, high-voltage rooms, low-voltage
        rooms, etc., to authorized personnel only.
      annotation: 'Key Points for Verification:

        - Are you segregating the physical locations of information systems based
        on their importance, purpose, and characteristics?

        - Have you established measures to easily verify the actual physical locations
        of information systems?

        - Are power and communication cables protected from physical damage and electrical
        interference from external sources?

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.4
      name: Operation of Protective Equipment
    - urn: urn:intuitem:risk:req_node:k_isms_p:node397
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.4
      description: For each protected area, based on its importance and characteristics,
        you must equip it with necessary facilities and establish and implement operational
        procedures to prepare for potential hazards such as fire, flooding, power
        failures, and other man-made or natural disasters.
      annotation: 'Key Points for Verification:

        - Have you equipped each protected area with necessary facilities and established
        operational procedures to prepare for potential hazards such as fire, flooding,
        and power failures, based on the importance and characteristics of the area?

        - If you outsource operations to an external data center (IDC), have you included
        physical protection requirements in the contract and are you periodically
        reviewing the operational status?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node398
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.4
      description: When outsourcing to an external data center (IDC), you must incorporate
        physical security requirements into the contract and regularly review the
        operational status.
      annotation: 'Key Points for Verification:

        - Have you equipped each protected area with necessary facilities and established
        operational procedures to prepare for potential hazards such as fire, flooding,
        and power failures, based on the importance and characteristics of the area?

        - If you outsource operations to an external data center (IDC), have you included
        physical protection requirements in the contract and are you periodically
        reviewing the operational status?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node399
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node398
      description: Ensure compliance with information security regulations, and apply
        physical security controls such as disaster and emergency preparedness (for
        fire, power failures, etc.), access control, asset entry and exit control,
        and video surveillance. Also, address issues related to damage compensation
        in case of incidents.
      annotation: 'Key Points for Verification:

        - Have you equipped each protected area with necessary facilities and established
        operational procedures to prepare for potential hazards such as fire, flooding,
        and power failures, based on the importance and characteristics of the area?

        - If you outsource operations to an external data center (IDC), have you included
        physical protection requirements in the contract and are you periodically
        reviewing the operational status?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node400
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node398
      description: Verify whether the IDC has liability insurance (failure to have
        insurance may result in a fine of up to 2 million won).
      annotation: 'Key Points for Verification:

        - Have you equipped each protected area with necessary facilities and established
        operational procedures to prepare for potential hazards such as fire, flooding,
        and power failures, based on the importance and characteristics of the area?

        - If you outsource operations to an external data center (IDC), have you included
        physical protection requirements in the contract and are you periodically
        reviewing the operational status?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.5
      name: Operations in Protected Areas
    - urn: urn:intuitem:risk:req_node:k_isms_p:node402
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.5
      description: Official work request and execution procedures must be established
        and implemented for situations requiring work within protected areas, such
        as the introduction or maintenance of information systems.
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node403
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node402
      description: When performing work in controlled areas, procedures such as work
        requests, approvals, and recording work details must be followed.
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node404
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node402
      description: Record details such as the date and time of work, purpose and content
        of the work, the name of the contractor and responsible personnel, and the
        names of reviewers and approvers.
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node405
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node402
      description: Establish procedures for accessing protected areas for work, ensure
        traceability of work details, and implement monitoring measures.
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node406
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.5
      description: Work records must be periodically reviewed to verify whether work
        within protected areas was appropriately conducted according to control procedures.
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node407
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node406
      description: Regularly review pre-approval details, access records, and work
        logs.
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node408
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node406
      description: Ensure consistency between access requests and access details (logbook,
        system logs, etc.)
      annotation: 'Key Points for Verification:

        - Have official work request and execution procedures been established and
        implemented for situations requiring work within protected areas, such as
        information system installation and maintenance?

        - To verify whether work within protected areas has been appropriately conducted
        according to control procedures, are work records being reviewed periodically?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.6
      name: Control of Equipment Exit and Entry
    - urn: urn:intuitem:risk:req_node:k_isms_p:node410
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.6
      description: When bringing in or taking out information systems, mobile devices,
        storage media, etc., into or out of protected areas, control procedures must
        be established and implemented to prevent security incidents such as information
        leakage or malware infection.
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node411
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node410
      description: Information systems (servers, network equipment, etc.), mobile
        devices (laptops, smart pads, smartphones, etc.), storage media (HDD, SSD,
        USB memory, external hard disks, CD/DVD, tapes, etc.).
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node412
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node410
      description: Prior approval from the responsible person for access control to
        the protected area, recording in the access control log, performing security
        checks on devices (such as checking for antivirus installation, security updates,
        malware infection, security sticker attachment, and any information leakage),
        and periodic review of entry and exit records.
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node413
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node410
      description: Exception request and approval, recording in the access control
        log, etc.
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node414
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.6
      description: Records of the entry and exit control procedures must be maintained
        and managed, and the compliance with these procedures should be verified by
        regularly checking the entry and exit logs.
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node415
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node414
      description: Maintain records of entry and exit history within protected areas
        (e.g., entry and exit logs, access control system logs, etc.).
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node416
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.6
      description: Regularly review entry and exit logs to ensure that entries and
        exits within the protected areas are appropriately conducted in accordance
        with control procedures.
      annotation: 'Key Points for Verification:

        - Have control procedures been established and implemented to prevent security
        incidents such as information leakage or malware infection when bringing in
        or taking out information systems, mobile devices, storage media, etc., into
        or out of protected areas?

        - Are records being maintained and managed according to the control procedures
        for bringing in and out these items, and is there a periodic review of the
        entry and exit history to verify compliance with these procedures?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.4.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4
      ref_id: 2.4.7
      name: Security of the Work Environment
    - urn: urn:intuitem:risk:req_node:k_isms_p:node418
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.7
      description: Protection measures must be established and implemented for facilities
        and office equipment used in common, such as document storage rooms, shared
        PCs, multifunction printers, and file servers.
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node419
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node418
      description: 'Document storage room: Minimize the number of people with access,
        assign access rights based on department and job, manage access history.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node420
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node418
      description: 'Shared PC: Assign a responsible person, set a screen saver, configure
        login passwords, regularly change passwords, limit storage of important information,
        install antivirus software, apply security updates, etc.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node421
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node418
      description: 'Shared office equipment: Prohibit leaving important documents
        unattended near shared office equipment like fax machines, copiers, and printers.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node422
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node418
      description: 'File server: Assign access rights based on department and job,
        minimize unnecessary information disclosure, issue user accounts per individual.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node423
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node418
      description: 'Shared office space: Prohibit leaving important information (personal
        information) documents unattended in shared office spaces such as meeting
        rooms or project rooms.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node424
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node418
      description: 'Other: Establish protection measures for other shared work environments.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node425
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.7
      description: ' Protection measures must be established and implemented to prevent
        the leakage or exposure of personal information and important information
        through personal work environments, such as work PCs, desks, and drawers.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node426
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node425
      description: 'Protection when leaving the workstation: Prohibit leaving personal
        information and documents containing personal information or auxiliary storage
        media unattended (clean desk policy), set screen savers and passwords, etc.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node427
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node425
      description: Prohibit exposure of login information (e.g., passwords) on monitors
        and desks
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node428
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node425
      description: Store documents and external storage devices containing personal
        or sensitive information in a secure location with a lock.
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node429
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node425
      description: Shred documents containing personal and important information using
        a shredder to prevent recovery.
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node430
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node425
      description: Take measures to prevent unauthorized individuals from accessing
        and tampering with management terminals.
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node431
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.7
      description: ' Necessary protection measures must be implemented to prevent
        the loss, theft, or leakage of personal information included in printed materials
        or copies and to safely manage these printed materials and copies.'
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node432
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.4.7
      description: 'Compliance with information protection measures in personal and
        shared work environments must be regularly reviewed. '
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node433
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node432
      description: Non-compliance with security regulations in personal and shared
        work environments should be managed according to disciplinary regulations.
      annotation: 'Key Points for Verification:

        - Are protection measures established and implemented for facilities and office
        equipment used in common, such as document storage rooms, shared PCs, multifunction
        printers, and file servers?

        - Have protection measures been established and implemented to prevent the
        leakage or exposure of personal and important information through personal
        work environments, such as work PCs, desks, and drawers?

        - Are necessary protection measures in place to safely manage printed or copied
        materials containing personal information, such as paper documents?

        - Is compliance with information protection regularly reviewed in both personal
        and shared work environments?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.5'
      name: Authentication and Access Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      ref_id: 2.5.1
      name: User Account Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node436
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.1
      description: 'To control unauthorized access to information systems and personal
        or sensitive information, formal procedures for the registration, modification,
        deletion, and termination of user accounts and access rights should be established
        and implemented, considering the following:'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node437
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node436
      description: 'Issuance of Unique User Accounts: Each user and personal information
        handler should be issued a unique user account, and account sharing should
        be prohibited.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node438
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node436
      description: 'Appropriate Review Procedures: When issuing or modifying accounts
        and access rights, ensure proper approval procedures and appropriateness reviews
        are in place.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node439
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node436
      description: 'Access Rights Adjustments: Change or revoke access rights promptly
        in the event of personnel transfers, resignations, or other HR movements (including
        account deletion or deactivation).'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node440
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node436
      description: 'Default and Test Accounts: After installing information systems,
        remove or change default and test accounts provided by manufacturers or vendors
        to obscure or difficult-to-guess credentials.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node441
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node436
      description: 'Record Maintenance: Maintain and manage records related to the
        registration, modification, deletion, and termination of user accounts and
        access rights.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node442
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.1
      description: 'When creating, registering, or modifying user accounts and access
        rights for information systems and personal or sensitive information, only
        the minimum necessary permissions required for the job should be granted according
        to a role-based access control system:'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node443
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node442
      description: 'Role-Based Permissions: Grant access rights based on job requirements,
        with differential access based on the necessity to perform specific duties.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node444
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node442
      description: 'Need-to-Know and Need-to-Do Principles: Grant access to important
        information and personal data strictly based on the need-to-know and need-to-do
        principles.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node445
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node442
      description: 'Segmentation of Rights: Avoid unnecessary or excessive access
        to important or personal information by implementing granular permission settings.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node446
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node442
      description: 'Approval Procedures: Ensure appropriateness reviews through approval
        procedures when granting or modifying access rights.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node447
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.1
      description: When granting user accounts and access rights, it must be clearly
        communicated that the individual is responsible for the security of their
        account.
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node448
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node447
      description: 'Documentation of Responsibility: Clearly specify the responsibilities
        and obligations related to the account in information security and privacy
        policies, agreements, or declarations. This includes prohibiting sharing or
        lending accounts and passwords to others and providing guidelines for secure
        login practices in public places.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node449
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node447
      description: 'Communication Methods: Utilize various methods to communicate
        these responsibilities, such as agreements, emails, system notifications,
        and training sessions.'
      annotation: 'Key Points for Verification:

        - Are formal procedures established and implemented for the registration,
        modification, and deletion of user accounts and access rights to information
        systems, personal information, and sensitive information?

        - When creating or modifying user accounts and access rights to information
        systems and personal or sensitive information, are only the minimum necessary
        permissions required for the job assigned according to the role-based access
        control system?

        - When granting accounts and access rights to users, is there a clear communication
        that the security responsibility for the account lies with the user?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      ref_id: 2.5.2
      name: User Identification
    - urn: urn:intuitem:risk:req_node:k_isms_p:node451
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.2
      description: When registering users for information systems and personal data
        processing systems, unique identifiers must be assigned to each user and personal
        data handler, and the use of guessable identifiers must be restricted.
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node452
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node451
      description: 'One User, One Account Principle: Ensure accountability by issuing
        a unique account to each user.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node453
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node451
      description: 'Account Sharing and Public Account Restrictions: Limit the sharing
        of accounts and the use of public accounts.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node454
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node451
      description: 'Operating Accounts: Restrict general user access to system operating
        accounts.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node455
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node451
      description: 'Default Accounts: After system installation, remove or change
        default and test accounts from manufacturers or vendors to non-guessable identifiers
        (including changing default passwords).'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node456
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node451
      description: 'Administrator Accounts: Restrict the use of easily guessable identifiers
        (e.g., root, admin, administrator) for administrative and special privilege
        accounts.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node457
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.2
      description: If sharing the same identifier is unavoidable for business reasons,
        the reasons and validity must be reviewed and approved by the responsible
        party.
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node458
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node457
      description: 'Role Separation: Even if administrator accounts are shared due
        to role division, assign separate user accounts and log in with the user account
        before switching to the administrator account.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node459
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node457
      description: 'Temporary Account Sharing: If accounts are temporarily shared
        for maintenance or similar tasks, change the password immediately after the
        task is completed.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node460
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node457
      description: 'Public Accounts: If the use of public accounts is necessary for
        business reasons, review and approve the reasons and validity, and implement
        additional control measures to ensure accountability.'
      annotation: 'Key Points for Verification:

        - Are unique identifiers assigned to users and personal data handlers in information
        systems and personal data processing systems, and is the use of guessable
        identifiers restricted?

        - If there are unavoidable reasons for sharing the same identifier, are the
        reasons and validity reviewed, and are corrective measures put in place with
        the approval of the responsible party?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      ref_id: 2.5.3
      name: User Authentication
    - urn: urn:intuitem:risk:req_node:k_isms_p:node462
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.3
      description: Access to information systems and personal data processing systems
        must be controlled according to secure user authentication procedures, including
        user authentication, login attempt limits, and warnings for illegal login
        attempts.
      annotation: 'Key Points for Verification:

        - Is access to information systems and personal data processing systems controlled
        according to secure user authentication procedures, including user authentication,
        login attempt limits, and warnings for illegal login attempts?

        - When accessing personal data processing systems from external networks,
        are secure authentication methods or secure access methods applied in accordance
        with legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node463
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node462
      description: Examples of user authentication methods
      annotation: ' You can find it page 95'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node464
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node462
      description: Examples of measures to control account misuse and unauthorized
        authentication attempts
      annotation: ' You can find it page 96'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node465
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node462
      description: When using Single Sign-On (SSO) to provide convenience in business
        operations, additional protective measures should be implemented due to the
        potential for increased damage in the event of account theft. Based on a risk
        assessment, enhanced authentication methods and re-authentication requirements
        for access to critical systems should be applied.
      annotation: 'Key Points for Verification:

        - Is access to information systems and personal data processing systems controlled
        according to secure user authentication procedures, including user authentication,
        login attempt limits, and warnings for illegal login attempts?

        - When accessing personal data processing systems from external networks,
        are secure authentication methods or secure access methods applied in accordance
        with legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node466
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.3
      description: When accessing personal data processing systems from outside through
        information communication networks such as the internet, secure authentication
        methods must be applied in accordance with legal requirements. For personal
        data processing systems that handle data from information subjects rather
        than users, secure access methods or authentication methods such as Virtual
        Private Networks (VPNs) can be used.
      annotation: 'Key Points for Verification:

        - Is access to information systems and personal data processing systems controlled
        according to secure user authentication procedures, including user authentication,
        login attempt limits, and warnings for illegal login attempts?

        - When accessing personal data processing systems from external networks,
        are secure authentication methods or secure access methods applied in accordance
        with legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node467
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node466
      description: Secure authentication methods refer to procedures beyond entering
        user accounts and passwords to identify and authenticate legitimate personal
        data handlers.
      annotation: 'Key Points for Verification:

        - Is access to information systems and personal data processing systems controlled
        according to secure user authentication procedures, including user authentication,
        login attempt limits, and warnings for illegal login attempts?

        - When accessing personal data processing systems from external networks,
        are secure authentication methods or secure access methods applied in accordance
        with legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node468
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node466
      description: Examples of secure authentication methods include certificates,
        security tokens, and one-time passwords (OTPs).
      annotation: ' You can find it page 96'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node469
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node466
      description: Personal data handlers must comply with legal requirements related
        to authentication methods when accessing personal data processing systems
        from external networks.
      annotation: 'Key Points for Verification:

        - Is access to information systems and personal data processing systems controlled
        according to secure user authentication procedures, including user authentication,
        login attempt limits, and warnings for illegal login attempts?

        - When accessing personal data processing systems from external networks,
        are secure authentication methods or secure access methods applied in accordance
        with legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      ref_id: 2.5.4
      name: Password Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node471
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.4
      description: You must establish and implement password management procedures
        and creation rules to ensure that users and administrators set and use secure
        passwords.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node472
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node471
      description: 'Examples of password creation rules (enforced systemically except
        in unavoidable cases):'
      annotation: ' You can find it page 98'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node473
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node471
      description: Examples of Password Management Procedures
      annotation: ' You can find it page 98'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node474
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.4
      description: Password rules must be established and enforced to ensure that
        users set and use secure passwords.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node475
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node474
      description: Follow guidelines for user and personal data handler passwords,
        but adjust rules based on the service's characteristics and risk level.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node476
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node474
      description: Implement secure procedures for password recovery in case of loss
        or theft, including identity verification.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node477
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.4
      description: Authentication methods for personal data handlers or users must
        be applied and managed securely.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node478
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node477
      description: When using passwords, establish and apply secure password rules.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node479
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node477
      description: For other authentication methods (e.g., certificates, PINs, biometrics,
        security tokens), implement protective measures to prevent unauthorized access
        or theft.
      annotation: 'Key Points for Verification:

        - Have you established and implemented secure user password management procedures
        and creation rules for information systems?

        - Have you established and implemented password creation rules to ensure that
        data subjects (users) can use secure passwords?

        - Are you securely applying and managing authentication methods for personal
        data handlers or data subjects?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      ref_id: 2.5.5
      name: Management of Special Accounts and Permissions
    - urn: urn:intuitem:risk:req_node:k_isms_p:node481
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.5
      description: Administrative and other special privileges should be granted only
        to the minimum number of individuals necessary. Formal authorization and approval
        procedures must be established and implemented.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node482
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node481
      description: Define account and privilege types for special purposes such as
        information system management, personal data management, and important information
        management.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node483
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node481
      description: Establish and enforce procedures for issuing, changing, and revoking
        special accounts and privileges, ensuring that applications and approvals
        follow formal procedures.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node484
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node481
      description: Apply stricter criteria for granting special accounts and privileges
        compared to general user accounts and privileges (e.g., requiring approval
        from executives or security officers).
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node485
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.5
      description: Establish and enforce control procedures to identify and manage
        special accounts and privileges, maintaining a separate list.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node486
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node485
      description: Create and manage a list of individuals with special privileges.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node487
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node485
      description: Minimize exceptions and enhance monitoring for individuals with
        special privileges.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node488
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node485
      description: Apply procedures to create special privileges for external parties
        (e.g., for system maintenance) only when necessary and promptly delete or
        suspend them after the work is completed.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node489
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node485
      description: Regularly review the status of special privilege holders to keep
        the list current.
      annotation: 'Key Points for Verification:

        - Are formal authorization and approval procedures established and enforced
        to ensure that special privileges, such as administrative rights, are granted
        only to the minimum number of individuals necessary?

        - Are accounts and privileges granted for special purposes identified and
        managed through a separate list, with control procedures in place?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.5.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5
      ref_id: 2.5.6
      name: Access Rights Review
    - urn: urn:intuitem:risk:req_node:k_isms_p:node491
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.6
      description: Records must be maintained for the creation, registration, granting,
        use, modification, and revocation of user accounts and access rights related
        to information systems, personal data, and critical information.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node492
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node491
      description: 'User account and access rights details should include all necessary
        information to ensure accountability:'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node493
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node492
      description: 'Account/Access Rights Application Information: Applicant or proxy,
        application date and time, purpose of application, usage period, etc.'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node494
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node492
      description: 'Account/Access Rights Approval Information: Approver, approval
        or denial status, reasons, and date/time, etc.'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node495
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node492
      description: 'Account/Access Rights Registration Information: Registrant, registration
        date, registration method (e.g., system integration, manual registration,
        etc.)'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node496
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node492
      description: 'Account/Access Rights Information: Target system name, access
        rights name, details of rights, etc.'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node497
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node491
      description: 'Access rights records should be retained for a period reflecting
        legal requirements:'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node498
      assessable: false
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node497
      description: 'For personal data processors under the "Personal Information Protection
        Act": at least 3 years.'
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node499
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.6
      description: Criteria, responsible parties, methods, and frequency for assessing
        the appropriateness of user accounts and access rights to information systems,
        personal data, and critical information must be established, and regular reviews
        must be conducted.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node500
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node499
      description: Establish review procedures for access rights, including review
        parties, methods, criteria, frequency (recommended at least quarterly), and
        reporting results.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node501
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.5.6
      description: If issues such as excessive access rights, non-compliance with
        authorization procedures, or misuse of rights are found during access rights
        reviews, procedures for addressing these issues must be established and implemented.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node502
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node501
      description: Establish and implement procedures that include requesting explanations,
        analyzing causes, developing corrective measures, and reporting systems if
        suspicious situations such as excessive rights, procedural non-compliance,
        or misuse are detected.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node503
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node501
      description: Notify users and relevant parties of any changes applied to access
        rights after the review.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node504
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node501
      description: If similar issues recur, analyze the root cause and establish measures
        to prevent recurrence.
      annotation: 'Key Points for Verification:

        - Are records maintained for the creation, registration, granting, use, modification,
        and revocation of user accounts and access rights related to information systems,
        personal data, and critical information?

        - Have criteria, review parties, methods, and frequencies for assessing the
        appropriateness of user accounts and access rights to information systems,
        personal data, and critical information been established, and is regular review
        being carried out?

        - If issues such as excessive access rights, non-compliance with authorization
        procedures, or misuse of privileges are identified during access rights reviews,
        have corrective action procedures been established and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.6'
      name: 'Access Control

        '
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.1
      name: Network Access
    - urn: urn:intuitem:risk:req_node:k_isms_p:node507
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.1
      description: Organizations must establish and implement network access control
        management procedures to identify all pathways that can access the organization's
        network and effectively prevent and respond to related risks such as unauthorized
        access to the network.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node508
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node507
      description: Control the use of unauthorized IPs by assigning IP addresses to
        information systems, personal information processing systems, PCs, etc., following
        an approval process.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node509
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node507
      description: Control unauthorized individuals and devices from accessing the
        internal network.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node510
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node507
      description: Block unnecessary services and ports installed on network equipment.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node511
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.1
      description: The network must be segmented physically or logically based on
        the importance of services, user groups, information assets, and legal requirements,
        with access control applied between these segments.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node512
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node511
      description: Determine the level of network segmentation and access control
        between areas of critical business operations through risk assessment.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node513
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node511
      description: ' Network segments separated by access control policies must be
        controlled so that only services necessary for business operations are allowed
        to access them. This can be achieved using intrusion prevention systems, network
        equipment ACLs, and similar measures.'
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node514
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.1
      description: Organizations must establish IP address assignment standards for
        different network segments and ensure that important systems, such as database
        servers, that do not need to connect to external networks are assigned private
        IP addresses to prevent direct external access.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node515
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node514
      description: Keep the IP address allocation status up to date and manage it
        securely with a confidentiality level of at least "confidential" to prevent
        external leaks.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node516
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node514
      description: Use a private IP address scheme within the internal network and
        apply NAT (Network Address Translation) to prevent the internal address scheme
        from being exposed externally.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node517
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node514
      description: When assigning private IP addresses, use private IP address ranges
        in accordance with international standards.
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node518
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.1
      description: Organizations must establish a secure connection environment when
        connecting networks with physically separate locations such as IDCs, branches,
        agencies, partners, and customer centers by using dedicated lines or VPNs
        (Virtual Private Networks).
      annotation: 'Key Points for Verification:

        - Have all the pathways that can access the organization''s network been identified,
        and is access to the internal network controlled so that only authorized users
        can access it according to the access control policy?

        - Is the network segmented physically or logically based on the importance
        of services, user groups, information assets, and legal requirements, and
        is access control applied between these segments?

        - Have criteria been established for assigning IP addresses by network segment,
        and are measures being implemented, such as assigning private IPs to database
        servers that do not require external connections?

        - Are protection measures in place for transmission sections when connecting
        networks to physically separated locations such as IDC (Internet Data Center),
        branches, or agencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.2
      name: Information System Access
    - urn: urn:intuitem:risk:req_node:k_isms_p:node520
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.2
      description: Access to the operating systems (OS) of information systems such
        as servers, network systems, and security systems must be controlled by defining
        authorized users, accessible locations, and access methods.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node521
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Establish procedures for account and permission requests and approvals.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node522
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Assign individual accounts to each user and restrict the use of
        shared accounts.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node523
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Regularly review and update account usage, including checking for
        long-term inactive accounts and unnecessary accounts.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node524
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Restrict access locations by limiting the IP addresses of users.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node525
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Consider enhanced authentication methods for administrators and
        other users with special privileges, such as certificates or OTP (One-Time
        Password).
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node526
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Apply secure access methods such as SSH and SFTP.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node527
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node520
      description: Implement access control measures for connections between servers
        within the same network segment.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node528
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.2
      description: If no work is performed for a certain period after accessing the
        information system, measures must be taken to automatically disconnect the
        session.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node529
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node528
      description: Set session timeout duration based on server characteristics, work
        environment, risk level, and legal requirements.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node530
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.2
      description: Services or ports that are unrelated to the intended purpose of
        the information system or that could cause security incidents must be identified
        and removed or blocked.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node531
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node530
      description: Implement additional security features for insecure services, protocols,
        and daemons.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node532
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node530
      description: Restrict the use of insecure services or protocols such as Netbios,
        File-Sharing, Telnet, and FTP unless absolutely necessary, and use secure
        technologies like SSH, SFTP, or IPSec VPN.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node533
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.2
      description: Servers that provide key services must be operated on independent
        servers.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node534
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node533
      description: Web servers, database servers, and applications that provide direct
        services to external users or store and process sensitive information must
        be operated on independent servers, not shared equipment.
      annotation: 'Key Points for Verification:

        - Is access to operating systems (OS) for information systems such as servers,
        network systems, and security systems controlled by defining authorized users,
        accessible locations, and access methods?

        - Is the system automatically disconnected after a certain period of inactivity
        following a connection to the information system?

        - Are services unrelated to the intended purpose of the information system
        removed?

        - Are information systems that provide key services operated on separate servers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.3
      name: Application Access
    - urn: urn:intuitem:risk:req_node:k_isms_p:node536
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.3
      description: ' To control access to sensitive information, access rights to
        applications must be differentiated according to the user''s job function.'
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node537
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node536
      description: Clearly identify internal applications (e.g., back-office systems,
        member management systems).
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node538
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node536
      description: Identify personal information processing systems within the applications.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node539
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node536
      description: Establish a user and personal information handler access rights
        classification system (e.g., an access rights classification table) based
        on the principle of least privilege.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node540
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node536
      description: Implement application features that allow detailed configuration
        of permissions for processing sensitive information and personal data (e.g.,
        input, view, modify, delete, download, print).
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node541
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node536
      description: Establish and enforce procedures for granting, modifying, and deleting
        accounts and permissions for identified applications and personal information
        processing systems.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node542
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node536
      description: Maintain records of permission grants, modifications, and deletions
        to review the validity of access rights.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node543
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.3
      description: Sessions without input for a certain period must be automatically
        terminated, and the number of simultaneous sessions for the same user must
        be limited.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node544
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node543
      description: Determine and apply session timeout settings considering the characteristics
        and risk levels of each application and task.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node545
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node543
      description: For personal information processing systems, ensure that sessions
        are automatically terminated if there is no activity for a specified period,
        in accordance with legal requirements.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node546
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node543
      description: Display warning messages and restrict access when there is a simultaneous
        login attempt with the same account.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node547
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.3
      description: Administrator-only applications (e.g., admin web pages, management
        consoles) must be controlled to prevent unauthorized access.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node548
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node547
      description: Block external access to administrator-only applications and implement
        access restrictions based on IP addresses.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node549
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node547
      description: If external access is unavoidable, apply secure authentication
        methods (e.g., OTP) or secure connection methods (e.g., VPN).
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node550
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node547
      description: Regularly monitor access logs and event logs for administrators
        and personal information handlers.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node551
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node547
      description: When detecting suspicious activity, conduct a detailed investigation
        and follow predefined procedures, including internal reporting.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node552
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.3
      description: To ensure consistency in the application of measures limiting the
        display of personal and sensitive information, related standards must be established
        and applied.
      annotation: 'Examples of standards for limiting the display of personal and
        sensitive information:

        Name: Mask the middle character(s) of the name (for two-character names, mask
        the last character; for names with four or more characters, mask all but the
        first and last characters).

        Resident registration number: Mask the last 7 digits of the 13-digit number.

        Phone number, mobile number: Mask the area code.

        Address: Mask the building number and detailed address numbers below the street
        name.

        Email address: Mask all but the first two characters of the ID.

        Card number: Mask six digits starting from the seventh digit.

        IP address: Mask bits 17-24 (IPv4) or bits 113-128 (IPv6), etc.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node553
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.3
      description: ' Applications must be designed and operated to minimize unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading).'
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node554
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node553
      description: When printing or displaying personal and sensitive information
        (e.g., on screen, in downloads) through applications (such as personal information
        processing systems), specify the purpose and minimize the output items based
        on that purpose.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node555
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node553
      description: Ensure that, depending on the work environment, purpose, type,
        and location, only the minimum necessary personal information is output within
        the scope of access rights to the personal information processing system.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node556
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node553
      description: Prevent 'like' searches of personal information unless absolutely
        necessary for business purposes.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node557
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node553
      description: When searching for personal information, ensure that unnecessary
        or excessive information is not displayed by using exact match (equal search)
        or multiple search criteria.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node558
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node553
      description: Take measures to ensure that personal information is not stored
        in hidden fields within office files (such as Excel)
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node559
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node553
      description: Ensure that unnecessary personal information is not displayed through
        actions like viewing the webpage source.
      annotation: 'Key Points for Verification:

        - To control access to sensitive information, are access rights to applications
        differentiated according to the user''s job function?

        - Is the system configured to automatically terminate sessions after a period
        of inactivity, and limit the number of concurrent sessions for the same user?

        - Are access controls in place to ensure that administrative applications
        (such as admin web pages or management consoles) are inaccessible to unauthorized
        users?

        - Have relevant standards been established and applied to ensure consistency
        in protection measures for displaying personal and sensitive information?

        - Are applications designed and operated in a way that minimizes unnecessary
        exposure of personal and sensitive information (e.g., viewing, screen display,
        printing, downloading, etc.)?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.4
      name: Database Access
    - urn: urn:intuitem:risk:req_node:k_isms_p:node561
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.4
      description: You must identify and continuously update the information being
        stored and managed, such as the list of tables in the database.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node562
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node561
      description: Identify the list of tables used in the database, the information
        stored, and their relationships.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node563
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node561
      description: Identify the storage locations (database and table names, column
        names) and status (number of records, encryption status) of critical and personal
        information.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node564
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node561
      description: Regularly review and update the database status.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node565
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.4
      description: You must clearly identify the applications, information systems
        (servers), and users that need access to information within the database and
        control access according to the access control policy.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node566
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Establish and implement access control policies for database access
        rights, distinguishing between administrators (DBAs) and users (e.g., access
        control at the table, view, column, and query levels based on the principle
        of least privilege).
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node567
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Restrict access to tables and columns containing critical information
        to authorized personnel only.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node568
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Differentiate accounts with DBA privileges from those with other
        privileges such as read-only access.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node569
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Limit the shared use of accounts between applications and users.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node570
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Restrict executable commands by account.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node571
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Delete unused accounts, test accounts, and default accounts.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node572
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Automatically block access if no activity is performed for a specified
        period.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node573
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Restrict unauthorized access to the database.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node574
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Ensure that databases storing personal information are not located
        on publicly exposed networks such as DMZs.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node575
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Block unauthorized access from other network zones and servers.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node576
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Restrict IP addresses, ports, and applications that are allowed
        to access the database.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node577
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node565
      description: Ensure that general users can access the database only through
        authorized applications.
      annotation: 'Key Points for Verification:

        - Are you identifying the information being stored and managed, such as the
        list of tables in the database?

        - Are you clearly identifying the applications, information systems (servers),
        and users that need access to information within the database, and are you
        controlling access according to the access control policy?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.5
      name: Wireless Network Access
    - urn: urn:intuitem:risk:req_node:k_isms_p:node579
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.5
      description: 'If wireless networks are used for business purposes, you must
        establish and implement protection measures considering the following aspects
        for securing wireless access points (APs) and network segments:'
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node580
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node579
      description: Manage a list of wireless network devices (e.g., APs).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node581
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node579
      description: Configure encryption for user authentication and data transmission
        (e.g., WPA2-Enterprise mode, WPA3-Enterprise mode).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node582
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node579
      description: Implement wireless AP access terminal authentication methods (e.g.,
        MAC authentication).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node583
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node579
      description: Enable SSID hiding.
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node584
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node579
      description: Set up Access Control Lists (ACLs) for the wireless network.
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node585
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node579
      description: Control administrator access to wireless APs (e.g., IP restrictions).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node586
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.5
      description: 'You must establish and implement procedures for access requests
        and termination to ensure that only authorized employees can use the wireless
        network:'
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node587
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node586
      description: Set up procedures for requesting and approving wireless network
        access (e.g., user and device registration).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node588
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node586
      description: Establish procedures for revoking access when the wireless network
        is no longer needed (e.g., due to retirement or expiration of access).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node589
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node586
      description: Separate wireless networks provided to external parties from those
        used by employees.
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node590
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.5
      description: 'You must establish and implement protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs:'
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node591
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node590
      description: Install and operate a Wireless Intrusion Prevention System (WIPS),
        and periodically check for unauthorized APs (Rogue APs).
      annotation: 'Key Points for Verification:

        - If wireless networks are used for business purposes, have you established
        and implemented protection measures such as authentication and data encryption
        for wireless access points (APs) and network segments?

        - Have you established and implemented procedures for the application and
        termination of wireless network access so that only authorized employees can
        use it?

        - Have you established and implemented protection measures against unauthorized
        wireless networks, such as detecting and blocking ad hoc connections and unauthorized
        wireless APs within the organization?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.6
      name: Remote Access Control
    - urn: urn:intuitem:risk:req_node:k_isms_p:node593
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.6
      description: 'The remote operation of critical information (personal information),
        information systems, and major assets related to personal information processing
        systems (servers, network equipment, security devices, etc.) through external
        networks such as the internet is generally prohibited. If it is unavoidably
        allowed, the following measures must be established and implemented:'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node594
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Approval from the responsible person for remote operation and access.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node595
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Use of secure authentication methods (certificates, OTPs, etc.).
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node596
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Use of secure access methods (VPNs, etc.).
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node597
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Temporary access rights provisioning and management of access rights
        status.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node598
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Security of access devices through antivirus installation, security
        patches, etc.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node599
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Monitoring of remote operation status (e.g., periodic review of
        VPN account issuance and usage).
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node600
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Logging and periodic analysis of remote access records.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node601
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node593
      description: Security awareness training related to remote operation.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node602
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.6
      description: When operating information systems remotely through an internal
        network, access must be restricted to specific devices only.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node603
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node602
      description: Limit accessible devices by IP address, MAC address, etc.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node604
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node602
      description: Block access paths that bypass normal remote access routes.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node605
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.6
      description: 'For remote work scenarios such as telecommuting, remote collaboration,
        and smart work, protective measures must be established and implemented to
        prevent the leakage of critical information, hacking, and other security incidents:'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node606
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node605
      description: 'Define smart work scenarios: telecommuting, smart work centers,
        remote collaboration, mobile office environments.'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node607
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node605
      description: 'Set permissions based on smart work scenarios: define the scope
        of remote access to internal systems and services.'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node608
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node605
      description: 'Approval process for smart work: application, approval, and revocation
        of remote access rights for smart work.'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node609
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node605
      description: 'Technical protection measures for remote access: encryption of
        transmission channels (VPNs, etc.), enhanced user authentication (OTPs, etc.).'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node610
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node605
      description: 'Security of access devices (PCs, mobile devices, etc.): installation
        of antivirus software, application of security patches, device authentication,
        measures for lost or stolen devices (reporting procedures, device locking,
        deletion of critical information, etc.), prohibition of storing critical information
        (encryption if necessary), etc.'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node611
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node605
      description: Establish and educate on information protection guidelines for
        the smart work environment.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node612
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.6
      description: 'For devices (management devices or critical devices) accessing
        the personal information processing system remotely for management, operation,
        development, and security purposes, the following protective measures must
        be applied:'
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node613
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node612
      description: Designate and manage a list of management devices.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node614
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node612
      description: Prevent unauthorized individuals from accessing and tampering with
        management devices.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node615
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node612
      description: Restrict access to only the registered management devices.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node616
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node612
      description: Ensure devices are not used for purposes other than their intended
        use.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node617
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node612
      description: Apply protective measures to management devices to prevent malware
        infections, etc.
      annotation: 'Key Points for Verification:

        - Remote operation of information systems through external networks such as
        the internet is generally prohibited. If it is unavoidably allowed for reasons
        such as dealing with system failures, are appropriate protective measures
        in place?

        - When operating information systems remotely via internal networks, is access
        restricted to specific devices only?

        - For remote work scenarios such as telecommuting, remote collaboration, and
        smart work, have you established and implemented protective measures to prevent
        information leaks, hacking, and other security incidents?

        - For remote access to personal information processing systems for management,
        operation, development, or security purposes, are the devices designated as
        management devices and are safety measures such as prohibiting unauthorized
        modifications and use for unintended purposes applied?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.6.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6
      ref_id: 2.6.7
      name: Internet Access Control
    - urn: urn:intuitem:risk:req_node:k_isms_p:node619
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.7
      description: To appropriately reduce risks such as information leakage, malware
        infection, and internal network breaches via the internet, control policies
        for internet access on work PCs, including those used for major job functions
        and handling personal information, must be established and implemented.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node620
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node619
      description: Network Configuration Policy for Internet Connections
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node621
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node619
      description: User Access Policy for External Email Use, Internet Site Access,
        Software Downloads, and Transfers
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node622
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node619
      description: Blocking Policy for Harmful Sites (such as adult content and entertainment)
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node623
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node619
      description: Blocking Policy for Sites with Potential for Information Leakage
        (such as web storage, P2P networks, remote access)
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node624
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node619
      description: Policies Related to Network Segregation or Internet Blocking Measures
        (whether network segregation is applied, target individuals for segregation,
        method of segregation, procedures for data transmission between networks,
        etc.)
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node625
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node619
      description: Monitoring Policy for Internet Access History
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node626
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.7
      description: Unnecessary external internet access from major information systems
        (such as database servers) must be controlled.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node627
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node626
      description: Limit external internet access from internal servers (DB servers,
        file servers, etc.) to prevent malware influx, information leakage, and reverse
        access.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node628
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node626
      description: If external access is unavoidable, conduct a risk analysis to establish
        protective measures and obtain approval from the responsible person before
        allowing access.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node629
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.7
      description: If internet network blocking is mandated by relevant laws, identify
        the subjects of internet network blocking and apply the blocking measures
        in a secure manner.
      annotation: 'Under the Personal Information Protection Act:

        - (Obligatory Targets for Personal Information Processors): Personal information
        processors with an average of more than 1 million users per day in the last
        three months of the previous year.

        - (Obligatory Targets for Computers, etc.): Computers and other devices used
        by personal information handlers that can download, destroy, or set access
        permissions for personal information.

        - (Measures When Using External Cloud Services) When using cloud computing
        services as defined in Article 2, Item 3 of the "Act on the Promotion of Cloud
        Computing and Protection of Users" to configure and operate personal information
        processing systems, internet access must be restricted to only the necessary
        cloud service, and all other internet access must be blocked.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node630
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.6.7
      description: 'Apply internet blocking measures in a secure manner considering
        the following:'
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node631
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node630
      description: Review whether internet blocking measures are mandatory and, if
        so, identify the subjects of the internet blocking measures.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node632
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node630
      description: If not subject to mandatory internet blocking, determine whether
        to apply internet blocking measures based on risk analysis results.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node633
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node630
      description: Apply internet blocking measures using physical methods (e.g.,
        configuring two PCs with separate networks) or logical methods (e.g., using
        virtualization technologies like VDI).
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node634
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node630
      description: Identify and control any bypass routes around internet blocking
        measures.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node635
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node630
      description: Establish control measures for secure data transmission for computers
        subject to internet blocking measures.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node636
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node630
      description: Conduct regular inspections of the adequacy and vulnerabilities
        of the internet blocking environment.
      annotation: 'Key Points for Verification:

        - Are control policies for internet access of key operational and personal
        information handling devices (work PCs) established and enforced?

        - Are unnecessary external internet connections from major information systems
        (such as DB servers) controlled?

        - If required by relevant laws to block internet access, are the affected
        parties identified and are internet access blocking measures applied in a
        secure manner?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.7
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.7'
      name: Encryption Application
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.7.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.7
      ref_id: 2.7.1
      name: Encryption Policy Application
    - urn: urn:intuitem:risk:req_node:k_isms_p:node639
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.7.1
      description: To protect personal and critical information, you must establish
        an encryption policy that includes legal requirements such as encryption targets,
        encryption strength, and encryption usage.
      annotation: 'Key Points for Verification:

        - To protect personal and critical information, have you established an encryption
        policy that includes legal requirements such as encryption targets, encryption
        strength, and usage?

        - In accordance with the encryption policy, are you performing encryption
        when storing, transmitting, or transferring personal and critical information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node640
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node639
      description: 'Encryption Targets: Defined based on legal requirements, sensitivity
        of the information being processed, and its importance.'
      annotation: You will find a table on page 121
    - urn: urn:intuitem:risk:req_node:k_isms_p:node641
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node639
      description: 'Encryption Algorithm: Select secure encryption algorithms and
        security strength based on legal requirements and other considerations.'
      annotation: You will find a table on page 122
    - urn: urn:intuitem:risk:req_node:k_isms_p:node642
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.7.1
      description: 'Encryption Policy Compliance: Encrypt personal and sensitive information
        during storage, transmission, and transfer according to the encryption policy.'
      annotation: 'Key Points for Verification:

        - To protect personal and critical information, have you established an encryption
        policy that includes legal requirements such as encryption targets, encryption
        strength, and usage?

        - In accordance with the encryption policy, are you performing encryption
        when storing, transmitting, or transferring personal and critical information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node643
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node642
      description: 'Encryption Method: Select and apply encryption methods considering
        the encryption location and system characteristics.'
      annotation: You will find a table on page 123
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.7.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.7
      ref_id: 2.7.2
      name: Encryption Key Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node645
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.7.2
      description: 'You must establish policies and procedures that include the following
        details for the generation, use, storage, distribution, and disposal of encryption
        keys:'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node646
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node645
      description: 'Encryption Key Management Personnel: Designation of individuals
        responsible for encryption key management.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node647
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node645
      description: 'Key Generation and Storage Methods: Methods for generating and
        storing encryption keys (including secure backup).'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node648
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node645
      description: 'Key Distribution and Recipients: Identification of those who receive
        encryption keys and the methods of distribution (including decryption authority).'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node649
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node645
      description: 'Key Validity and Rotation: Duration of key validity (rotation
        frequency), considering costs, business importance, and other factors when
        changing keys.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node650
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node645
      description: 'Key Recovery and Disposal Procedures: Procedures and methods for
        recovering and disposing of encryption keys.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node651
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node645
      description: 'Prohibition of Hardcoding Keys: Policies related to preventing
        the hardcoding of encryption keys in source code.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node652
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.7.2
      description: 'Secure Storage and Access Control for Encryption Keys: Encryption
        keys should be stored in a separate secure location to ensure they can be
        recovered if needed, and access to them should be minimized:'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node653
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node652
      description: 'Secure Storage: In case of damage, encryption keys should be stored
        on a separate medium and kept in a secure location (e.g., encryption key management
        systems, physically separated areas).'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node654
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node652
      description: 'Access Control: Minimize access to encryption keys and implement
        monitoring of access.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented procedures for the generation, use,
        storage, distribution, change, recovery, and disposal of encryption keys?

        - Are encryption keys stored in a separate secure location to ensure recoverability
        if needed, and is access to encryption key usage minimized?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.8'
      name: Information System Introduction and Development Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      ref_id: 2.8.1
      name: Definition of Security Requirements
    - urn: urn:intuitem:risk:req_node:k_isms_p:node657
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.1
      description: When introducing, developing, or changing an information system,
        you must establish and implement procedures to review and accept the system
        from the perspective of information security and privacy protection.
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node658
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node657
      description: 'Develop an introduction plan that includes feasibility analysis
        for new information systems (servers, network equipment, commercial software
        packages) and security systems:'
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node659
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node658
      description: Analysis of current system resource utilization, usage, and capacity
        limits
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node660
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node658
      description: Requirements for performance, stability, security, reliability,
        compatibility with existing systems, and interoperability
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node661
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node658
      description: Compliance with legal requirements such as the Personal Information
        Protection Act (including the standards for ensuring the safety of personal
        information) if the system involves personal data processing
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node662
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node657
      description: Incorporate information security and privacy protection requirements
        into the Request for Proposal (RFP) and use them as criteria when selecting
        vendors or products
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node663
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node657
      description: 'Establish criteria for determining system acceptance:'
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node664
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node663
      description: Develop acceptance criteria reflecting performance, security, and
        legal requirements defined in the introduction plan
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node665
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node663
      description: Ensure compliance with acceptance criteria during the system introduction
        process by reflecting them in purchase contracts
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node666
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.1
      description: When introducing, developing, or changing an information system,
        you must clearly define security requirements, including legal obligations
        and the latest vulnerabilities, and incorporate them from the design stage.
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node667
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node666
      description: 'Legal requirements related to personal data protection: access
        control, encryption, access logs, etc.'
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node668
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node666
      description: Information security and privacy protection requirements based
        on higher authority and internal regulations
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node669
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node666
      description: 'Technical security requirements: authentication, development security,
        etc.'
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node670
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node666
      description: Latest security vulnerabilities
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node671
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.1
      description: You must establish and apply coding standards for the secure implementation
        of information systems.
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node672
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node671
      description: Develop secure coding standards and guidelines to minimize threats
        from known technical security vulnerabilities
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node673
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node671
      description: Include all relevant development languages and environments such
        as Java, PHP, ASP, web, and mobile.
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node674
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node671
      description: Conduct training for developers on secure coding standards and
        guidelines.
      annotation: 'Key Points for Verification:

        - hen introducing, developing, or changing an information system, you must
        establish and implement procedures for reviewing and accepting the system
        from the perspective of information security and privacy protection.

        - When introducing, developing, or changing an information system, you must
        clearly define security requirements, including legal obligations and the
        latest vulnerabilities, and integrate these requirements from the design stage.

        - You must establish and apply coding standards to ensure the safe implementation
        of the information system.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      ref_id: 2.8.2
      name: Review and Testing of Security Requirements
    - urn: urn:intuitem:risk:req_node:k_isms_p:node676
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.2
      description: When introducing, developing, or changing information systems,
        establish review criteria and procedures to verify that the security requirements
        defined during the analysis and design phases are effectively applied, and
        conduct tests accordingly.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node677
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node676
      description: Perform tests to ensure that the system meets pre-defined security
        requirements before acceptance.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node678
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node677
      description: Establish acceptance criteria and procedures to verify that the
        information system meets pre-defined security requirements for development,
        changes, and deployment.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node679
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node677
      description: Confirm compliance with the pre-defined acceptance criteria through
        tests before deciding on acceptance.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node680
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node677
      description: Check system security settings, removal of unnecessary default
        accounts, and application of the latest security patches.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node681
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node676
      description: Conduct tests to ensure that developed and changed functionalities
        meet the pre-defined security requirements.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node682
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node681
      description: Reflect results in test plans, checklists, and test reports.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node683
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.2
      description: Perform vulnerability assessments to ensure that the information
        system is developed securely according to coding standards.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node684
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node683
      description: After coding is complete, check compliance with secure coding standards
        and perform vulnerability assessments to identify technical security weaknesses.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node685
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node684
      description: Verify source code for compliance with secure coding standards
        (e.g., using source code verification tools).
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node686
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node684
      description: Test completed programs for vulnerabilities using vulnerability
        assessment tools or simulated testing in an environment identical to the operational
        environment.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node687
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.2
      description: In the process of testing and vulnerability assessment, establish
        and implement procedures to quickly address identified issues, including developing
        improvement plans and verifying implementation.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node688
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node687
      description: Develop an improvement plan for issues identified, ensure internal
        reporting, and establish procedures to verify the implementation of fixes
        before system launch.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node689
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node687
      description: If it is unavoidable to resolve issues before the system launch,
        assess the impact, develop mitigating measures, and prepare internal reports
        to minimize risks.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node690
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.2
      description: Public institutions must perform privacy impact assessments through
        designated evaluation bodies during the analysis and design phases for new
        or changed personal information processing systems, and incorporate the results
        into development and modifications according to relevant laws.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node691
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node690
      description: When planning for new development or changes of personal information
        processing systems, public institutions must review whether they are required
        to conduct privacy impact assessments. If so, they should establish a plan
        for the assessment and secure the necessary budget.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node692
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node690
      description: Public institutions must conduct a privacy impact assessment through
        an evaluation agency designated by the Personal Information Protection Commission
        during the analysis and design stages of new or changed personal information
        processing systems, and incorporate the results into development and modifications.
      annotation: "The list of designated evaluation agencies can be checked on the\
        \ 'Personal Information Portal' (www.privacy.go.kr). \nFor procedures and\
        \ criteria for conducting impact assessments, refer to the 'Personal Information\
        \ Impact Assessment Guide'."
    - urn: urn:intuitem:risk:req_node:k_isms_p:node693
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node690
      description: Public institutions must submit the privacy impact assessment report
        to the Personal Information Protection Commission before the system goes live
        and within 2 months after the assessment is completed.
      annotation: 'Register the assessment report on the Personal Information Protection
        Comprehensive Support System (intra.privacy.go.kr).

        The Personal Information Protection Commission or the head of the public institution
        may publish a summary of the assessment report.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node694
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node690
      description: Manage the implementation of improvement requirements resulting
        from the privacy impact assessment.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node695
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node694
      description: Develop a detailed implementation plan for the improvement requirements.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node696
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node694
      description: Regularly check the implementation status.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node697
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node694
      description: If it is unavoidable to take action within the specified period,
        record and report the valid reasons, and establish a plan for future actions.
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node698
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node694
      description: The head of the public institution that received the impact assessment
        report must submit a report on the implementation status of the identified
        improvements to the Personal Information Protection Commission within one
        year (Improvement Plan Implementation Verification Report).
      annotation: 'Key Points for Verification:

        - When introducing, developing, or changing information systems, are tests
        conducted to verify that the security requirements defined during the analysis
        and design phases are effectively applied?

        - Is vulnerability assessment performed to ensure that the information system
        is developed securely according to coding standards?

        - Are procedures such as improvement planning and implementation checks followed
        to promptly address issues found during testing and vulnerability assessment?

        - For public institutions, do they conduct impact assessments through evaluation
        agencies during the analysis and design phases when developing or changing
        personal data processing systems, and incorporate the results into development
        and changes as required by relevant laws?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      ref_id: 2.8.3
      name: Separation of Testing and Operational Environments
    - urn: urn:intuitem:risk:req_node:k_isms_p:node700
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.3
      description: The development and testing systems of the information system must
        be separated from the operational system.
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node701
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node700
      description: The development and testing systems should be configured separately
        from the operational system as a general rule.
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node702
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node700
      description: Establish and implement access control measures to prevent developers
        from unnecessarily accessing the operational system from the development and
        testing systems.
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node703
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.3
      description: If separation of development and production environments is unavoidable,
        security measures such as mutual review, higher authority monitoring, change
        approval, and responsibility tracking should be established.
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node704
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node703
      description: If it is unavoidable due to reasons like very small organizational
        size, lack of human resources, or system characteristics, apply appropriate
        compensatory controls to reduce security risks.
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node705
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node704
      description: 'Mutual Review: Implement mutual review among personnel.'
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node706
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node704
      description: 'Change Approval: Ensure all changes are approved.'
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node707
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node704
      description: 'Higher Authority Monitoring and Auditing: Monitor and audit by
        higher authorities.'
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node708
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node704
      description: 'Backup and Recovery: Establish backup and recovery solutions,
        and ensure responsibility tracking.'
      annotation: 'Key Points for Verification:

        - Are the development and testing systems for information systems separated
        from the production systems?

        - If separation of development and production environments is unavoidable,
        have security measures been established, such as mutual review, monitoring
        by higher authorities, change approval, and responsibility tracking?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      ref_id: 2.8.4
      name: Security of Test Data
    - urn: urn:intuitem:risk:req_node:k_isms_p:node710
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.4
      description: The use of actual operational data during the development and testing
        of information systems must be restricted.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node711
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node710
      description: To prevent the leakage of personal and sensitive information during
        system testing, test data should be created randomly or processed/converted
        from operational data before use.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node712
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node710
      description: Establish and implement standards and procedures for data transformation
        and usage.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node713
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.4
      description: If it is unavoidable to use operational data in the test environment,
        procedures for control must be established and implemented, including responsible
        approval, access and leakage monitoring, and data deletion after testing.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node714
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node713
      description: 'Establish an approval procedure for using operational data: define
        reporting and approval systems based on data sensitivity.'
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node715
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node713
      description: Develop and implement procedures for data disposal after the testing
        period expires.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node716
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node713
      description: Apply access control measures for operational data in the test
        environment.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node717
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node713
      description: Conduct monitoring and regular reviews of operational data replication
        and usage.
      annotation: 'Key Points for Verification:

        - Are the use of actual operational data restricted during the development
        and testing processes of information systems?

        If it is unavoidable to use operational data in the test environment, are
        procedures in place for obtaining responsible approval, monitoring access
        and data leakage, and deleting data after testing?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      ref_id: 2.8.5
      name: Source Program Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node719
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.5
      description: Procedures must be established and implemented to control unauthorized
        access to source code.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node720
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node719
      description: Develop procedures for access to and use of source code.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node721
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node719
      description: Grant access rights only to authorized developers and personnel,
        and block unauthorized access.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node722
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node719
      description: Implement access controls for servers where source code is stored
        (e.g., version control servers).
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node723
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.5
      description: Source code must be securely stored in a location other than the
        operational environment to prepare for emergencies.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node724
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node723
      description: Backup both the latest and previous versions of the source code.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node725
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node723
      description: Store and manage the source code in a separate environment from
        the operational environment.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node726
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node723
      description: Control access to source code backups to prevent unauthorized access.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node727
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.5
      description: Change history of the source code must be managed.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node728
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node727
      description: Establish procedures for source code changes, including approval
        and change procedures, and version control methods.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node729
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node727
      description: 'Manage source code change history: record the date of changes,
        reasons for changes, and personnel involved.'
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node730
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node727
      description: Perform change control for system-related documents (e.g., design
        documents) associated with source code changes.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node731
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node727
      description: Regularly review source code change history and change control
        activities.
      annotation: 'Key Points for Verification:

        - Are procedures established and implemented to control unauthorized access
        to source code?

        - Is source code securely stored in a location other than the operational
        environment to prepare for emergencies, such as system failures?

        - Is the change history of the source code managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.8.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8
      ref_id: 2.8.6
      name: Migration to Operational Environment
    - urn: urn:intuitem:risk:req_node:k_isms_p:node733
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.6
      description: Procedures must be established and implemented to safely transition
        newly introduced, developed, and modified systems into the operational environment.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node734
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node733
      description: Designate a transition manager other than the developer.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node735
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node733
      description: Confirm completion of testing.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node736
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node733
      description: Define a transition strategy (e.g., phased transition, full transition).
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node737
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node733
      description: Prepare response measures for issues that may arise during transition
        (e.g., rollback plans, storage plans for previous versions of the system).
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node738
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node733
      description: Obtain approval from the responsible person for the transition.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node739
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node733
      description: Maintain records and perform reviews of the transition.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node740
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node739
      description: If applying DevOps in a cloud environment, ensure secure deployment
        to the operational environment following controlled procedures within the
        CI/CD pipeline, applying DevSecOps controls.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node741
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.6
      description: Prepare response measures for potential issues that may arise during
        the transition to the operational environment.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node742
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node741
      description: Develop rollback plans if the transition to the operational environment
        does not proceed smoothly.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node743
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node741
      description: Establish storage plans for previous versions of the system (e.g.,
        software, add-ons, configuration files, parameters).
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node744
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.8.6
      description: Only install files necessary for service execution in the operational
        environment.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node745
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node744
      description: Ensure that the operational environment does not contain unauthorized
        development tools (e.g., editors), source programs, backup copies, or any
        unnecessary files related to service execution.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented to safely transition newly
        introduced, developed, and modified systems into the operational environment?

        - Are only the files necessary for service execution installed in the operational
        environment?

        - Have measures been prepared to address potential issues that may arise during
        the transition to the operational environment?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.9'
      name: System and Service Operation Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.1
      name: Change Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node748
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.1
      description: Procedures for changes related to information system assets (such
        as hardware, operating systems, commercial software packages, etc.) must be
        established and implemented.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented for changes related to
        information system assets (such as hardware, operating systems, commercial
        software packages, etc.)?

        - Before performing changes to information system assets, do you analyze the
        impact on performance and security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node749
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node748
      description: When changes are needed for information system assets, such as
        operating system upgrades, commercial software installations, enhancements
        to running application functionalities, network configuration changes, or
        expansion of CPU, memory, and storage, formal procedures for making these
        changes should be established and followed.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented for changes related to
        information system assets (such as hardware, operating systems, commercial
        software packages, etc.)?

        - Before performing changes to information system assets, do you analyze the
        impact on performance and security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node750
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.1
      description: Before making changes to information system assets, the impacts
        on performance and security must be analyzed
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented for changes related to
        information system assets (such as hardware, operating systems, commercial
        software packages, etc.)?

        - Before performing changes to information system assets, do you analyze the
        impact on performance and security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node751
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node750
      description: When changes are required for information system assets, analyze
        the impacts on security, performance, and operations, such as the need for
        changes to security system policies (e.g., firewall policies), potential issues,
        and the extent of their impact
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented for changes related to
        information system assets (such as hardware, operating systems, commercial
        software packages, etc.)?

        - Before performing changes to information system assets, do you analyze the
        impact on performance and security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node752
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node750
      description: Implement changes in a way that minimizes the impact.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented for changes related to
        information system assets (such as hardware, operating systems, commercial
        software packages, etc.)?

        - Before performing changes to information system assets, do you analyze the
        impact on performance and security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node753
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node750
      description: Consider recovery plans in advance in case of change failures.
      annotation: 'Key Points for Verification:

        - Have procedures been established and implemented for changes related to
        information system assets (such as hardware, operating systems, commercial
        software packages, etc.)?

        - Before performing changes to information system assets, do you analyze the
        impact on performance and security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.2
      name: Performance and Fault Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node755
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      description: 'To ensure the availability of information systems, procedures
        must be established and implemented for continuously monitoring performance
        and capacity, including the following aspects:'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node756
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node755
      description: 'Identification Criteria for Performance and Capacity Management
        Targets: Identify key information systems and security systems that could
        impact service and business operations and include them in the monitoring
        targets.'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node757
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node755
      description: 'Definition of Performance and Capacity Requirements (Thresholds)
        for Each Information System: Determine thresholds for CPU, memory, storage,
        etc., that could affect system availability.'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node758
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node755
      description: 'Monitoring Methods: Establish methods to continuously monitor
        for threshold breaches and respond accordingly (e.g., alarms).'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node759
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node755
      description: Recording, Analyzing, and Reporting Monitoring Results.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node760
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node755
      description: Designation of Performance and Capacity Management Personnel and
        Responsibilities.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node761
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      description: 'Procedures must be established and implemented for responding
        when information system performance and capacity requirements (thresholds)
        are exceeded:'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node762
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node761
      description: Continuously monitor the performance and capacity status of information
        systems and establish and implement action plans (e.g., upgrading systems,
        memory, storage) when thresholds are exceeded.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node763
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      description: 'Procedures must be established and implemented to immediately
        detect and respond to information system failures, including the following:'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node764
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node763
      description: Definition of Failure Types and Severity Levels.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node765
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node763
      description: Reporting Procedures by Failure Type and Severity Level.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node766
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node763
      description: 'Detection Methods for Each Failure Type: Utilize management systems
        such as Network Management Systems (NMS).'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node767
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node763
      description: Definition of Responsibilities and Roles for Failure Response and
        Recovery.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node768
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node763
      description: Recording and Analyzing Failures.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node769
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      description: 'For customer-facing services: procedures for informing customers.'
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node770
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      description: Emergency contact system (maintenance vendors, information system
        manufacturers), etc.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node771
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node770
      description: In the event of a failure, actions must be taken according to the
        procedures, and the details of the failure response must be recorded and managed
        through failure response reports and similar documentation.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node772
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.2
      description: For high-severity incidents, a root cause analysis must be conducted
        to establish and implement measures to prevent recurrence.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node773
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node772
      description: For severe incidents such as those causing disruption to daily
        operations, excessive costs (damage), or recurring issues, the root cause
        must be identified, and measures to prevent recurrence should be established
        and implemented.
      annotation: 'Key Points for Verification:

        - To ensure the availability of information systems, are procedures in place
        for continuously monitoring performance and capacity?

        - Are there procedures established and implemented for responding when performance
        and capacity requirements (thresholds) are exceeded?

        - Are procedures in place for promptly detecting and responding to information
        system failures?

        - In the event of a failure, are actions taken according to established procedures,
        and is a failure response report or similar documentation maintained to track
        and manage the actions taken?

        - For high-severity failures, are preventive measures developed through root
        cause analysis to prevent recurrence?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.3
      name: Backup and Recovery Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node775
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.3
      description: Backup and recovery procedures, including the backup targets, frequency,
        methods, and processes, must be established and implemented to ensure timely
        recovery of information systems in the event of damage caused by disasters,
        failures, or security incidents.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node776
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: Establish criteria for selecting backup targets.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node777
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: Designate backup personnel and responsible parties.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node778
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: Define backup frequency and retention periods for each backup target.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node779
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: Determine backup methods and procedures, such as using backup systems
        or manual methods.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node780
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: Manage backup media, including labeling, storage locations, and
        access controls.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node781
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: 'Implement backup recovery procedures: For major information systems,
        conduct regular recovery tests to verify the completeness and accuracy of
        backup information from a disaster recovery perspective.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node782
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node775
      description: Maintain a backup management ledger.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node783
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.3
      description: To ensure the completeness and accuracy of backed-up information
        and the adequacy of recovery procedures, regular recovery tests must be conducted.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node784
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node783
      description: 'Develop a recovery test plan: This plan should include the frequency
        and timing of recovery tests, designated personnel, and methods.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node785
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node783
      description: 'Establish recovery test scenarios: Create scenarios to simulate
        various types of recovery situations to effectively evaluate the recovery
        process.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node786
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node783
      description: 'Conduct and report on recovery tests: Perform recovery tests as
        planned and document the results.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node787
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node783
      description: Establish and implement improvement plans if issues are discovered
        during the recovery tests.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node788
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.3
      description: 'For backup media containing critical information, ensure that
        it is physically dispersed to locations that can handle disasters and emergencies:'
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node789
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node788
      description: 'Store and manage backup media in locations physically distant
        from the operational information systems or backup systems. Maintain a log
        of dispersal activities including:'
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node790
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node789
      description: "Dispersal dates\_(e.g., transport in and out)"
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node791
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node789
      description: Details of dispersed backup media and backup information
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node792
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node788
      description: "Regularly check\_whether the dispersal is being carried out appropriately."
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node793
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node788
      description: "Implement security measures\_at the dispersal locations, such\
        \ as:"
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node794
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node793
      description: Measures against natural disasters (e.g., fireproof safes, flame
        retardant treatments)
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node795
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node793
      description: Access controls for the dispersal site and media.
      annotation: 'Key Points for Verification:

        - Have you established and implemented backup and recovery procedures that
        include backup targets, frequency, methods, and processes?

        - Do you regularly perform recovery tests to ensure the integrity and accuracy
        of backed-up information and the adequacy of recovery procedures?

        - For backup media containing critical information, do you store the backup
        media in a physically separate location to protect against disasters and emergencies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.4
      name: Log and Access Record Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node797
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.4
      description: ' Procedures for log management for information systems such as
        servers, applications, security systems, and network systems must be established,
        and necessary logs must be generated and retained according to these procedures.'
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node798
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node797
      description: Identify the types of logs and the target systems that need to
        be preserved.
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node799
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node797
      description: ' The types of logs, retention periods, and methods of log preservation
        (including backups) must be defined for each system and device. '
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node800
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node797
      description: ' Establish log management procedures and ensure logs are generated
        and stored according to these procedures.'
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node801
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.4
      description: Logs from information systems must be securely stored to prevent
        tampering, theft, or loss, and access to log records must be minimized
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node802
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node801
      description: Log records should be backed up using separate storage devices,
        such as dedicated storage, and access rights to these records should be minimized
        to prevent unauthorized individuals from tampering with, altering, or deleting
        logs.
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node803
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.4
      description: Access records for personal information processing systems must
        be electronically recorded to include all required elements in compliance
        with legal requirements and must be securely stored for a specified period.
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node804
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node803
      description: Mandatory elements that must be included in access records for
        personal information processing systems.
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node805
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node803
      description: Retention period for access records of personal information processing
        systems.
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node806
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node803
      description: Access records for personal information must be securely stored
        to prevent tampering, theft, or loss.
      annotation: 'Key Points for Verification:

        - Have procedures for log management for information systems such as servers,
        applications, security systems, and network systems been established and are
        they followed to generate and retain necessary logs?

        - Are the logs of information systems securely stored to prevent tampering,
        theft, and loss, and is access to these logs minimized and controlled?

        - Are access records for personal data processing systems stored securely
        for a specified period, including all required elements to comply with legal
        requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.5
      name: Log and Access Record Review
    - urn: urn:intuitem:risk:req_node:k_isms_p:node808
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.5
      description: 'Procedures for log review and monitoring must be established and
        implemented to detect anomalies such as errors, misuse (unauthorized access,
        excessive queries), and fraudulent activities in information systems, including:'
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node809
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node808
      description: Review frequency
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node810
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node808
      description: Review targets
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node811
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node808
      description: Review criteria and methods
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node812
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node808
      description: Review personnel and responsibilities
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node813
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node808
      description: Procedures for responding to detected anomalies
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node814
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.5
      description: 'The results of log review and monitoring must be reported to the
        responsible person, and appropriate actions must be taken according to procedures
        if anomalies are detected:'
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node815
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node814
      description: Perform reviews according to log review and monitoring criteria
        and report the results, including any detected anomalies, to the relevant
        responsible person
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node816
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node814
      description: Establish and follow procedures for responding to detected anomalies,
        including verifying incidents such as information leakage, hacking, misuse,
        and fraudulent activities
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node817
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node814
      description: If unauthorized downloading of personal information is confirmed,
        verify the reasons according to the internal management plan and log review
        criteria. If it is confirmed that personal information was downloaded for
        misuse or leakage, promptly retrieve and dispose of the personal information
        downloaded by the data handler, and take necessary actions.
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node818
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.5
      description: 'Access records of personal information processing systems must
        be regularly inspected in accordance with the intervals specified by relevant
        laws and regulations:'
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node819
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node818
      description: 'Legal requirement for checking personal information access records:
        at least once a month'
      annotation: 'Key Points for Verification:

        - Have procedures for log review and monitoring been established and implemented,
        including review frequency, targets, and methods, to detect anomalies such
        as errors, misuse (unauthorized access, excessive queries), and fraudulent
        activities related to information systems?

        - Are the results of log reviews and monitoring reported to the responsible
        person, and are appropriate actions taken according to procedures when anomalies
        are detected?

        - Are the access records of personal information processing systems regularly
        inspected in accordance with the intervals specified by relevant laws and
        regulations?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.6
      name: Time Synchronization
    - urn: urn:intuitem:risk:req_node:k_isms_p:node821
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.6
      description: To ensure the accuracy of logs and access records and to enable
        reliable log analysis, each information system must be synchronized with the
        standard time.
      annotation: 'Key Points for Verification:

        - Is the time of the information system synchronized with the standard time?

        - Are you regularly checking to ensure that time synchronization is functioning
        correctly?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node822
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node821
      description: Use methods such as NTP (Network Time Protocol) to synchronize
        time across systems.
      annotation: 'Key Points for Verification:

        - Is the time of the information system synchronized with the standard time?

        - Are you regularly checking to ensure that time synchronization is functioning
        correctly?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node823
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node821
      description: Ensure that all information systems requiring time accuracy (e.g.,
        access control systems, CCTV storage devices) are synchronized without exception.
      annotation: 'Key Points for Verification:

        - Is the time of the information system synchronized with the standard time?

        - Are you regularly checking to ensure that time synchronization is functioning
        correctly?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node824
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.6
      description: Regularly check to ensure that time synchronization is functioning
        correctly.
      annotation: 'Key Points for Verification:

        - Is the time of the information system synchronized with the standard time?

        - Are you regularly checking to ensure that time synchronization is functioning
        correctly?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node825
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node824
      description: Check for time synchronization errors and verify that synchronization
        is applied correctly after OS reinstallations or configuration changes.
      annotation: 'Key Points for Verification:

        - Is the time of the information system synchronized with the standard time?

        - Are you regularly checking to ensure that time synchronization is functioning
        correctly?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.9.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9
      ref_id: 2.9.7
      name: Reuse and Disposal of Information Assets
    - urn: urn:intuitem:risk:req_node:k_isms_p:node827
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.7
      description: Establish and implement procedures for the safe reuse and disposal
        of information assets.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node828
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node827
      description: 'Reuse Procedures for Information Assets: Methods for data initialization,
        reuse processes, etc.'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node829
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node827
      description: 'Disposal Procedures for Information Assets: Methods of disposal,
        disposal processes (including approval), disposal confirmation, and recording
        in the disposal management log.'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node830
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.7
      description: When reusing or disposing of information assets and storage media,
        ensure that personal data and sensitive information are processed in a way
        that prevents recovery.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node831
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node830
      description: 'For personal data destruction: Ensure safe destruction methods
        so that recovery or regeneration is not possible, in accordance with relevant
        regulations.'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node832
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node830
      description: Irreversible methods' refer to measures taken to ensure that personal
        data, once destroyed, cannot be recovered with current technology and at a
        reasonable cost, according to common social standards (Article 10 of the Standard
        Privacy Protection Guidelines).
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node833
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.7
      description: 'When disposing of information assets and storage media on your
        own, you must maintain a disposal log that includes the following information
        and keep evidence of the disposal:'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node834
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node833
      description: Date of Disposal
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node835
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node833
      description: Names of Disposal Responsible Person and Verifier
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node836
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node833
      description: Disposal Method
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node837
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node833
      description: Disposal Confirmation Evidence (e.g., photographs)
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node838
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.7
      description: 'When disposing of information assets and storage media through
        an external company, the disposal procedures should be specified in the contract,
        and it must be verified that the disposal was completed according to these
        procedures:'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node839
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node838
      description: Include disposal procedures and protection measures, as well as
        responsibility allocation, in the contract.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node840
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node838
      description: Verify compliance with the disposal procedures specified in the
        contract through evidence such as photographs and on-site inspections.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node841
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.9.7
      description: 'In the case of maintenance or repair of information systems, PCs,
        etc., measures should be established to protect information within storage
        media during media replacement or recovery:'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node842
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node841
      description: Data transfer and destruction prior to maintenance request.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node843
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node841
      description: Data encryption.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node844
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node841
      description: Confidentiality agreement in the contract.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node845
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node841
      description: Complete data deletion or complete destruction of storage media,
        etc.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing procedures for the safe reuse and
        disposal of information assets?

        - When reusing or disposing of information assets and storage media, are you
        handling personal data and sensitive information in a manner that ensures
        it cannot be recovered?

        - If disposing of information assets and storage media internally, are you
        keeping a disposal log and retaining proof of disposal?

        - If disposing of information assets and storage media through an external
        vendor, are you specifying the disposal procedures in the contract and verifying
        that the disposal has been completed properly?

        - In the maintenance and repair processes of information systems, PCs, etc.,
        are you taking measures to protect information on storage media in case of
        replacement or recovery?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.10'
      name: System and Service Security Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.1
      name: Security System Operation
    - urn: urn:intuitem:risk:req_node:k_isms_p:node848
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      description: 'For the security systems operated by the organization, the following
        operational procedures must be established and implemented:'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node849
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: Designate responsible persons and administrators for each type
        of security system.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node850
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: Establish procedures for applying security system policies (such
        as rule sets), including registration, modification, and deletion.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node851
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: 'Implement measures for updating policies: For security systems
        like IDS and IPS, continuously update the latest patterns (signatures) and
        engines to detect new attack techniques.'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node852
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: Establish procedures for monitoring security system events, including
        detecting and confirming anomalies that violate policies.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node853
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: Set policies for controlling access to security systems, such as
        user authentication and IP or MAC address restrictions for administrator terminals.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node854
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: Regularly review the operational status of security systems.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node855
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node848
      description: Implement access control measures for the security systems themselves.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node856
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      description: You must minimize the number of authorized personnel, such as security
        system administrators, and strictly control access by unauthorized individuals.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node857
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node856
      description: Apply enhanced user authentication measures (such as OTP) and access
        control for administrator terminal IPs or MAC addresses to strictly control
        access by unauthorized individuals.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node858
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node856
      description: Regularly analyze security system access logs to check for any
        unauthorized access attempts.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node859
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      description: For each security system, establish and implement formal procedures
        for registering, modifying, and deleting policies.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node860
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node859
      description: Establish application and approval procedures for policy registration,
        modification, and deletion for security systems like firewalls and DLP.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node861
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node859
      description: Maintain records of policy application, approval, and implementation
        to ensure accountability.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node862
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node859
      description: 'Considerations when applying security system policies (rule sets):'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node863
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node862
      description: Follow the principle of least privilege, granting only the minimum
        necessary permissions.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node864
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node862
      description: Network access control policies should be set to block all by default,
        allowing only specific IPs and ports that are necessary for work.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node865
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node862
      description: Limit the application period of security policies according to
        their purpose.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node866
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node862
      description: Manage the registration and modification of security policies through
        formal procedures.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node867
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      description: Manage exception policies for security systems according to procedures,
        and ensure that exception policy users are given the minimum necessary permissions.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node868
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node867
      description: Review the validity of the reason for the exception request.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node869
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node867
      description: 'Conduct a security review: Evaluate and prepare countermeasures
        for the security of exception policies'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node870
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node867
      description: 'Exception policy application and approval: Obtain approval from
        responsible persons or administrators for each security system.'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node871
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node867
      description: Monitor the expiration of exception policies and the use of exceptions.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node872
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      description: 'Periodically review the validity of the policies set on the security
        systems, considering the following:'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node873
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node872
      description: Internal policy or guideline violations (e.g., overly permissive
        rules).
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node874
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node872
      description: Policies registered without formal approval procedures.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node875
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node872
      description: Policies not used for a long time.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node876
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node872
      description: Duplicate or expired policies.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node877
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node872
      description: Policies related to resignations or job changes.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node878
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node872
      description: Exception-related policies.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node879
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.1
      description: To prevent illegal access and leakage of personal information,
        install and operate security systems that perform functions required by relevant
        laws and regulations.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node880
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node879
      description: 'Mandatory Functional Requirements for Access Control Systems Required
        by Personal Information Protection Laws:'
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node881
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node880
      description: 1. Restrict access to the personal information processing system
        by IP address or other means to prevent unauthorized access.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node882
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node880
      description: 2. Analyze IP addresses and other access details to detect and
        respond to attempts of personal information leakage.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node883
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node879
      description: If a personal information processing system is configured in a
        cloud environment, access control functions can be implemented using security
        features or services provided by the cloud service provider.
      annotation: 'Key Points for Verification:

        - Are procedures for the operation of security systems managed by the organization
        established and implemented?

        - For each security system, are formal procedures for the registration, modification,
        and deletion of policies established and implemented?

        - Are exception policy registrations in the security system managed according
        to procedures, and are exception policy users managed with

        minimum authority?

        - Are the validity of policies set on security systems regularly reviewed?

        - For the prevention of illegal access and personal information leakage from
        personal information processing systems, are security systems that perform
        functions prescribed by relevant laws installed and operated?

        - Are the number of personnel authorized to access the security systems, such
        as security system administrators, minimized and is access by unauthorized
        individuals strictly controlled?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.2
      name: Cloud Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:node885
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.2
      description: You must clearly define the responsibilities and roles related
        to information security and personal data protection with the cloud service
        provider and reflect these in the contract (e.g., SLA).
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node886
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node885
      description: 'Roles and Responsibilities According to Cloud Service Type (Examples): '
      annotation: 'You will find a table on page 155.

        Note: May vary depending on the cloud service provider, service configuration,
        and characteristics.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node887
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.2
      description: When using cloud services, you must evaluate the security risks
        associated with the service type and establish and implement security control
        policies to prevent unauthorized access, configuration errors, and other risks.
        This includes security configuration and setting standards, procedures for
        changing and approving security settings, secure access methods, and authorization
        frameworks.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node888
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node887
      description: 'Risk Assessment for External Cloud Services: Consider service
        quality and continuity, legal compliance, and security aspects.'
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node889
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node887
      description: Establish and implement security control policies based on the
        risk assessment results for cloud services.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node890
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.2
      description: Administrative privileges for cloud service management must be
        minimized according to roles, and protective measures such as enhanced authentication,
        encryption, access control, and audit logging should be applied to prevent
        unauthorized access and abuse of privileges.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node891
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node890
      description: 'Granular Cloud Service Administrator Privileges: Chief Administrator,
        Virtual Network Administrator, Security Administrator, DevOps Administrator,
        etc.'
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node892
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node890
      description: Minimize administrator privileges according to job roles and responsibilities.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node893
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node890
      description: 'Apply enhanced authentication for cloud administrator access:
        OTP, security keys, etc.'
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node894
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node890
      description: Apply communication encryption or VPN for remote access.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node895
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node890
      description: Maintain detailed logs and monitoring for cloud administrator access
        and privilege settings.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node896
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.2
      description: You must monitor changes to cloud service security settings and
        operational status and regularly review their appropriateness.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node897
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node896
      description: Set up alarms and monitoring to detect unauthorized environment
        and security setting changes in cloud services.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node898
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node896
      description: Regularly review and address the appropriateness of cloud service
        security settings.
      annotation: 'Key Points for Verification:

        - Have you clearly defined the responsibilities and roles related to information
        security and personal data protection with the cloud service provider, and
        reflected these in the contract (e.g., SLA)?

        - When using cloud services, do you assess the security risks associated with
        the service type and establish and implement security control policies to
        prevent unauthorized access, configuration errors, and other risks? This includes
        security configuration and settings standards, procedures for changing and
        approving security settings, secure access methods, and authorization frameworks.

        - Are administrative privileges for cloud service management minimized according
        to roles, and are enhanced protective measures such as strengthened authentication,
        encryption, access control, and audit logging applied to prevent unauthorized
        access and abuse of privileges?

        - Do you monitor changes to security settings and operational status of the
        cloud service and regularly review their appropriateness?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.3
      name: Public Server Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:node900
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.3
      description: 'If operating public servers such as web servers, you must establish
        and implement protective measures:'
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node901
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: For transmitting personal data via web servers, establish a secure
        server with SSL (Secure Socket Layer) / TLS (Transport Layer Security) certificates.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node902
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: Install and update antivirus software.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node903
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: Apply the latest security patches to applications (e.g., web servers,
        OpenSSL) and operating systems.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node904
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: Remove unnecessary services and block unused ports.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node905
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: Prohibit the installation of unnecessary software, scripts, and
        executable files.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node906
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: Prevent the exposure of unnecessary pages such as error handling
        or test pages.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node907
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node900
      description: Conduct regular vulnerability assessments.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node908
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.3
      description: 'Public servers should be installed in a DMZ (Demilitarized Zone)
        that is separated from the internal network and protected by security systems
        such as intrusion prevention systems:'
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node909
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node908
      description: Apply access control policies through intrusion prevention systems
        to ensure that even if the public server is compromised, internal network
        access through the public server is not possible.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node910
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node908
      description: Apply strict access control policies when the public server in
        the DMZ needs to connect to internal network information systems such as databases
        or Web Application Servers (WAS).
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node911
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.3
      description: 'If personal data and important information need to be posted or
        stored on public servers, establish and implement approval and posting procedures,
        including responsibility authorization:'
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node912
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node911
      description: As a general rule, storing personal data and important information
        on web servers in the DMZ is prohibited. If it is unavoidable for business
        purposes, apply approval procedures and protective measures.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node913
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node911
      description: Perform pre-review and approval procedures before posting personal
        data and important information on websites.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node914
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node911
      description: Take measures to prevent exposure of personal data and important
        information to unauthorized persons via external search engines.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node915
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.3
      description: You must regularly check whether the organization's important information
        is being exposed through websites and web servers, and take immediate action
        to block the exposure if it is detected.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node916
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node915
      description: Regularly inspect using search engines and apply necessary measures.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node917
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node915
      description: If exposure of important information is detected, take blocking
        measures on the website and request the search engine provider to prevent
        continued exposure through caches or other means.
      annotation: 'Key Points for Verification:

        - Are protective measures established and implemented for operating public
        servers?

        - Are public servers installed in a DMZ (Demilitarized Zone) that is separated
        from the internal network and protected through security systems such as intrusion
        prevention systems?

        - If personal data and important information need to be posted or stored on
        public servers, is there a procedure for approval and posting, including responsibility
        for authorization?

        - Is there a regular check to ensure that important information is not exposed
        through websites and web servers, and if exposure is detected, are immediate
        actions taken to block it?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.4
      name: Electronic Transactions and Fintech Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:node919
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.4
      description: If you provide electronic transactions and fintech services, you
        must establish and implement protective measures to ensure the safety and
        reliability of transactions.
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node920
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node919
      description: Electronic transactions' refer to transactions where all or part
        of the transaction is processed using electronic documents (Electronic Documents
        and Electronic Transactions Basic Act, Article 2).
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node921
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node919
      description: Electronic commerce' refers to commercial transactions conducted
        using electronic transaction methods (Act on Consumer Protection in Electronic
        Commerce, etc., Article 2).
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node922
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node919
      description: Fintech' is a combination of finance (Finance) and technology (Technology),
        and it encompasses the changes in financial services and industry through
        the convergence of finance and IT (Financial Services Commission Financial
        Terminology Dictionary).
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node923
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node919
      description: Electronic (commerce) businesses and fintech service providers
        must establish and implement protective measures to prevent security incidents
        in the collection, storage management, and disposal of users' personal information,
        trade secrets (such as client identification information, and prices of goods
        or services which may cause business losses if disclosed), and payment information
        (such as authentication, encryption, and access control).
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node924
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node919
      description: For fintech services, it is necessary to identify all possible
        risk factors associated with the fintech service, reflecting the service's
        type and characteristics, and apply the necessary protective measures.
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node925
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.4
      description: When providing electronic transactions and fintech services, if
        you are integrating with external systems such as payment systems, you must
        establish and implement measures to protect the related information being
        transmitted and received, and regularly check its security.
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node926
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node925
      description: 'Electronic payment operators'' are entities involved in the issuance
        of electronic payment methods, provision of electronic payment services, or
        assisting or mediating the implementation of such services through electronic
        payment methods (Act on Consumer Protection in Electronic Commerce, etc.,
        Enforcement Decree, Article 8), and include the following:'
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node927
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node926
      description: Financial institutions, credit card companies, issuers of payment
        methods (entities that record and store monetary value or equivalent value
        in electronic media or information processing systems, and provide it upon
        purchase of goods, etc.), telecommunications payment service providers, and
        electronic payment processing or mediation service providers (such as payment
        gateway companies).
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node928
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node925
      description: Appropriate protection measures must be established and implemented
        to prevent damage between parties involved in transactions due to breaches
        such as leakage, tampering, or fraud of payment-related information transmitted
        between e-commerce operators and electronic payment service providers or fintech
        service providers. Additionally, the safety of these measures must be regularly
        checked.
      annotation: 'Key Points for Verification:

        - If you provide electronic transactions and fintech services, have you established
        and implemented protective measures to ensure the safety and reliability of
        transactions?

        - If you connect with external systems such as payment systems to provide
        electronic transactions and fintech services, have you established and implemented
        measures to protect the transmitted and received related information and checked
        its security?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.5
      name: Information Transmission Security
    - urn: urn:intuitem:risk:req_node:k_isms_p:node930
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.5
      description: When transmitting personal and sensitive information to external
        organizations, a secure transmission policy must be established.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node931
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node930
      description: 'Information Transmission Technology Standards: Encryption methods,
        key exchange and management, protocol standards, and communication methods.'
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node932
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node930
      description: 'Information Transmission Review Procedures: Reporting and approval
        processes, roles and responsibilities between relevant organizations, and
        security reviews.'
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node933
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node930
      description: 'Information Transmission Agreement Standards: Standard security
        agreements or contract templates.'
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node934
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node930
      description: 'Other Protection Measures Application Standards: Protection measures
        reflecting legal requirements.'
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node935
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.5
      description: When exchanging important and personal information between organizations
        for business purposes, protection measures such as establishing agreements
        for secure transmission must be established and implemented.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node936
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node935
      description: For the electronic exchange of important information between organizations
        or affiliates, establish agreements (security agreements, contracts, annexes,
        SLAs, etc.) for secure transmission and implement them accordingly.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node937
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node936
      description: 'Related Business Definitions: Transmission of personal information
        for direct mail (DM) purposes to DM service providers, transfer of collection
        information to debt collection agencies, provision of personal information
        to third parties, transmission of credit card payment information to VAN (Value
        Added Network) companies, etc.'
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node938
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node936
      description: Exchange only the minimum necessary information to comply with
        regulations or prevent information leakage.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node939
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node936
      description: Designate responsible persons and authorities.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node940
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node936
      description: Define information transmission technology standards.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node941
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node936
      description: Administrative, technical, and physical protection measures for
        information transmission, storage, and disposal.
      annotation: 'Key Points for Verification:

        - When transmitting personal and sensitive information to external organizations,
        is a secure transmission policy established?

        - When exchanging personal and sensitive information between organizations
        for business purposes, are protection measures such as establishing agreements
        for secure transmission in place and implemented?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node942
      assessable: false
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node941
      description: 'DM (Direct Mail): Refers to promotional activities conducted through
        mail, including the delivery of letters, postcards, notices, leaflets, catalogs,
        and bills directly or through postal means.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.6
      name: Security of Work Terminals
    - urn: urn:intuitem:risk:req_node:k_isms_p:node944
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.6
      description: Security control policies for devices used for work, such as PCs,
        laptops, virtual PCs, and tablets, must be established and implemented. This
        includes device authentication, approval, access range settings, and device
        security configurations.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node945
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node944
      description: Criteria for Allowing Work Devices
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node946
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node944
      description: Scope of Work Use Through Work Devices
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node947
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node944
      description: Approval Procedures and Methods for Using Work Devices
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node948
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node944
      description: 'Authentication Methods for Connecting to Work Networks: Device
        Authentication, MAC Authentication, etc.'
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node949
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node944
      description: 'Security Configuration Policies for Work Devices: Installation
        of Antivirus Software, Security Programs, etc.'
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node950
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node944
      description: Security Configuration Policies for Using Work Devices and Monitoring
        Measures for Misuse or Abuse
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node951
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.6
      description: To prevent the leakage of personal and sensitive information through
        work devices, policies must be established and implemented, including prohibiting
        the use of file-sharing programs, limiting sharing settings, and controlling
        wireless network usage.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node952
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node951
      description: When sharing settings are unavoidable, set access rights passwords
        for work devices and remove sharing settings after use.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node953
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node951
      description: If file transfers are necessary, provide only read permissions
        by default and grant write permissions individually when required.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node954
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node951
      description: Prevent the leakage or exposure of personal and sensitive information
        through P2P programs, commercial webmail, web storage, messaging services,
        and social networking services due to intentional or careless actions.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node955
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node951
      description: Utilize wireless networks that apply security protocols like WPA2
        (Wi-Fi Protected Access 2).
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node956
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.6
      description: To prevent the leakage or exposure of personal and sensitive information
        due to the loss or theft of mobile devices used for work, security measures
        such as setting passwords must be applied.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node957
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.6
      description: The appropriateness of access control measures for work devices
        must be periodically checked.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node958
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node957
      description: Application and approval processes for work devices, registration
        and de-registration, and device authentication history.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node959
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node957
      description: Current status of security settings on work devices.
      annotation: 'Key Points for Verification:

        - Have security control policies been established and implemented for devices
        used for work, such as PCs, laptops, virtual PCs, and tablets, including device
        authentication, approval, access range settings, and device security configurations?

        - To prevent the leakage of personal and sensitive information through work
        devices, have policies been established and implemented to restrict the use
        of data-sharing programs, limit sharing settings, and control the use of wireless
        networks?

        - Have security measures been applied to prevent the exposure or loss of personal
        and sensitive information due to the loss or theft of work mobile devices?

        - Is the appropriateness of access control measures for work devices periodically
        reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.7
      name: Management of Auxiliary Storage Media
    - urn: urn:intuitem:risk:req_node:k_isms_p:node961
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.7
      description: External hard drives, USB memory sticks, CDs, and other auxiliary
        storage media must have established and implemented policies and procedures
        for their handling (use), storage, disposal, and reuse.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node962
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node961
      description: 'Management Plan for Auxiliary Storage Media Holdings: Maintenance
        of an auxiliary storage media management ledger, etc.'
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node963
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node961
      description: Procedures for Authorization and Registration of Auxiliary Storage
        Media Use
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node964
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node961
      description: Procedures for Managing the Inbound and Outbound Transfer of Auxiliary
        Storage Media
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node965
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node961
      description: Procedures for Disposal and Reuse of Auxiliary Storage Media
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node966
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node961
      description: 'Scope of Auxiliary Storage Media Use: Policies and procedures
        for usage within protected areas such as controlled and restricted zones'
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node967
      assessable: false
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.7
      description: You must periodically inspect the status of auxiliary storage media
        holdings, usage, and management practices.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node968
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node967
      description: Check management practices such as evidence of approval for use,
        current holdings, management ledgers, and usage history.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node969
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.7
      description: The use of auxiliary storage media must be restricted in controlled
        areas, critical restricted zones, and other protected areas where major information
        systems are located.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node970
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node969
      description: In unavoidable cases, use must be authorized by a responsible person
        and conducted following proper procedures.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node971
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node969
      description: Conduct regular reviews of the use of auxiliary storage media within
        controlled and critical restricted zones.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node972
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.7
      description: You must establish measures to prevent malware infections and the
        leakage of sensitive information through auxiliary storage media.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node973
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node972
      description: Establish and implement protective measures such as disabling automatic
        execution of auxiliary storage media and using antivirus programs before use.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node974
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.7
      description: Auxiliary storage media containing personal information or sensitive
        information must be stored in a secure location with a locking device.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node975
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node974
      description: Auxiliary storage media containing personal or sensitive information
        (e.g., portable hard drives, USB memory sticks, SSDs) should be kept in a
        safe or another secure location equipped with a locking mechanism.
      annotation: 'Key Points for Verification:

        - Have you established and implemented policies and procedures for the handling
        (use), storage, disposal, and reuse of auxiliary storage media such as external
        hard drives, USB memory sticks, and CDs?

        - Do you periodically check the status of auxiliary storage media holdings,
        usage, and management?

        - Are you restricting the use of auxiliary storage media in controlled areas
        and critical restricted zones where major information systems are located?

        - Have you established measures to prevent malware infection and information
        leakage through auxiliary storage media?

        - Are auxiliary storage media containing personal or sensitive information
        stored in a secure location with locking mechanisms?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.8
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.8
      name: Patch Management
    - urn: urn:intuitem:risk:req_node:k_isms_p:node977
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.8
      description: Establish and implement OS and software patch management policies
        and procedures according to the characteristics and importance of assets such
        as servers, network systems, security systems, and PCs.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node978
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Establish and implement OS and software patch management policies
        and procedures according to the characteristics and importance of assets such
        as servers, network systems, security systems, and PCs.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node979
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: "Patch Frequency:\_Reflect the importance and characteristics of\
        \ the assets."
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node980
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Patch Information Verification Methods
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node981
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Pre-Deployment Review Procedures
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node982
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Emergency Patch Application Procedures
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node983
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Security Review for Unapplied Patches
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node984
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Patch Managers and Responsible Personnel
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node985
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node977
      description: Patch-related vendor (manufacturer) contact information
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node986
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.8
      description: Regularly manage the OS and software patch application status for
        major servers, network systems, security systems, etc.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node987
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node986
      description: Manage as a list that includes version information, patch application
        status, and application dates for the OS and software installed on major servers,
        network systems, security systems, etc.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node988
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node986
      description: Regularly check the need for applying the latest security patches.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node989
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.8
      description: If it is difficult to apply the latest patches to address vulnerabilities
        due to service impact, supplementary measures must be established.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node990
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node989
      description: When applying patches to operational systems, consider the importance
        and characteristics of the system, and thoroughly analyze the impact following
        established procedures, as applying patches may affect system availability
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node991
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node989
      description: If immediate patch application is challenging due to the operational
        environment, document the reasons, develop additional supplementary measures,
        report to the responsible party, and manage the status.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node992
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.8
      description: For major servers, network systems, and security systems, restrict
        patching through public internet access.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node993
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node992
      description: However, if unavoidable, conduct a risk analysis beforehand, establish
        protective measures, and apply them after obtaining approval from the responsible
        party.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node994
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.8
      description: When using a Patch Management System (PMS), ensure sufficient protective
        measures, such as access control, as the PMS server or management console
        could be exploited to distribute malware to internal network servers or PCs.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node995
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node994
      description: 'Implement access control measures for the Patch Management System
        itself: block access for unauthorized administrators, change default passwords,
        and eliminate security vulnerabilities.'
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node996
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node994
      description: Perform file integrity checks when distributing update files.
      annotation: 'Key Points for Verification:

        - Have patch management policies and procedures for operating systems (OS)
        and software been established and implemented according to the characteristics
        and importance of assets such as servers, network systems, security systems,
        and PCs?

        - Are the OS and software patch application statuses for major servers, network
        systems, and security systems being regularly managed?

        - If it is difficult to apply the latest patches due to service impact, are
        supplementary measures being prepared?

        - Are patches for major servers, network systems, and security systems restricted
        from being applied via public internet access?

        - If a patch management system is used, have sufficient protection measures
        such as access control been established?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.10.9
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10
      ref_id: 2.10.9
      name: Malware Control
    - urn: urn:intuitem:risk:req_node:k_isms_p:node998
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.9
      description: 'To protect information systems and business terminals from malware
        such as viruses, worms, Trojans, and ransomware, protective measures must
        be established and implemented, including the following:'
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node999
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Guidelines for PC usage (e.g., prohibiting the opening of suspicious
        emails and files, prohibiting the download and installation of unauthorized
        programs).
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1000
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Malware response guidelines for information systems and personal
        information processing systems.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1001
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Scope of antivirus program installation (targeting information
        assets vulnerable to malware infection).
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1002
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Procedures for installing antivirus programs.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1003
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Preventive and detection activities for the latest malware through
        antivirus programs and other security tools.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1004
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Policies for regular monitoring of malware infections via antivirus
        programs and other tools.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1005
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Configuration of automatic updates for antivirus software or performing
        updates at least once a day.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1006
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: Prohibition of unauthorized programs, such as P2P and web hard
        services, on information systems and business computers.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1007
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node998
      description: User education and information provision.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1008
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.9
      description: 'Ongoing activities must be conducted to prevent and detect the
        latest malware through antivirus software and other security programs:'
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1009
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1008
      description: Scanning email attachments for malware infections.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1010
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1008
      description: Real-time monitoring and remediation of malware.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1011
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1008
      description: 'Regular malware checks: setting up automated virus scan schedules.'
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1012
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1008
      description: Maintaining the latest version of the antivirus engine through
        regular updates.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1013
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.9
      description: Antivirus software and other security programs must be kept up
        to date, and emergency security updates should be performed when necessary.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1014
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1013
      description: 'Compliance with antivirus update frequency: Ensure automatic updates
        or perform updates at least once a day.'
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1015
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1013
      description: Perform updates in response to malware alerts or emergency update
        notifications.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1016
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1013
      description: When managing antivirus programs via a central management system,
        implement protective measures such as access control for the management server
        and integrity verification of distribution files.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1017
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.10.9
      description: When managing antivirus programs via a central management system,
        implement protective measures such as access control for the management server
        and integrity verification of distribution files.
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1018
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1017
      description: Establish response procedures upon detecting malware infections
        (e.g., disconnecting network cables).
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1019
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1017
      description: Maintain an emergency contact list (e.g., contacts for antivirus
        software vendors and relevant organizations).
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1020
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1017
      description: Prepare a response report template (including the date and time
        of detection, response procedures and methods, responsible personnel, and
        preventive measures).
      annotation: 'Key Points for Verification:

        - Have protective measures been established and implemented to protect information
        systems and business terminals from malware such as viruses, worms, Trojans,
        and ransomware?

        - Are continuous activities being carried out to prevent and detect the latest
        malware through security programs such as antivirus software?

        - Are security programs, including antivirus software, kept up-to-date, and
        are emergency security updates performed when necessary?

        - When malware infection is detected, have response procedures been established
        and implemented to minimize the spread and damage caused by the malware?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.11
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.11'
      name: Incident Prevention and Response
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.11.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11
      ref_id: 2.11.1
      name: ' Establishing Incident Prevention and Response Systems'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.1
      description: 'A system and procedures must be established to prevent security
        breaches and personal information leakage incidents, and to respond quickly
        and effectively in case of an incident. The following elements should be included:'
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1024
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Definition and scope of security breaches (e.g., personal information
        leakage, hacking incidents, denial-of-service attacks).
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1025
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Types and severity of security breaches.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1026
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Procedures and methods for declaring a security breach.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1027
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Communication systems, including emergency contact lists.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1028
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Systems for detecting security breaches.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1029
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Procedures for recording and reporting security breaches.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1030
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Procedures for reporting and notifying relevant agencies, data
        subjects, and users in the event of a security breach.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1031
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Preparation of security breach reports.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1032
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Response and recovery procedures based on the severity and type
        of security breach.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1033
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Formation, responsibilities, and roles of the recovery team for
        security breaches.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1034
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Procurement of recovery equipment and resources.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1035
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Training for security breach response and recovery, including training
        scenarios.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1036
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Utilization of external experts and specialized institutions.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1037
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1023
      description: Other necessary measures for preventing and recovering from security
        incidents
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1038
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.1
      description: When establishing and operating a security incident response system
        through external organizations such as security monitoring services, the details
        of the incident response procedures must be reflected in the contract (e.g.,
        SLA).
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1039
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1038
      description: Scope of the security monitoring service.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1040
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1038
      description: Reporting and response procedures upon detection of security threats.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1041
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1038
      description: Reporting and response procedures in case of a security incident.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1042
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1038
      description: Responsibilities and roles related to security incidents.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1043
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.1
      description: A coordination system with external experts, specialized companies,
        and professional institutions must be established for monitoring, responding
        to, and handling security incidents.
      annotation: 'Key Points for Verification:

        - Are you establishing and implementing systems and procedures to prevent
        security incidents and data breaches and to respond quickly and effectively
        when such incidents occur?

        - When establishing and operating a security incident response system through
        external organizations, such as security monitoring services, are the details
        of the incident response procedures reflected in the contract?

        - Have you established a coordination system with external experts, specialized
        companies, and professional institutions for monitoring, responding to, and
        handling security incidents?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.11.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11
      ref_id: 2.11.2
      name: Vulnerability Inspection and Remediation
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1045
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.2
      description: You must establish and regularly perform procedures for vulnerability
        assessment of information systems.
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1045
      description: 'Items to include in the vulnerability assessment procedure:'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1047
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: "Vulnerability Assessment Targets:\_(e.g., servers, network devices,\
        \ etc.)"
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1048
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: "Assessment Frequency:\_(considering legal requirements, importance,\
        \ etc.)"
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1049
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: Designated Assessors and Responsible Persons
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1050
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: Assessment Procedures and Methods
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1051
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: Action Criteria Based on Importance
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1052
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: Reporting Procedures for Assessment Results
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1053
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: Security Review for Unaddressed Vulnerabilities
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1054
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1046
      description: Other necessary measures for preventing and recovering from security
        incidents
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1045
      description: 'Vulnerability Assessment Targets:'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1056
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      description: Vulnerabilities in network systems configuration and settings (e.g.,
        routers, switches)
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1057
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      description: Security settings vulnerabilities in server operating systems
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1058
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      description: Vulnerabilities in security systems (e.g., firewalls)
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1059
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      description: Application vulnerabilities
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1060
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      description: Web service vulnerabilities
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1061
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1055
      description: Vulnerabilities in smart devices and mobile services (e.g., mobile
        apps)
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1062
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1045
      description: You should consider performing penetration testing based on the
        company's size and the importance of the information held.
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1063
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1045
      description: Data controllers are required to include vulnerability assessment
        measures to prevent data leakage or theft in their internal management plans
        and to establish and implement them (Article 4, Paragraph 1, Item 10 of the
        Personal Information Safety Measures Standards).
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1064
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.2
      description: Actions must be taken for identified vulnerabilities, and the results
        must be reported to the responsible person.
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1065
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1064
      description: 'Report Preparation: Include details such as the date of the assessment,
        targets, methods, contents and results, findings, and corrective actions in
        the report to ensure proper record-keeping.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1066
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1064
      description: 'Verification: Confirm the completion of corrective actions through
        follow-up checks for each identified vulnerability.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1067
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1064
      description: 'Unresolved Vulnerabilities: Clearly identify the reasons for any
        vulnerabilities that cannot be addressed, report the associated risks and
        supplementary measures to the responsible person.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1068
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.2
      description: Continuously identify and analyze the impact of the latest security
        vulnerabilities on information systems and take necessary actions.
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1069
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1068
      description: 'Ongoing Monitoring: In addition to regular security vulnerability
        assessments, continuously identify the latest vulnerabilities.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1070
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1068
      description: 'Impact Analysis: When new security vulnerabilities are discovered,
        analyze their impact on the information systems and take necessary corrective
        measures.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1071
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.2
      description: Maintain records of vulnerability assessment history and establish
        measures to address issues such as the recurrence of vulnerabilities identified
        in the previous year.
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1072
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1071
      description: 'Record Management: Keep records of the vulnerability assessment
        history.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1073
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1071
      description: 'Comparison Analysis: Compare and analyze current vulnerability
        assessment results with previous assessments to check for recurrences.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1074
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1071
      description: 'Root Cause Analysis: If similar vulnerabilities reoccur, conduct
        a root cause analysis and develop measures to prevent recurrence.'
      annotation: 'Key Points for Verification:

        - Have you established a procedure for vulnerability assessment of information
        systems and are you performing regular checks?

        - Do you take action on identified vulnerabilities and report the results
        to the responsible person?

        - Are you continuously monitoring for the occurrence of new security vulnerabilities,
        analyzing their impact on information systems, and taking appropriate measures?

        - Do you maintain records of vulnerability assessment history and have you
        implemented protective measures to address issues such as the recurrence of
        vulnerabilities identified in the previous year?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.11.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11
      ref_id: 2.11.3
      name: Analyzing and Monitoring Unusual Activity
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1076
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.3
      description: To detect abnormal activities such as intrusion attempts, personal
        data leakage attempts, and fraudulent behavior by internal and external sources,
        you must collect, analyze, and monitor network traffic, data flows, and event
        logs from major information systems, applications, networks, and security
        systems.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1077
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1076
      description: You should establish a system for collecting and analyzing logs
        from information systems, security systems, applications, and network equipment
        to determine abnormal behavior.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1078
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1077
      description: Targets and scope for collecting or monitoring event logs
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1079
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1077
      description: Methods for collection, analysis, and monitoring
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1080
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1077
      description: Designation of responsible personnel and accountability
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1081
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1077
      description: Reporting system for analysis and monitoring results
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1082
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1077
      description: Response procedures for detecting abnormal behavior
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1083
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1076
      description: For organizations with high importance of information systems,
        consider 24-hour real-time monitoring.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1084
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.3
      description: You must define criteria and thresholds for determining intrusion
        attempts, personal data leakage attempts, and fraudulent activities, and ensure
        that judgments, investigations, and subsequent actions are carried out promptly
        according to these criteria.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1085
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1084
      description: Establish criteria and thresholds for identifying abnormal behavior
        and reflect them in the system as necessary.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1086
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1084
      description: Regularly review and optimize the defined criteria and thresholds.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1087
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1084
      description: When abnormal behavior is confirmed, perform emergency responses,
        request explanations, and conduct cause investigations according to regulations.
      annotation: 'Key Points for Verification:

        - Are you collecting, analyzing, and monitoring network traffic, data flows,
        and event logs from major information systems, applications, networks, and
        security systems to detect abnormal activities such as intrusion attempts,
        attempts to leak personal information, and fraudulent actions?

        - Have you defined criteria and thresholds to determine the presence of intrusion
        attempts, personal information leakage attempts, and fraudulent activities,
        and are follow-up actions, such as judgment and investigation of abnormal
        activities, being carried out in a timely manner according to these criteria?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.11.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11
      ref_id: 2.11.4
      name: Incident Response Training and Improvement
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1089
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.4
      description: You must establish a simulation training plan for responding to
        security incidents and personal data leakage incidents, and conduct such training
        at least once a year.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1090
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1089
      description: Review the adequacy of the incident response procedures and ensure
        that the simulation training plan is established and implemented to enable
        prompt response in the event of an incident.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1091
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1089
      description: Develop realistic and practical simulation training scenarios that
        reflect the latest incident cases, hacking trends, and business characteristics.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1092
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1089
      description: Form a simulation training team that includes all relevant organizational
        units involved in incident response, such as information security, personal
        data protection, IT, legal, HR, and public relations.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1093
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1089
      description: Conduct simulation training at least once a year to ensure that
        relevant employees are familiar with the incident response procedures.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1094
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.4
      description: You must improve the incident response system for security incidents
        and personal data leakage incidents based on the results of the training exercises.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1095
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1094
      description: Prepare and report an internal report on the results of the simulation
        training.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1096
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1094
      description: Identify areas for improvement based on the simulation training
        results and reflect these improvements in the response procedures as necessary.
      annotation: 'Key Points for Verification:

        - Have you established a simulation training plan for responding to security
        incidents and personal data leakage incidents, and are you conducting such
        training at least once a year?

        - Are you improving the response system for security incidents and personal
        data leakage incidents based on the results of the training exercises?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.11.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11
      ref_id: 2.11.5
      name: Incident Response and Recovery
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1098
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.5
      description: When signs of or an actual incident of a security breach or personal
        data leak are detected, a prompt response and reporting must be carried out
        according to the defined incident response procedures.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1099
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1098
      description: Initial Response and Evidence Preservation for Security Incidents
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1100
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1099
      description: Action to delete, change, or block access rights to information
        systems suspected of being compromised
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1101
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1099
      description: Security checks and vulnerability remediation for network, firewall,
        and other internal and external systems
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1102
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1099
      description: Preservation of evidence, such as external access logs, necessary
        for incident investigation
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1103
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1099
      description: Verification of personal and sensitive data leaks through log analysis,
        etc.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1104
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1098
      description: Preparation and Internal Reporting of Incident Reports Including
        the Following
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1105
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1104
      description: Date and time of the incident
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1106
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1104
      description: Reporter and reporting time
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1107
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1104
      description: Details of the incident (findings, damage, etc.)
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1108
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1104
      description: Response process details
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1109
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1104
      description: Time taken to respond to the incident, etc.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1110
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1098
      description: If the impact of the incident on the organization is severe, report
        it promptly to top management according to the reporting procedures.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1111
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.5
      description: In the event of a personal data breach, the notification of data
        subjects and reporting to relevant authorities must be carried out in accordance
        with applicable laws and regulations.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1112
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1111
      description: Requirements for notifying data subjects in the case of loss, theft,
        or leakage of personal data (hereinafter referred to as "leakage")
      annotation: You will find a table on page 183
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1113
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1111
      description: Requirements for Reporting to Relevant Authorities in the Event
        of Personal Data Leakage
      annotation: You will find a table on page 184
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1114
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.5
      description: After a Security Incident is Resolved, Analyze the Cause and Report
        the Results, Sharing Them with Relevant Organizations and Personnel.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1115
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1114
      description: ' After handling and concluding a security incident, perform an
        analysis of the incident''s cause and prepare a report for the responsible
        person. '
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1116
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1114
      description: Share the incident information, discovered vulnerabilities, causes,
        and countermeasures with relevant organizations and personnel.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1117
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.11.5
      description: Utilize the Information Obtained from Incident Analysis to Establish
        Measures to Prevent Recurrence of Similar Incidents, and Modify the Incident
        Response Procedures if Necessary.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1118
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1117
      description: 'Establish measures to prevent recurrence of similar incidents
        using information obtained from the incident analysis. '
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1119
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1117
      description: Modify incident response procedures, information security policies,
        and related procedures based on the analysis results, if necessary.
      annotation: 'Key Points for Verification:

        - When signs of or actual incidents of security breaches or personal data
        leaks are detected, is a prompt response and reporting carried out according
        to the defined incident response procedures?

        - In the event of a personal data breach, are the notification of the data
        subjects and the reporting to relevant authorities carried out in accordance
        with applicable laws and regulations?

        - After the incident is resolved, is an analysis of the incident''s cause
        conducted, with the results reported and shared with relevant organizations
        and personnel?

        - Are measures established to prevent similar incidents from recurring based
        on the analysis of the breach, and are changes made to the incident response
        procedures as necessary?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.12
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2
      ref_id: '2.12'
      name: Disaster Recovery
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.12.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12
      ref_id: 2.12.1
      name: Safety Measures for Disaster Preparedness
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1122
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12.1
      description: "Identify IT disaster types that could threaten the continuity\
        \ of the organization\u2019s core services (operations), analyze the impact\
        \ scale and effects on operations for each type, and identify the core IT\
        \ services (operations) and systems."
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1123
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1122
      description: "Identify IT disaster types that could threaten the continuity\
        \ of the organization\u2019s core services (operations), such as natural disasters,\
        \ hacking, communication failures, etc."
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1124
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1122
      description: "Analyze the impact scale and effects on the organization\u2019\
        s core services (operations) for each type of disaster, considering the following\
        \ factors, and identify the core IT services and systems:"
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1125
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1124
      description: "Financial aspects:\_Decrease in revenue, contract penalty payments,\
        \ etc."
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1126
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1124
      description: "Legal aspects:\_Damage compensation lawsuits, etc."
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1127
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1124
      description: "Qualitative aspects:\_Deterioration of external image, loss of\
        \ competitiveness, etc."
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1128
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12.1
      description: 'Define the Recovery Time Objectives (RTO) and Recovery Point Objectives
        (RPO) based on the importance and characteristics of core IT services and
        systems:'
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1129
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1128
      description: 'Recovery Time Objective (RTO): Define the target recovery time
        from the point of IT service or system disruption until it is restored and
        operational.

        Recovery Point Objective (RPO): Define the target point in time to which data
        must be recovered.'
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1130
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12.1
      description: 'Establish and implement disaster recovery plans to ensure the
        continuity of core services and systems even during disasters and emergencies.
        This includes recovery strategies, emergency recovery teams, emergency contact
        systems, and recovery procedures:'
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1131
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1130
      description: 'Develop Cost-Effective Recovery Strategies and Measures: Create
        strategies and measures to achieve predefined service and system recovery
        time and recovery point objectives in case of IT disasters.'
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1132
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1130
      description: 'Build IT Disaster Recovery Systems: Ensure rapid recovery by including
        the following elements:'
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1133
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1132
      description: Assign roles and responsibilities to relevant departments and personnel
        for recovery in the event of an IT disaster.
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1134
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1132
      description: Establish a contact system among relevant department personnel
        and maintenance vendors within the organization.
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1135
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1132
      description: Includes business impact analysis, definition of recovery time
        and recovery point objectives, and identification of core IT services and
        systems.
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1136
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1132
      description: Determine the recovery sequence for information systems according
        to recovery time objectives.
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1137
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1132
      description: Include disaster occurrence, recovery completion, and post-recovery
        management stages.
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1138
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1130
      description: For personal data controllers, develop and regularly review crisis
        response manuals and procedures for protecting personal data processing systems
        in the event of disasters such as fires, floods, or power outages (as per
        the Personal Data Safety Measures Standards Article 11).
      annotation: "Key Points for Verification:\n- Have you identified IT disaster\
        \ types that could threaten the continuity of the organization\u2019s core\
        \ services (operations), analyzed the impact scale and effects on operations\
        \ for each type, and identified the core IT services (operations) and systems?\n\
        - Have you defined recovery time objectives (RTO) and recovery point objectives\
        \ (RPO) based on the importance and characteristics of core IT services and\
        \ systems?\n- Have you established and implemented a disaster recovery plan\
        \ to ensure continuity of core services and systems in the event of a disaster,\
        \ including recovery strategies and measures, emergency recovery organization,\
        \ emergency contact systems, and recovery procedures?"
    - urn: urn:intuitem:risk:req_node:k_isms_p:2.12.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12
      ref_id: 2.12.2
      name: Disaster Recovery Testing and Improvement
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1140
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12.2
      description: To assess the effectiveness of the established IT disaster recovery
        system, a disaster recovery test plan must be established and implemented.
      annotation: 'Key Points for Verification:

        - Are disaster recovery test plans established and implemented to assess the
        effectiveness of the established IT disaster recovery system?

        - Are recovery strategies and measures regularly reviewed and updated to reflect
        test results, changes in the information system environment, and legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1141
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1140
      description: ' Regular tests should be conducted according to the test plan
        to check if the recovery strategies and measures are effective, and if the
        disaster recovery team members respond quickly according to the recovery procedures
        during emergencies.'
      annotation: 'Key Points for Verification:

        - Are disaster recovery test plans established and implemented to assess the
        effectiveness of the established IT disaster recovery system?

        - Are recovery strategies and measures regularly reviewed and updated to reflect
        test results, changes in the information system environment, and legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1142
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:2.12.2
      description: Recovery strategies and measures should be regularly reviewed and
        updated to reflect changes based on test results, changes in the information
        system environment, and legal requirements.
      annotation: 'Key Points for Verification:

        - Are disaster recovery test plans established and implemented to assess the
        effectiveness of the established IT disaster recovery system?

        - Are recovery strategies and measures regularly reviewed and updated to reflect
        test results, changes in the information system environment, and legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1143
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1142
      description: Establish an official change management procedure for the IT disaster
        recovery plan.
      annotation: 'Key Points for Verification:

        - Are disaster recovery test plans established and implemented to assess the
        effectiveness of the established IT disaster recovery system?

        - Are recovery strategies and measures regularly reviewed and updated to reflect
        test results, changes in the information system environment, and legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1144
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1142
      description: Regularly review and update the recovery plan considering the results
        of disaster recovery tests and changes in the information system environment.
      annotation: 'Key Points for Verification:

        - Are disaster recovery test plans established and implemented to assess the
        effectiveness of the established IT disaster recovery system?

        - Are recovery strategies and measures regularly reviewed and updated to reflect
        test results, changes in the information system environment, and legal requirements?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3
      assessable: false
      depth: 1
      ref_id: '3'
      name: Requirements for Each Stage of Personal Information Processing
      description: (21 items)
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3
      ref_id: '3.1'
      name: Protection Measures During the Collection of Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.1
      name: Collection and Use of Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1148
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: When collecting personal information, the lawful requirements as
        per relevant laws, such as obtaining the data subject's consent, complying
        with legal obligations, and the execution and fulfillment of contracts, must
        be clearly identified and followed to ensure the lawful collection of personal
        information.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1149
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1148
      description: The legal requirements for the collection of personal information
        must be clearly identified for each method of collection, and the relevant
        evidence should be documented and managed to demonstrate compliance.
      annotation: 'For example, if personal information is collected without the data
        subject''s consent due to specific legal provisions or to comply with legal
        obligations, the relevant legal provisions or clauses should be documented
        as evidence. '
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1150
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1148
      description: A personal information controller may collect personal information
        under any of the following circumstances and may use it within the scope of
        the stated purpose of collection.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1151
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: ' When obtaining consent for the collection of personal information
        from the data subject, the consent must be obtained in an appropriate manner
        that reflects the characteristics of the collection medium, and the information
        should be collected at the point when it is needed. '
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1152
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1151
      description: Consent for the collection of personal information must be obtained
        in an appropriate manner, taking into account the following factors based
        on the characteristics of the collection medium.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1153
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1151
      description: Personal information should not be collected broadly in advance
        during the membership registration process; it should be collected at the
        point when it is actually needed.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1154
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1153
      description: Consent for the collection and use of personal information should
        be obtained only for the information necessary to initiate the service, and
        for any additional services, consent should be obtained at the time those
        services are provided.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1155
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1153
      description: When registering on a website, personal information that is only
        required for specific services within the website should be collected at the
        time those specific services are used.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1156
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1153
      description: However, for repeated services, personal information can be collected
        and used if consent is obtained at the initial service point by classifying
        it as an optional consent item.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1157
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: When obtaining consent for the collection of personal information
        from the data subject, the legally required notifications must be clearly
        communicated, and consent must be obtained. Important information, as specified
        by law, should be clearly marked to ensure that the data subject can easily
        understand it.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1158
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1157
      description: When obtaining consent for the collection and use of personal information
        from the data subject, the four legally required notifications must be clearly
        and specifically communicated, and consent must be obtained.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1159
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1157
      description: ' For the consent of the data subject to be legally valid, it must
        meet all legal requirements, including the data subject''s ability to make
        a decision based on their free will, and the specificity and clarity of the
        consent content.'
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1160
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1157
      description: 'According to Article 22(2) of the Personal Information Protection
        Act, when obtaining consent for the processing of personal information in
        writing (including electronic documents as defined in Article 2(1) of the
        Electronic Documents and Transactions Act), the following important information
        must be clearly displayed and easily understandable:'
      annotation: 'You will find it on page 192.

        For detailed information, refer to the "Personal Information Processing Consent
        Guide" provided by the Personal Information Protection Commission.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1161
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: When obtaining consent for the collection, use, or provision of
        personal information from children under the age of 14, it is necessary to
        inform the legal guardian of the required details and obtain their consent.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1162
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1161
      description: If there is no need to process the personal information of children
        under the age of 14, implement appropriate age verification procedures to
        prevent the collection of such information.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1163
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1161
      description: If there is a need to process the personal information of children
        under the age of 14, establish a separate consent form and legal guardian
        verification procedures to obtain the required consent from the legal guardian.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1164
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: To obtain the consent of a legal guardian, only the minimum necessary
        information (such as name and contact details) should be collected, and procedures
        and methods must be established to verify whether the legal guardian meets
        the eligibility requirements.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1165
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1164
      description: The minimum information required to obtain the legal guardian's
        consent (such as the guardian's name and contact details) can be collected
        directly from the child without the guardian's consent.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1166
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1165
      description: However, when collecting the guardian's name and contact details,
        the child must be informed of the purpose of collecting their own identity
        and contact information, as well as the reason for collecting the guardian's
        name and contact details (Standard Personal Information Protection Guidelines
        Article 13(1)).
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1167
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1165
      description: The personal information of the legal guardian collected from the
        child should be used solely for obtaining consent.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1168
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1164
      description: To obtain the legal guardian's consent, it is necessary to verify
        that the information provided by the child pertains to a legitimate legal
        guardian and confirm the authenticity of the guardian.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1169
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1168
      description: Verify the legal guardian's status as a minor.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1170
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1168
      description: Confirm the age difference between the child and the guardian.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1171
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1164
      description: If the legal guardian refuses consent or if the consent of the
        legal guardian cannot be confirmed, the collected data must be destroyed within
        5 days from the collection date (Standard Personal Information Protection
        Guidelines Article 13(2)).
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1172
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: When notifying children under the age of 14 about matters related
        to personal data processing, the information must be presented in a format
        and language that is easy to understand.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1173
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1172
      description: Information should be transparently conveyed in child-friendly
        ways, such as using simple language, illustrations, videos, etc.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1174
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1172
      description: Consider the child's age, capabilities, and usage behavior.
      annotation: For detailed information, refer to the 'Children and Youth Personal
        Information Protection Guidelines' (Personal Information Protection Commission).
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1175
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: Records of consent obtained from the data subject and legal guardian
        must be maintained to prove the legal basis for data collection and use.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1176
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1175
      description: 'Records should include: date and time of consent, consent items,
        consent giver (legal guardian''s information if applicable), and method of
        consent.'
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1177
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1175
      description: 'Retention period: Until the personal data is destroyed, such as
        when membership is canceled.'
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1178
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: For personal data that can be processed without the data subject's
        consent, clearly disclose the items and legal basis for processing in the
        privacy policy or notify the data subject through written means.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1179
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1178
      description: 'Cases where personal data collection and use are allowed without
        consent: Personal Information Protection Act Article 15(1)(2) to (7).'
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1180
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1178
      description: 'Information to notify: Items of personal data processed without
        consent and legal basis for processing.'
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1181
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1178
      description: 'Method of notification: Separate from personal data collected
        with consent, either through the privacy policy or written methods (e.g.,
        mail, email, fax, phone, text message, or equivalent).'
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1182
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.1
      description: When using personal data for additional purposes without consent,
        establish and implement criteria considering relevance to the original purpose,
        predictability, potential infringement on rights, and safety measures. If
        additional use continues, disclose this in the privacy policy and check compliance
        with the criteria.
      annotation: 'Key Points for Verification:

        - When collecting personal information, is it being collected in accordance
        with the lawful requirements such as obtaining the consent of the data subject,
        compliance with legal obligations, or the execution and fulfillment of a contract?

        - When obtaining consent from the data subject for the collection of personal
        information, are the methods and timing of obtaining consent appropriate?

        - When obtaining consent from the data subject for the collection of personal
        information, is the relevant information clearly disclosed, and is important
        information as specified by law highlighted in an easily understandable manner?

        - In cases where consent is obtained for the collection, use, and provision
        of personal information of children under the age of 14, is the legal guardian
        properly informed of the necessary details and is consent obtained from them?

        - Is only the minimum necessary personal information collected to obtain consent
        from the legal guardian, and are procedures and methods in place to verify
        that the legal guardian meets the qualification requirements?

        - Are records of consent obtained from the data subject and legal guardian
        being properly maintained?

        - When notifying children under the age of 14 about matters related to the
        processing of personal information, is it done using a format and language
        that is easy for them to understand?

        - For personal information that can be processed without the consent of the
        data subject, are the items and legal grounds for processing distinguished
        from those that require consent, and is this information disclosed in the
        privacy policy or otherwise communicated to the data subject?

        - When using personal information for purposes beyond the original intent
        without the consent of the data subject, are criteria established and implemented
        to assess factors such as the relevance to the original purpose, predictability,
        potential harm to the data subject, and security measures? If additional use
        occurs continuously, are these criteria disclosed in the privacy policy and
        regularly reviewed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.2
      name: Limitation on the Collection of Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1184
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.2
      description: When collecting personal data, you must collect only the minimum
        amount of information necessary for the stated purpose, whether based on legal
        grounds, compliance with legal obligations, or contract performance
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1185
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1184
      description: "Even if collecting personal data without the data subject\u2019\
        s consent, based on legal grounds or compliance with legal obligations, you\
        \ must still collect only the minimum required data for the intended purpose."
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1186
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1184
      description: The responsibility to prove the necessity of collecting minimal
        personal data lies with the data processor, so you must be able to demonstrate
        that the information collected is essential for providing the service (with
        "minimal personal data" referring to information necessary for the core functionality
        of the service).
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1187
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.2
      description: When collecting personal data with the data subject's consent,
        you must clearly inform them that they can refuse to provide information beyond
        what is necessary.
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1188
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1187
      description: Distinguish and clearly indicate which information is essential
        and which is not, so that the data subject can easily identify it.
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1189
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1187
      description: Inform the data subject that they can freely refuse to provide
        non-essential information without affecting their ability to use goods or
        services.
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1190
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.2
      description: Ensure that refusal to provide non-essential personal data does
        not result in denial of services or goods.
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1191
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1190
      description: Clearly state that opting out of optional information does not
        affect the ability to use the essential services.
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1192
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1190
      description: Implement systems so that essential services, like membership registration,
        remain accessible even if optional data is not provided.
      annotation: 'Key Points for Verification:

        - When collecting personal data, are you collecting only the minimum amount
        of information necessary for the stated purpose?

        - When obtaining consent from the data subject to collect personal data, are
        you specifically informing them that they can refuse to consent to the collection
        of information beyond the minimum required?

        - Are you ensuring that refusal to consent to the collection of personal data
        beyond what is necessary does not result in the denial of service or goods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.3
      name: Limitation on the Processing of Resident Registration Numbers
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1194
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.3
      description: Resident registration numbers cannot be collected or processed
        except in cases where there are legal grounds as outlined below.
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1195
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1194
      description: Cases where the collection and processing of resident registration
        numbers are permitted (collection based on consent is not allowed).
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1196
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.3
      description: When processing resident registration numbers, you must specifically
        identify and be able to prove the legal provisions that justify such processing.
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1197
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1196
      description: The phrase "when laws, Presidential Decrees, rules of the National
        Assembly, Supreme Court, Constitutional Court, National Election Commission,
        or Board of Audit and Inspection specifically require or allow the processing
        of resident registration numbers" means that there must be a specific provision
        in at least one of these legal texts that explicitly requires or permits the
        processing of resident registration numbers by a data controller.
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1198
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1196
      description: Under Article 24-2(1)(1) of the Personal Information Protection
        Act, the scope of laws that allow the processing of resident registration
        numbers is limited, so it is not permitted to process them based solely on
        enforcement rules.
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1199
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1196
      description: According to Article 24-2(1)(2) of the Personal Information Protection
        Act, processing of resident registration numbers is exceptionally permitted
        if it is clearly necessary to protect the urgent life, body, or property interests
        of the data subject or a third party.
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1200
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1196
      description: Collection, provision to third parties, storage, or retention of
        resident registration numbers is prohibited unless it falls under one of the
        exceptions specified in each subparagraph of Article 24-2(1) of the Personal
        Information Protection Act.
      annotation: 'Key Points for Verification:

        - Is the handling of resident registration numbers limited to cases with clear
        legal grounds?

        - Are the legal provisions justifying the collection of resident registration
        numbers specifically identified?

        - Even when processing resident registration numbers based on legal grounds,
        is there an option for individuals to register as members on the website without
        using their resident registration numbers?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1201
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.3
      description: Even when processing resident registration numbers based on legal
        grounds, an alternative method for membership registration must be provided,
        allowing users to sign up on the website without using their resident registration
        number.
      annotation: 'Examples of alternative registration methods: i-PIN, mobile phone
        verification, credit card, digital certificate, etc.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.4
      name: Limitation on the Processing of Sensitive and Unique Identifying Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1203
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.4
      description: Sensitive information is, in principle, prohibited from being processed.
        However, it can be processed if separate consent is obtained from the data
        subject or if there is a legal basis for it.
      annotation: 'Scope of Sensitive Information:

        1. Ideologies and Beliefs: Information on various ideologies or ideological
        tendencies, and religious beliefs.

        2. Political Views: Information on one''s stance on political issues or support
        for a particular political party.

        3. Union or Party Membership: Information regarding membership or withdrawal
        from labor unions or political parties.

        4. Health and Sexual Life: Information on past or present medical history,
        physical or mental disabilities (including disability grades), and sexual
        preferences.

        5. Personal Information That May Seriously Infringe Privacy:

        - Genetic information obtained from genetic testing and criminal records.

        - Information on sentencing or exemption from sentences of fines or higher,
        protective custody, treatment custody, probation, the invalidation of probation,
        the cancellation of suspended sentences, forfeiture, confiscation, community
        service orders, detention orders, etc.

        - Information on the physical, physiological, or behavioral characteristics
        of an individual, created using specific technical means for the purpose of
        identifying the individual (biometric characteristic information).

        - Information on race or ethnicity.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1204
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1203
      description: 'Cases Where Sensitive Information Processing is Permissible:

        When separate consent is obtained from the data subject, distinct from the
        consent for the processing of other personal information.

        When the processing of sensitive information is required or permitted by law.'
      annotation: 'Key Points for Verification:

        - Is sensitive information processed only when separate consent is obtained
        from the data subject or when there is a legal basis for it?

        - Is unique identification information (excluding resident registration numbers)
        processed only when separate consent is obtained from the data subject or
        when there is a specific legal basis for it?

        - When there is a risk of privacy invasion due to the inclusion of the data
        subject''s sensitive information in information disclosed during the provision
        of goods or services, is the data subject clearly informed of the possibility
        of disclosure and the method to choose non-disclosure before providing the
        goods or services?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1205
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.4
      description: Unique Identifying Information (excluding Resident Registration
        Numbers) must only be processed if separate consent is obtained from the data
        subject or if there is a specific legal basis for it.
      annotation: 'Scope of Unique Identifying Information:

        1. Resident Registration Number: (However, collection based on consent is
        not permitted due to legal restrictions on its collection.)

        2. Passport Number

        3. Driver''s License Number

        4. Alien Registration Number'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1206
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1205
      description: 'Cases Where the Processing of Unique Identifying Information (excluding
        Resident Registration Numbers) is Permissible:


        When separate consent is obtained from the data subject, distinct from the
        consent for the processing of other personal information.

        When the processing of unique identifying information is specifically required
        or permitted by law.'
      annotation: 'Key Points for Verification:

        - Is sensitive information processed only when separate consent is obtained
        from the data subject or when there is a legal basis for it?

        - Is unique identification information (excluding resident registration numbers)
        processed only when separate consent is obtained from the data subject or
        when there is a specific legal basis for it?

        - When there is a risk of privacy invasion due to the inclusion of the data
        subject''s sensitive information in information disclosed during the provision
        of goods or services, is the data subject clearly informed of the possibility
        of disclosure and the method to choose non-disclosure before providing the
        goods or services?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1207
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.4
      description: When providing goods or services, if it is determined that the
        disclosure of the data subject's sensitive information could pose a risk to
        privacy, the data subject must be clearly informed in an easily understandable
        way about the possibility of sensitive information being disclosed and how
        to opt for non-disclosure before the goods or services are provided.
      annotation: 'Key Points for Verification:

        - Is sensitive information processed only when separate consent is obtained
        from the data subject or when there is a legal basis for it?

        - Is unique identification information (excluding resident registration numbers)
        processed only when separate consent is obtained from the data subject or
        when there is a specific legal basis for it?

        - When there is a risk of privacy invasion due to the inclusion of the data
        subject''s sensitive information in information disclosed during the provision
        of goods or services, is the data subject clearly informed of the possibility
        of disclosure and the method to choose non-disclosure before providing the
        goods or services?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1208
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1207
      description: If applicable, this must also be disclosed in the privacy policy.
      annotation: 'Key Points for Verification:

        - Is sensitive information processed only when separate consent is obtained
        from the data subject or when there is a legal basis for it?

        - Is unique identification information (excluding resident registration numbers)
        processed only when separate consent is obtained from the data subject or
        when there is a specific legal basis for it?

        - When there is a risk of privacy invasion due to the inclusion of the data
        subject''s sensitive information in information disclosed during the provision
        of goods or services, is the data subject clearly informed of the possibility
        of disclosure and the method to choose non-disclosure before providing the
        goods or services?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.5
      name: ' Indirect Collection of Personal Information'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1210
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      description: When receiving personal information from a third party other than
        the data subject, it is necessary to verify whether the information was collected
        and provided through lawful procedures. Additionally, the contract must clearly
        specify that the responsibility for obtaining consent for the collection of
        personal information lies with the provider.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1211
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      description: When collecting personal information from publicly available media
        or locations such as SNS or websites, the information can only be used within
        the scope where the data subject's consent is clearly indicated or within
        the extent where consent is reasonably assumed based on social norms (Standard
        Guidelines for Personal Information Protection, Article 6, Paragraph 4).
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1212
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      description: Even when collecting or generating personal information through
        automatic collection devices (e.g., call records, access logs, payment records,
        usage history) during the service provision process, only the minimum necessary
        personal information required to fulfill and provide the service contract
        should be collected.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1213
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1212
      description: However, if the information is collected for purposes unrelated
        to service provision, it should be classified as an optional consent item,
        and separate prior consent must be obtained (e.g., using behavioral information
        collected through cookies for personalized advertising).
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1214
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      description: If personal information is collected from sources other than the
        data subject, and the data subject requests it, the necessary details must
        be promptly communicated to the data subject.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1215
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1214
      description: 'When a data subject requests information, the following details
        must be provided:'
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1216
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1215
      description: The source of the collected personal information.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1217
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1215
      description: The purpose of processing the personal information.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1218
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1215
      description: The fact that the data subject has the right to request the cessation
        of processing or to withdraw consent.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1219
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1214
      description: Unless there is a legitimate reason, the information must be communicated
        to the data subject within 3 days from the date of the request (Standard Guidelines
        for Personal Information Protection, Article 9, Paragraph 1).
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1220
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1214
      description: If the request is refused due to concerns such as potential harm
        to another person's life or body, the grounds and reasons for refusal must
        be communicated to the data subject within 3 days from the date of the request,
        unless there is a legitimate reason (Standard Guidelines for Personal Information
        Protection, Article 9, Paragraph 2).
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1221
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      description: When processing personal information collected from sources other
        than the data subject, the necessary details must be communicated to the data
        subject if the type and scope of the information meet legal requirements.
      annotation: You will find a table of Requirements and Methods for Notification
        on page 204
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1222
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1221
      description: The obligation to notify the source of personal information applies
        only to personal information collected from personal information controllers
        who have provided the information with the data subject's consent under Article
        17(1)1 of the Personal Information Protection Act. This does not apply to
        personal information collected from entities that provided it under the Credit
        Information Act or other legal provisions (Personal Information Protection
        Act regulations and guidelines).
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1223
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1221
      description: If the collected information does not include contact information
        or other data that can be used to inform the data subject, there is no obligation
        to notify.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1224
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.5
      description: Records of notifying the data subject about the source of the collected
        information must be retained and managed until the personal information is
        destroyed.
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1225
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1224
      description: 'Information to be retained and managed related to source notification
        (Personal Information Protection Act Enforcement Decree Article 15-2(4)):'
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1226
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1225
      description: Facts notified to the data subject
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1227
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1225
      description: Timing of notification
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1228
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1225
      description: Method of notification
      annotation: 'Key Points for Verification:

        - When receiving personal information from a third party other than the data
        subject, is it clearly stated in the contract that the responsibility for
        obtaining consent for the collection of personal information lies with the
        provider of the information?

        - When collecting personal information from publicly available media and locations,
        is the information collected and used only within the scope of the data subject''s
        intended purpose, the range of disclosure, and the extent to which consent
        is reasonably assumed according to social norms?

        - In cases where personal information is collected or generated through automatic
        collection devices during the service provision process, and it is necessary
        for fulfilling the service contract, is the principle of minimal collection
        applied?

        - When collecting personal information from sources other than the data subject,
        is the data subject promptly informed of the necessary details upon their
        request?

        - When processing personal information collected from sources other than the
        data subject, if the type or scope of the personal information meets legal
        requirements, are the necessary details communicated to the data subject?

        - Is the record of informing the data subject about the source of the collected
        information kept and managed until the personal information is destroyed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.6
      name: Installation and Operation of Video Information Processing Devices
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1230
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: When installing and operating fixed surveillance cameras in public
        places, you must review whether they meet the legal requirements.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1231
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1230
      description: These are devices installed in a specific location that continuously
        or periodically capture images of people or objects, or transmit these images
        via wired or wireless networks. This includes closed-circuit television (CCTV)
        and network cameras (as defined in Article 2, Item 7 of the Personal Information
        Protection Act and Article 3, Paragraph 1 of the Enforcement Decree of the
        same Act).
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1230
      description: 'Fixed surveillance cameras can be installed and operated in public
        places only under the following circumstances:'
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1233
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      description: When specifically permitted by law.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1234
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      description: When necessary for the prevention and investigation of crime.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1235
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      description: When installed and operated by authorized personnel for the safety
        and management of facilities, and fire prevention.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1236
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      description: When installed and operated by authorized personnel for traffic
        enforcement.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1237
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      description: When installed and operated by authorized personnel for collecting,
        analyzing, and providing traffic information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1238
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1232
      description: 'When the captured video information is not stored and falls under
        one of the following cases:'
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1239
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1238
      description: For calculating statistics such as the number of visitors.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1240
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1238
      description: To derive statistical characteristics such as gender and age group.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1241
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1238
      description: In other cases similar to the above two, subject to review and
        resolution by the Personal Information Protection Commission.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1242
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1230
      description: It is prohibited to install and operate surveillance cameras in
        places such as public baths, restrooms, sweat rooms, and changing rooms, where
        there is a significant risk of infringing on personal privacy. However, exceptions
        are made for facilities that detain or protect individuals based on legal
        grounds, such as prisons and mental health facilities designated by Presidential
        Decree (correctional facilities, mental health institutions with detention
        facilities, mental health care facilities, and mental rehabilitation facilities).
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1243
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: When public institutions wish to install and operate fixed surveillance
        cameras in public places, they must follow legal procedures such as public
        hearings or briefings to collect opinions from relevant experts and stakeholders.
      annotation: 'Entities Required to Collect Opinions:

        - Heads of public institutions intending to install and operate fixed surveillance
        cameras in public places.

        - Correctional facilities, mental health institutions, mental health care
        facilities, and mental rehabilitation facilities intending to install cameras
        that may significantly infringe on personal privacy.


        Opinion Collection Procedures:

        - Conducting administrative notices or soliciting opinions according to the
        Administrative Procedure Act.

        - Holding briefings, surveys, or public opinion polls for local residents
        directly affected by the installation of the surveillance cameras.


        Opinion Collectors:

        - Relevant experts.

        - Individuals working at the facility, those detained or protected at the
        facility, or their guardians and other stakeholders.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1244
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: When installing and operating fixed surveillance cameras, an information
        board must be installed to ensure that individuals can easily recognize the
        presence of the cameras.
      annotation: 'Information to Include on the Board:[Details about what should
        be included on the board were not provided in your request. Typically, this
        information would include the purpose of the surveillance, contact information
        for the responsible entity, and details about how the footage will be used
        and managed.]

        1.Purpose and Location of Installation

        2.Range and Time of Surveillance

        3.Contact Information of the Responsible Manager

        4.Name and Contact Information of the Entrusted Party (if the operation and
        management of the surveillance system are outsourced)


        Exceptions for Installing Information Boards:

        1.Military Facilities

        2.National Key Facilities

        3.National Security Facilities'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1245
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1244
      description: "Considerations for Installing Information Boards:\nInstall the\
        \ board in a location that is easily noticeable by the individuals concerned.\n\
        If multiple fixed surveillance cameras are installed within a building, a\
        \ single information board indicating that the entire facility or area is\
        \ under surveillance can be installed in a prominent location, such as at\
        \ the entrance.\nIn cases where a public institution installs fixed surveillance\
        \ cameras for long-distance recording, monitoring speeding or signal violations,\
        \ traffic flow studies, or monitoring forest fires\u2014where there is minimal\
        \ concern for privacy violations\u2014if it is impossible to install an information\
        \ board or if an information board would not be easily visible to individuals\
        \ due to the specific characteristics of the location, the relevant information\
        \ can be posted on the institution's website."
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1246
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: When operating mobile surveillance cameras in public places for
        work purposes, you must verify that they meet legal requirements and take
        the necessary actions accordingly.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1247
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1246
      description: Devices worn or carried on the body, attached to, or mounted on
        a mobile object, used to capture images or videos of people or objects, or
        to transmit this footage via wired or wireless networks, as defined by Presidential
        Decree (Article 2, Paragraph 7-2 of the Personal Information Protection Act,
        and Article 3, Paragraph 2 of the Enforcement Decree).
      annotation: 'Cases Where Mobile Surveillance Cameras Can Be Operated in Public
        Places for Work Purposes:


        1. When any of the conditions in Article 15, Paragraph 1 of the Personal Information
        Protection Act are met (e.g., with the consent of the data subject).


        2. When the fact that recording is taking place is clearly indicated, allowing
        the data subject to be aware of the recording, and the data subject has not
        expressed a refusal to be recorded. In such cases, it must be ensured that
        the recording does not unfairly infringe on the rights of the data subject
        and remains within reasonable limits.


        3. Other cases similar to the above, as specified by Presidential Decree.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1248
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1246
      description: ' It is prohibited to film people or objects related to them with
        mobile surveillance cameras in places where the privacy of individuals is
        at significant risk, such as public baths, restrooms, saunas, and changing
        rooms. However, exceptions are made in situations like crimes, disasters,
        fires, or similar emergencies where video recording is necessary for rescuing
        or assisting lives.'
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1249
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: When filming people or objects related to them with mobile surveillance
        cameras in public places for work purposes, the filming should be clearly
        indicated using lights, sounds, signs, or other methods to ensure that the
        data subject is easily aware of the filming.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1250
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1249
      description: 'Methods to Indicate Filming: Lights, sounds, signs, written notices,
        announcements, or other similar means.

        '
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1251
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1249
      description: 'Exceptions to Indicating Filming: If it is difficult to notify
        data subjects due to the nature of filming, such as aerial photography by
        drones, the fact and purpose of filming, as well as the date, time, and location,
        must be announced through a website managed by the Personal Information Protection
        Commission to support the indication of mobile surveillance camera filming
        (Standard Personal Information Protection Guidelines, Article 39-2, Paragraph
        2)'
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1252
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: Operators of surveillance cameras must establish and implement
        policies for the safe management of surveillance cameras and the video information
        collected by them.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1253
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1252
      description: Operators of fixed surveillance cameras should establish fixed
        surveillance camera operation and management policies, while operators of
        mobile surveillance cameras should establish mobile surveillance camera operation
        and management policies.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1252
      description: 'Information that must be included in the surveillance camera operation
        and management policy:'
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1255
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: The legal basis and purpose of installing the surveillance cameras.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1256
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: The number of cameras installed, their locations, and the range
        of coverage.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1257
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: The person responsible for management, the department in charge,
        and the individuals with access to the video information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1258
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: The recording times, retention periods, storage locations, and
        processing methods of the video information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1259
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: Methods and locations for verifying video information by the operator.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1260
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: Measures for handling requests from data subjects for access to
        their video information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1261
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: Technical, administrative, and physical measures for the protection
        of video information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1262
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1254
      description: Other necessary matters regarding the installation, operation,
        and management of surveillance cameras.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1263
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1252
      description: If a privacy policy already includes matters related to the operation
        and management of surveillance cameras, a separate surveillance camera operation
        and management policy may not be required.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1264
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1252
      description: Regulations should include provisions to prevent fixed surveillance
        cameras from being manipulated or pointed at unintended locations, ensuring
        management and supervision.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1265
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1252
      description: Fixed surveillance cameras should not have their audio recording
        functions activated.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1266
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: A retention period must be established for the video information,
        and the information must be promptly destroyed once the retention period expires.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1267
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1266
      description: The retention period should be determined to be the minimum necessary
        to achieve the purpose of retaining the video information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1268
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1266
      description: However, if there are specific provisions in other laws regarding
        the retention period, those provisions should be followed.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1269
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1266
      description: If the operator of the surveillance cameras finds it difficult
        to determine the minimum period required to achieve the purpose of retention,
        the retention period should be set to within 30 days from the date of collection
        of personal video information (Standard Personal Information Protection Guidelines,
        Article 41, Paragraph 2).
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1270
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.6
      description: When delegating the installation and operation of video surveillance
        systems to an external party, the necessary details must be included in the
        contract according to the relevant procedures and requirements.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1271
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1270
      description: 'Items that must be included in the contract for public institutions
        when outsourcing the installation and operation of video surveillance systems
        (Article 26, Paragraph 1 of the Enforcement Decree of the Personal Information
        Protection Act):'
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1272
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1271
      description: The purpose and scope of the delegated tasks.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1273
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1271
      description: Restrictions on further subcontracting.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1274
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1271
      description: Measures to ensure security, such as restricting access to video
        information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1275
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1271
      description: Provisions for inspecting the management status of video information.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1276
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1271
      description: Liability, including compensation for damages, in case the subcontractor
        violates the obligations they must adhere to.
      annotation: 'Key Points for Verification:

        - When installing and operating fixed surveillance cameras in public places,
        have you reviewed whether it meets the legal requirements for such activities?

        - When public institutions or similar entities plan to install and operate
        fixed surveillance cameras in public places, have they followed the legal
        procedures such as holding public hearings or informational meetings to gather
        opinions from relevant experts and stakeholders?

        - When installing and operating fixed surveillance cameras, have you taken
        necessary measures, such as installing signage, to ensure that data subjects
        can easily recognize the presence of the cameras?

        - When operating mobile surveillance cameras in public places for business
        purposes, have you reviewed whether it meets the legal requirements for such
        activities?

        - When using mobile surveillance cameras to capture images of people or objects
        associated with them in public places for business purposes, do you inform
        and notify individuals of the filming through methods such as lights, sounds,
        or signage?

        - Have you established and implemented policies for the safe management and
        operation of surveillance cameras and video data?

        - Do you have a set retention period for video data, and do you promptly destroy
        the data when the retention period expires?

        - When outsourcing the installation and operation of surveillance cameras,
        are the relevant procedures and requirements reflected in the contract?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.1.7
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1
      ref_id: 3.1.7
      name: Collection and Use of Personal Information for Marketing Purposes
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1278
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.7
      description: When intending to process personal information to promote or sell
        goods or services to the data subject, you must inform the data subject in
        a way that is clear and understandable and obtain separate consent.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1279
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1278
      description: "It is prohibited to collect personal information for \u2018promotion\
        \ and marketing\u2019 purposes while describing the purpose as \u2018providing\
        \ additional services\u2019 or \u2018providing partnership services\u2019."
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1280
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1278
      description: Personal information collected for product promotion or marketing
        purposes must be clearly distinguished from information collected for other
        purposes, and consent must be obtained separately.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1281
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1278
      description: The fact that the personal information will be used to contact
        the data subject for the promotion or solicitation of goods or services must
        be clearly indicated, and the consent form should be designed to be easily
        understood (using font size, color, bolding, or underlining to make the information
        stand out).
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.7
      description: When sending commercial advertising information using electronic
        transmission media, explicit prior consent from the recipient must be obtained,
        and the recipient's consent status must be regularly checked every two years.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1283
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      description: "\u2018Electronic transmission media\u2019 includes mobile phones,\
        \ landlines, faxes, messengers, emails, and bulletin boards."
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1284
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      description: To send commercial advertising information, explicit consent from
        the recipient must be obtained through a document (including electronic documents)
        or verbal means.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1285
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      description: "Consent for the promotion or solicitation of goods or services\
        \ under Article 22, Paragraph 1, Subparagraph 7 of the Personal Information\
        \ Protection Act corresponds to the consent for the collection and use of\
        \ the recipient\u2019s personal information by the sender to transmit advertising\
        \ information. Meanwhile, the consent under Article 50, Paragraph 1 of the\
        \ Information and Communications Network Act pertains to the recipient agreeing\
        \ to receive advertising information from the sender. These two types of consent\
        \ must be distinguished and obtained separately."
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1286
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      description: Simply downloading and installing a smartphone app (application)
        does not allow the transmission of advertising information (app push notifications).
        Advertising should only be sent after checking whether the recipient agrees
        to receive advertising information when the app is first launched and obtaining
        their consent.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1287
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      description: However, if the exception based on a transaction relationship applies,
        it is possible to send advertising information without obtaining consent to
        receive it.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1288
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1282
      description: A sender who transmits advertising information after obtaining
        the recipient's consent must verify the recipient's consent every two years
        from the date the consent was initially obtained.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1289
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1288
      description: This obligation is to inform the recipient that they have consented
        to receive the information, so there is no need to obtain consent again.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1290
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1288
      description: If the recipient does not express any intention, it is assumed
        that the consent for receiving messages remains valid.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1291
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1288
      description: 'When confirming the recipient''s consent, the following details
        must be provided:'
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1292
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1291
      description: The sender's name
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1293
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1291
      description: The date of consent and confirmation of consent
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1294
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1291
      description: How to express the intention to maintain or withdraw consent
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1295
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.7
      description: If a recipient indicates refusal to receive or withdraws their
        prior consent for advertising messages sent via electronic means, the sender
        must stop sending such advertising information.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1296
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1295
      description: Even if there is an existing business relationship, if the recipient
        expresses refusal to receive, sending advertising messages is prohibited.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1297
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1295
      description: Unsubscribing from membership is also considered as expressing
        refusal to receive, so no advertising messages should be sent to those who
        have unsubscribed.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1298
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1295
      description: Unless the recipient specifically limits their refusal or withdrawal
        of consent to particular messages, the refusal applies to all advertising
        messages from the sender.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1299
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.1.7
      description: 'When sending advertising information for commercial purposes,
        the following details must be clearly stated:'
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1300
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1299
      description: The sender's name and contact information
      annotation: Compliance with the "Information and Communication Network Act Enforcement
        Decree Appendix 6 (Details and Methods for Commercial Advertising Information)"
        is required.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1301
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1300
      description: Details and methods for easily expressing refusal or withdrawal
        of consent
      annotation: Compliance with the "Information and Communication Network Act Enforcement
        Decree Appendix 6 (Details and Methods for Commercial Advertising Information)"
        is required.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1302
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1299
      description: Advertising messages cannot be sent via electronic means during
        night hours (from 9 PM to 8 AM the next day) unless there is separate consent.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1303
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1302
      description: However, sending advertising emails during the night is permissible
        without additional consent.
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1304
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1302
      description: For more detailed information, refer to the "Information and Communication
        Network Act Guide for Preventing Illegal Spam."
      annotation: 'Key Points for Verification:

        - When obtaining consent from the data subject for the processing of personal
        information for the purpose of promoting or selling goods or services, are
        you informing the data subject clearly and obtaining separate consent?

        - When sending commercial advertising information using electronic transmission
        media, are you obtaining the recipient''s explicit prior consent, and checking
        the recipient''s consent status every two years?

        - If the recipient expresses a refusal to receive commercial advertising information
        sent via electronic transmission media or withdraws their prior consent, are
        you ensuring that the transmission of commercial advertising information is
        discontinued?

        - When sending commercial advertising information, are you clearly indicating
        the sender''s name and the method to opt out, and ensuring that such information
        is not sent during nighttime hours?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.2
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3
      ref_id: '3.2'
      name: Protection Measures During Retention and Use of Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.2.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2
      ref_id: 3.2.1
      name: Management of Personal Information Status
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1307
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.1
      description: You must regularly manage the status of the personal data you collect
        and retain, including the items of data, quantity, processing purposes and
        methods, and retention periods.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1308
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1307
      description: Data controllers (information and communication service providers)
        must identify and record/manage the items of personal data, quantity, processing
        basis (consent, legal provisions, etc.), processing purposes and methods,
        and retention periods using personal data status tables, flow charts, or diagrams.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1309
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1307
      description: Additionally, you should regularly review the personal data status
        and update the relevant documents.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1310
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.1
      description: When public institutions operate or modify personal data files,
        they must register the relevant information with the heads of the related
        agencies as required by law, and update the registration if there are any
        changes.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1311
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1310
      description: The data protection officer who receives the personal data file
        registration or modification application must review and assess the appropriateness
        of the registration or modification and submit it to the Personal Information
        Protection Commission within 60 days.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1312
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1310
      description: Central administrative agencies, local government agencies, and
        other public institutions must request review and appropriateness judgment
        from their higher management bodies for personal data file registration or
        modification, and obtain confirmation from the higher management body before
        registering with the Personal Information Protection Commission within 60
        days.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1313
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1310
      description: For the National Assembly, the judiciary, the Constitutional Court,
        and the Central Election Commission (including its affiliated bodies), personal
        data file registration and disclosure follow the rules of the National Assembly,
        Supreme Court, Constitutional Court, and Central Election Commission.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1314
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1310
      description: However, personal data files falling under Article 32(2) of the
        Personal Information Protection Act do not need to be registered with the
        Personal Information Protection Commission.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1315
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.1
      description: Public institutions must disclose the status of personal data files
        in their personal data processing policies.
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1316
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1315
      description: The data protection officer of a public institution must regularly
        investigate the status of personal data file retention and destruction and
        disclose the results in the institution's personal data processing policy.
        (Standard Personal Data Protection Guidelines, Article 61)
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1317
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1315
      description: The Personal Information Protection Commission must make the status
        of personal data file registrations publicly available on the internet, so
        that anyone can easily access it. (Personal Information Portal, www.privacy.go.kr)
      annotation: 'Key Points for Verification:

        - Are you regularly managing the current status of the personal data you collect
        and retain, including the types of data, quantity, purposes and methods of
        processing, and retention periods?

        - When public institutions operate or modify personal data files, do they
        register the relevant information with the heads of the related agencies as
        required by law?

        - Do public institutions disclose the status of their personal data files
        in their privacy policies?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.2.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2
      ref_id: 3.2.2
      name: Ensuring the Quality of Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1319
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.2
      description: Procedures and measures must be established and implemented to
        ensure that personal data is maintained accurately and up-to-date.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1320
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1319
      description: Apply safety measures to prevent personal data from being forged,
        altered, or damaged.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1321
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1319
      description: Build and implement systems for backup and recovery to ensure the
        accuracy and completeness of personal data, even in the event of illegal changes,
        damage due to external hacking, internal abuse of authority, or disasters.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1322
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1319
      description: Apply administrative and technical measures to prevent errors in
        personal data input when it is altered by data handlers.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1323
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1319
      description: Establish and implement procedures to update personal data when
        data subjects change their name or resident registration number, such as due
        to name changes or data breaches.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1324
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.2
      description: Methods must be provided for data subjects to ensure the accuracy,
        completeness, and timeliness of their personal data.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1325
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1324
      description: Notify data subjects regularly about the ability to update their
        personal data via the website.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1326
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1324
      description: Provide various methods for data subjects to easily view and update
        their personal data, both online and offline.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1327
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1324
      description: Develop and implement secure identity verification procedures for
        personal data changes.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1328
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1324
      description: Make it easy for data subjects to understand changes and updates
        to the privacy policy and the history of personal data processing by posting
        relevant information clearly.
      annotation: 'Key Points for Verification:

        - Have procedures and measures been established and implemented to maintain
        personal data in an accurate and up-to-date condition?

        - Are there methods provided for data subjects to ensure the accuracy, completeness,
        and timeliness of their personal data?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.2.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2
      ref_id: 3.2.3
      name: Protection of Access to User Devices
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1330
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.3
      description: If access to information stored on the data subject's (user's)
        mobile communication device or to features installed on the mobile communication
        device is required, you must clearly inform the data subject (user) about
        this requirement and obtain their consent.
      annotation: 'Key Points for Verification:

        - If access to information stored on the data subject''s (user''s) mobile
        communication device or to features installed on the mobile communication
        device is required, is it clearly communicated to the data subject (user)
        and is their consent obtained?

        - If the access permission is not essential for providing the service, are
        you ensuring that the service is not denied if the data subject (user) does
        not consent?

        - Have you established and provided methods for obtaining and withdrawing
        consent from the data subject (user) for the required access permissions on
        the mobile communication device?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1331
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1330
      description: The permission to access information and features stored on a smartphone
        should be minimized to the extent necessary for the service.
      annotation: 'Key Points for Verification:

        - If access to information stored on the data subject''s (user''s) mobile
        communication device or to features installed on the mobile communication
        device is required, is it clearly communicated to the data subject (user)
        and is their consent obtained?

        - If the access permission is not essential for providing the service, are
        you ensuring that the service is not denied if the data subject (user) does
        not consent?

        - Have you established and provided methods for obtaining and withdrawing
        consent from the data subject (user) for the required access permissions on
        the mobile communication device?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1332
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1330
      description: Before obtaining consent for access permissions, distinguish between
        access permissions that are absolutely necessary for providing the service
        (referred to as 'essential access permissions') and those that are not strictly
        necessary (referred to as 'optional access permissions'). Clearly inform the
        data subject (user) about the items and reasons for each type of access permission,
        and obtain separate consent from them for both essential and optional access
        permissions.
      annotation: 'Key Points for Verification:

        - If access to information stored on the data subject''s (user''s) mobile
        communication device or to features installed on the mobile communication
        device is required, is it clearly communicated to the data subject (user)
        and is their consent obtained?

        - If the access permission is not essential for providing the service, are
        you ensuring that the service is not denied if the data subject (user) does
        not consent?

        - Have you established and provided methods for obtaining and withdrawing
        consent from the data subject (user) for the required access permissions on
        the mobile communication device?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1333
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1332
      description: '(For essential access permissions): 1. Inform the data subject
        (user) of the items of information and features that require access permissions.
        2. Explain the reasons why access to these information and features is necessary.'
      annotation: 'Key Points for Verification:

        - If access to information stored on the data subject''s (user''s) mobile
        communication device or to features installed on the mobile communication
        device is required, is it clearly communicated to the data subject (user)
        and is their consent obtained?

        - If the access permission is not essential for providing the service, are
        you ensuring that the service is not denied if the data subject (user) does
        not consent?

        - Have you established and provided methods for obtaining and withdrawing
        consent from the data subject (user) for the required access permissions on
        the mobile communication device?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1334
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1332
      description: '(For optional access permissions): In addition to the items 1
        and 2 above, you must also inform the data subject (user) that they have the
        option to refuse to consent to the access permission.'
      annotation: 'Key Points for Verification:

        - If access to information stored on the data subject''s (user''s) mobile
        communication device or to features installed on the mobile communication
        device is required, is it clearly communicated to the data subject (user)
        and is their consent obtained?

        - If the access permission is not essential for providing the service, are
        you ensuring that the service is not denied if the data subject (user) does
        not consent?

        - Have you established and provided methods for obtaining and withdrawing
        consent from the data subject (user) for the required access permissions on
        the mobile communication device?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1335
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.3
      description: If access permissions that are not essential for providing the
        service are required on a mobile communication device, the data subject (user)
        should not be denied service if they choose not to consent.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1336
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.3
      description: You must establish and provide methods for the data subject (user)
        to consent to or withdraw consent for access permissions on the mobile communication
        device.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1337
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1336
      description: '(For operating systems with individual consent selection capability,
        such as Android 6.0 or higher and iPhone): Even if the data subject (user)
        has already consented to access permissions, they can use the app-specific
        or permission-specific consent withdrawal features provided by the operating
        system to reset permissions for each app.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1338
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1336
      description: "(For operating systems without individual consent selection capability):\
        \ Since the system does not support denial of permissions on a per-permission\
        \ basis and generally only allows setting essential permissions, if the data\
        \ subject (user) wishes to withdraw consent for these essential permissions,\
        \ they should uninstall the app. However, if the app itself provides a feature\
        \ to set optional permissions and choose whether to consent, the data subject\
        \ can use the app\u2019s consent withdrawal feature to reset the permissions."
      annotation: 'Note: For more detailed information, refer to the ''Smartphone
        App Access Permission Privacy Protection Guide.'''
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2
      ref_id: 3.2.4
      name: Use and Provision of Personal Information Beyond the Original Purpose
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1340
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      description: Personal data must be used or provided only within the scope of
        the purpose for which consent was obtained from the data subject at the time
        of initial collection or based on legal grounds.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1341
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1340
      description: You must notify the data subject of the purpose of use or provision
        and obtain consent within the scope allowed by the Personal Information Protection
        Act or other laws. It is prohibited to use or provide personal data beyond
        the scope permitted by the consent obtained or by law.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1342
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      description: When receiving personal data from a data processor, it must be
        used or provided only within the scope of the purpose for which it was provided.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1343
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1342
      description: The recipient of personal data is prohibited from using or providing
        the data for purposes other than those for which it was provided or from providing
        it to third parties.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1344
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      description: If personal data is used or provided beyond the scope of the collection
        purpose or the purpose for which it was provided by the data processor, it
        should be limited to cases where separate consent from the data subject is
        obtained or where there is a legal basis for such use.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1345
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1344
      description: Exceptions may apply where the use or provision of personal data
        for purposes other than those initially intended is allowed (except where
        there is a risk of unjustly infringing on the rights of the data subject or
        third parties).
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1346
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1344
      description: 'When obtaining consent for using or providing personal data for
        purposes other than those originally intended, the following information must
        be provided:'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1347
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1346
      description: The recipient of the personal data
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1348
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1346
      description: The purpose of using the personal data (for provision, the recipient's
        purpose)
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1349
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1346
      description: The items of personal data to be used or provided
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1350
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1346
      description: The retention and use period of the personal data (for provision,
        the recipient's retention and use period)
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1351
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1346
      description: The right to refuse consent and, if refusal results in any disadvantages,
        the details of those disadvantages
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1352
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1344
      description: 'The recipient of personal data from another data processor must
        not use the data for purposes other than those for which it was provided or
        provide it to third parties, except in the following cases:'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1353
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1352
      description: When separate consent has been obtained from the data subject
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1354
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1352
      description: When there are specific provisions in other laws
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1355
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      description: 'When providing personal data to a third party for purposes other
        than those originally intended, the recipient should be requested to:'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1356
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1355
      description: Restrict the purpose, method, duration, and form of use of the
        personal data
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1357
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1355
      description: Take specific measures to ensure the security of the personal data,
        and these measures should be requested in writing (including electronic documents)
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1358
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1355
      description: Clarification of Responsibilities Regarding the Recipient of Personal
        Data and Measures for Ensuring Data Security
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1359
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      description: When a public institution uses personal data for purposes other
        than those originally intended or provides it to a third party, it must publish
        the necessary details about the legal basis, purpose, and scope of the use
        or provision in the Official Gazette or on its website.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1360
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1359
      description: 'Exceptions to Publication in the Official Gazette or on the Website:'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1361
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1360
      description: When the use or provision of personal data for purposes other than
        those originally intended is based on the consent of the data subject.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1362
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1360
      description: When the use or provision of personal data for purposes other than
        those originally intended is for the investigation of crimes or the initiation
        and maintenance of prosecution.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1363
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1359
      description: 'Details to be Published in the Official Gazette or on the Website:'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1364
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1363
      description: The date of the use or provision of personal data for purposes
        other than those originally intended.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1365
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1363
      description: The legal basis for the use or provision of personal data for purposes
        other than those originally intended.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1366
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1363
      description: The purpose of the use or provision of personal data for purposes
        other than those originally intended.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1367
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1363
      description: The items of personal data used or provided for purposes other
        than those originally intended.
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1368
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1359
      description: 'Timing and Duration of Publication:'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1369
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1368
      description: "Publication Timing:\_Within 30 days from the date of the use or\
        \ provision of personal data for purposes other than those originally intended."
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1370
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1368
      description: "Publication Duration:\_If published on the website, it must remain\
        \ for at least 10 days."
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1371
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.4
      description: When public institutions or other entities use personal data for
        purposes other than those initially intended or provide it to third parties,
        they must record and manage this information in a 'Register of Unauthorized
        Use and Provision of Personal Data.'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1372
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1371
      description: For public institutions, when personal data is used for purposes
        other than those intended or provided to third parties, it must be recorded
        and managed in the 'Register of Unauthorized Use and Provision of Personal
        Data.'
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1373
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1371
      description: Procedures must be established to systematically respond to requests
        for personal data or other materials from judicial or government authorities
        (such as warrants, orders, or demands for data submission).
      annotation: 'Key Points for Verification:

        - Are you using and providing personal data only within the scope of the purposes
        for which consent was obtained from the data subject at the time of initial
        collection or based on legal grounds?

        - If you have received personal data from a data controller, are you using
        and providing it only within the scope of the purposes for which it was provided?

        - If you use or provide personal data beyond the scope of the original collection
        purpose or the purpose for which it was provided by the data controller, are
        you limiting it to cases where you have obtained separate consent from the
        data subject or have a legal basis?

        - When providing personal data to a third party for purposes other than those
        originally intended, do you request that the recipient restrict the use and
        methods of the data and take necessary measures to ensure its security?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it publish the legal
        grounds, purposes, and scope of such use or provision in official publications
        or on its website?

        - When a public institution uses personal data for purposes other than those
        originally intended or provides it to a third party, does it have procedures
        in place to record and manage these instances in a log of non-purpose use
        and third-party provision?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2
      ref_id: 3.2.5
      name: Processing of Pseudonymized Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      description: When processing pseudonymous information, procedures must be established
        and implemented to ensure appropriate handling of pseudonymous information,
        including purpose limitation, pseudonymization methods and criteria, adequacy
        review, prohibition of re-identification, and measures to be taken in case
        re-identification occurs.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1376
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: Pseudonymization' refers to the processing of personal data in
        a way that renders an individual unidentifiable without additional information,
        which can include deleting or replacing part of the data.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1377
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: Pseudonymous information' refers to information that has been pseudonymized
        in such a way that it cannot identify a specific individual without using
        or combining additional information, and this information remains within the
        category of personal data.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1378
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: Pseudonymous information' refers to information that has been pseudonymized
        in such a way that it cannot identify a specific individual without using
        or combining additional information, and this information remains within the
        category of personal data.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1379
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: According to the special provisions for pseudonymous information
        processing, pseudonymous information can be processed without the data subject's
        consent only for the purposes of statistical analysis, scientific research,
        and public interest record preservation. Therefore, pseudonymizing personal
        data for storage without a defined processing purpose does not fall under
        the special provisions for pseudonymous information processing.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1380
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: Procedures for pseudonymization must be established and implemented
        to ensure an appropriate level of pseudonymization, taking into account the
        processing purposes, usage environment, and data characteristics.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1381
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: Examples of Pseudonymization Procedures (Pseudonymous Information
        Processing Guidelines)
      annotation: You will find a table on page 228
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1382
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1375
      description: If separate pseudonymized data processing guidelines exist for
        the relevant field, apply the contents of those guidelines as a priority.
      annotation: 'Examples include: Health and Medical Data Utilization Guidelines
        (Ministry of Health and Welfare), Education Field Pseudonymous and Anonymous
        Information Processing Guidelines (Ministry of Education), Public Sector Pseudonymous
        Information Provision Practical Guide (Ministry of the Interior and Safety),
        Financial Sector Pseudonymous and Anonymous Processing Guide (Financial Services
        Commission), etc.'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1383
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      description: When pseudonymizing personal data for use or provision, it must
        be processed in a manner that ensures individuals cannot be identified without
        using or combining additional information.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1384
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1383
      description: 'Personal Identifiable Information: When necessary, replace it
        with values that cannot identify a specific individual but can distinguish
        between individuals, such as generating random values or hash values.'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1385
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1383
      description: 'Identifiable Information: If not required for the pseudonymous
        information processing purposes, it should be deleted. For the remaining identifiable
        information, pseudonymization should be performed using appropriate methods
        and levels, considering the processing purposes and the risk of identification.'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1386
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      description: When combining pseudonymous information with other data controllers,
        it should be done through a designated combination expert institution or data
        specialist institution.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1387
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1386
      description: If combining pseudonymous information held by different data controllers
        for purposes such as statistical analysis, scientific research, or public
        interest record preservation, it should be done through a combination expert
        institution designated by the Personal Information Protection Commission or
        relevant central administrative agencies.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1388
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1387
      description: 'Expert Institutions: Refer to the Comprehensive Pseudonymous Information
        Combination Support System (link.privacy.go.kr)'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1389
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1387
      description: 'Financial Sector: When combining with datasets held by financial
        companies, it should be performed through a data specialist institution in
        accordance with the Credit Information Act.'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1390
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1386
      description: Pseudonymous Information Processing Procedures (Pseudonymous Information
        Processing Guidelines)
      annotation: You will find a table on page 229
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1391
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      description: When processing pseudonymous information, additional information
        must be deleted or separated and stored/managed securely, and relevant records
        must be created and maintained with necessary technical, managerial, and physical
        measures to ensure security.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1392
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1391
      description: '(Administrative Protection Measures)

        Establishing and implementing internal management plans to safely manage pseudonymous
        information and additional information

        Managing and supervising pseudonymous information processing contractors

        Including provisions in contracts for pseudonymous information processing
        tasks and third-party provision, such as prohibiting re-identification

        Establishing and disclosing privacy policies related to pseudonymous information
        processing

        Implementing training on pseudonymous information protection'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1393
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1391
      description: '(Technical Protection Measures)

        Separating or deleting additional information

        Restricting access rights to pseudonymous information and additional information

        Creating and maintaining records related to pseudonymous information processing'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1394
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1391
      description: (Physical Protection Measures) When storing pseudonymous information
        or additional information in computer rooms or data storage rooms, establish
        and implement procedures such as access control to protect against unauthorized
        access.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1395
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1391
      description: (Other Protection Measures) Since pseudonymous information is considered
        personal data, adhere to the security measures required by Article 29 of the
        Personal Information Protection Act, including prohibiting pseudonymous processing
        for the purpose of identifying individuals.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1396
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1391
      description: (Re-identification Monitoring, etc.) If information that can identify
        a specific individual is generated during the processing of pseudonymous information,
        immediately cease processing the information and take prompt action to recover
        and destroy it.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1397
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      description: 'Processing Duration: Determine an appropriate period for processing
        pseudonymous information based on its intended purpose. Destroy the information
        promptly once the processing period has expired.'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1398
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1397
      description: Set the processing period appropriately to achieve the purpose
        of pseudonymous information processing.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1399
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1397
      description: Destroy the pseudonymous information without delay once the processing
        period has expired.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1400
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.2.5
      description: When anonymizing personal data, ensure that the level of anonymization
        is sufficient such that the individual can no longer be identified, considering
        factors such as time, cost, and technology.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1401
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1400
      description: '"Anonymous Information" refers to data that cannot identify an
        individual even if other information is used, considering reasonable time,
        cost, and technology.'
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1402
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1400
      description: When anonymizing, delete personally identifiable information and
        use a combination of anonymization methods to ensure that personally identifiable
        information is anonymized to an adequate level.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1403
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1400
      description: To ensure the adequacy of anonymization, establish and implement
        a review process, such as forming a review committee composed of internal
        and external experts.
      annotation: 'Key Points for Verification:

        - When processing pseudonymous information, are procedures established to
        ensure appropriate handling of pseudonymous information, including purpose
        limitation, pseudonymization methods and criteria, adequacy review, prohibition
        of re-identification, and measures to be taken in case re-identification occurs?

        - When pseudonymizing personal data for use or provision, is the pseudonymization
        performed to a degree that the individual cannot be identified without the
        use or combination of additional information?

        - When combining pseudonymous information with other personal data controllers,
        is the combination done through specialized institutions or data combination
        organizations?

        - When processing pseudonymous information, are additional information deleted
        or separately stored and managed, and are technical, managerial, and physical
        measures implemented to ensure safety, including the creation and retention
        of related records?

        - Considering the purpose of processing pseudonymous information, is the processing
        period set to an appropriate duration, and is the information promptly destroyed
        after this period expires?

        - When anonymizing personal data, is the anonymization performed to a level
        where, considering time, cost, and technology, it is not possible to identify
        a specific individual even with the use of additional information?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.3
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3
      ref_id: '3.3'
      name: Protection Measures When Providing Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3
      ref_id: 3.3.1
      name: Provision of Personal Information to Third Parties
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1406
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: When providing personal data to third parties, you must clearly
        identify and comply with legal requirements, such as obtaining the data subject's
        consent and adhering to legal obligations, to ensure the lawful provision
        of personal data.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1407
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1406
      description: 'Scope of Third Parties:'
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1408
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1407
      description: All entities except for the data subject and the personal data
        controller who collects and retains the data (departments and organizations
        within the same personal data controller are not considered third parties).
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1409
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1406
      description: 'For each method of providing personal data, clearly identify the
        legal requirements for data provision and maintain related evidence to prove
        compliance:'
      annotation: For example, if personal data is provided without the data subject's
        consent due to specific legal provisions or to comply with legal obligations,
        document the relevant legal provisions or regulations.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1410
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1406
      description: 'A personal data controller may provide (including sharing) personal
        data to a third party in the following cases:'
      annotation: (Specific details to be listed depending on the applicable laws
        or regulations.)
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1411
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: Consent for providing personal data to a third party must be obtained
        separately from consent for collection and use. If providing data to a third
        party is not essential for performing the core functions of the service, then
        service provision should not be refused on the grounds of not consenting to
        the third-party data provision.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1412
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: When obtaining consent from the data subject for providing personal
        data to a third party, relevant information must be clearly communicated,
        and important details required by law must be explicitly indicated to make
        it easily understandable.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1413
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1412
      description: When obtaining consent for the provision of personal data to a
        third party from the data subject, five statutory notices must be communicated
        in a specific and clear manner.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1414
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1412
      description: "For consent from the data subject to be lawful, it must meet all\
        \ legal requirements, including the data subject\u2019s free will in making\
        \ the decision, and the specificity and clarity of the consent details."
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1415
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1412
      description: 'According to Article 22, Section 2 of the Personal Information
        Protection Act, when obtaining consent for the processing of personal data
        in writing (including electronic documents as defined in Article 2, Section
        1 of the Electronic Transactions Basic Act), important details must be clearly
        highlighted and made easily understandable as follows:'
      annotation: For detailed information, refer to the 'User-Friendly Personal Data
        Processing Consent Guide' (Personal Information Protection Commission).
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1416
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: When providing personal data to a third party, it must be limited
        to the minimum necessary data items that match the purpose of the provision.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1417
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1416
      description: 'When providing data based on consent: Only provide the minimum
        necessary personal data required to achieve the purpose disclosed at the time
        of consent.'
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1418
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1416
      description: 'When providing data based on legal grounds: Provide only the minimum
        necessary personal data required as specifically stated by the law or to comply
        with legal obligations.'
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1419
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: During the process of providing personal data to a third party,
        ensure that the data is protected from exposure or leakage by using secure
        procedures and methods, and record and store the related provision details.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1420
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: When allowing third parties access to personal data, control access
        according to protection procedures to ensure the data is safely protected.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1421
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1420
      description: Implement secure authentication and access control measures to
        ensure only authorized individuals can access the data.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1422
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1420
      description: Use encryption measures to prevent eavesdropping during transmission.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1423
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1420
      description: Maintain access logs to ensure accountability and traceability.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1424
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.1
      description: When providing additional personal data without the information
        subject's consent, establish and implement criteria for considerations such
        as relevance to the original collection purpose, predictability, potential
        harm to interests, and safety measures. If additional provision of data continues
        to occur, disclose this in the personal data processing policy and check for
        compliance with these criteria.
      annotation: 'Key Points for Verification:

        - When providing personal data to third parties, are legal requirements such
        as obtaining the data subject''s consent and compliance with legal obligations
        clearly identified and followed?

        - When obtaining consent from the data subject for providing personal data
        to third parties, are the relevant details clearly communicated, and is consent
        obtained in a manner that distinguishes it from other consent matters?

        - When obtaining consent from the data subject for providing personal data
        to third parties, is the information clearly communicated, and are critical
        details required by law clearly marked to ensure easy understanding?

        - When providing personal data to third parties, is the information limited
        to the minimum necessary items for the purpose of provision?

        - When providing personal data to third parties, are secure procedures and
        methods used, and are records of the provision kept?

        - When allowing third parties access to personal data, is the data controlled
        according to protection procedures to ensure its security?

        - When providing additional personal data without the data subject''s consent,
        are criteria established and implemented for assessing relevance to the original
        collection purpose, predictability, potential harm, and safety measures? Additionally,
        if such additional provision continues, are these criteria disclosed in the
        privacy policy and monitored ?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.3.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3
      ref_id: 3.3.2
      name: Outsourcing of Personal Information Processing Tasks
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1426
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.2
      description: When outsourcing (including subcontracting) personal data processing
        tasks to a third party, the details of the outsourced tasks and the subcontractor
        must be continuously updated and made publicly available on the website, so
        that data subjects can easily check them at any time.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1427
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1426
      description: 'Information to be provided to data subjects:'
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1428
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1427
      description: Details of the outsourced tasks.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1429
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1427
      description: The third party (subcontractor) responsible for processing the
        personal data.
      annotation: The term "subcontractor" includes third parties (sub-subcontractors)
        who receive tasks from the original subcontractor.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1430
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1426
      description: 'Disclosure methods for personal data processing outsourcing details
        (according to Article 28(2) and (3) of the Enforcement Decree of the Personal
        Information Protection Act):'
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1431
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1430
      description: Posting the details of the outsourced tasks and the subcontractor
        on the website of the outsourcing party.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1432
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1430
      description: 'If posting on the website is not possible, one or more of the
        following methods should be used:'
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1433
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1432
      description: "1. Posting in a visible location at the outsourcing party\u2019\
        s business premises."
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1434
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1432
      description: "2. Publishing in the Official Gazette (only if the outsourcing\
        \ party is a public institution) or in general daily newspapers, weekly newspapers,\
        \ or online newspapers that are distributed in the region where the outsourcing\
        \ party\u2019s business is located, as defined by the Newspaper Promotion\
        \ Act."
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1435
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1432
      description: 3.Including in publications, newsletters, promotional materials,
        or invoices distributed to data subjects at least twice a year under the same
        title.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1436
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1432
      description: 4.Including in contracts or agreements made between the outsourcing
        party and the data subject for the provision of goods or services.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1437
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1426
      description: 'Important considerations:'
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1438
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1437
      description: Even if there are many subcontractors, all subcontractor names
        must be listed and disclosed.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1439
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1437
      description: If there is subcontracting, information about the subcontracting
        must also be disclosed.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1440
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1437
      description: If the content of the outsourced tasks or the subcontractor changes,
        the updated information must be promptly reflected and disclosed on the website
        or through other means.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1441
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.2
      description: When outsourcing tasks related to promoting or selling goods or
        services, the details of the outsourced tasks and the subcontractor must be
        communicated to the data subject via written methods such as email, text messages,
        etc.
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1442
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1441
      description: "Notification methods:\_Written methods (including written documents,\
        \ email, fax, phone, text messages, or equivalent methods)"
      annotation: 'Key Points for Verification:

        - When outsourcing (including subcontracting) personal data processing tasks
        to a third party, is the content of the outsourced tasks and the subcontractor
        updated and publicly disclosed on the website?

        - When outsourcing tasks related to promoting or selling goods or services,
        are the content of the outsourced tasks and the subcontractor notified to
        the data subjects via written documents, emails, text messages, or other methods?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1443
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1441
      description: "Notification details:\_Content of the outsourced tasks, subcontractor"
      annotation: For matters related to the outsourcing of personal data processing
        tasks, such as outsourcing contracts, consent for subcontracting, and management
        and supervision of subcontractors, refer to the certification standards for
        the "External Security" section (2.3).
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.3.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3
      ref_id: 3.3.3
      name: Transfer of Personal Information Due to Business Transfer, etc.
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1445
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.3
      description: 'When transferring all or part of a business, or in cases of mergers,
        where personal data is transferred to another party, the following information
        must be provided to the data subject in advance:'
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1446
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1445
      description: 'Information to be Provided:'
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1447
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1446
      description: The fact that personal data is being transferred.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1448
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1446
      description: The name, address, phone number, and other contact details of the
        person receiving the personal data.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1449
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1446
      description: Methods and procedures for the data subject to take action if they
        do not wish for their personal data to be transferred.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1450
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1445
      description: 'Methods of Notification:'
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1451
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1450
      description: Through email, written notice, fax, phone, or similar methods.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1452
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1450
      description: "If the data subject\u2019s contact information cannot be obtained\
        \ without negligence, the information should be posted on the website for\
        \ at least 30 days."
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1453
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1452
      description: If the transferor does not operate a website, the information should
        be posted at a visible location at their business premises for at least 30
        days.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1454
      assessable: true
      depth: 7
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1452
      description: Alternatively, the information can be published in a daily newspaper,
        weekly newspaper, or online newspaper within the main distribution area of
        the business location according to the Newspaper Promotion Act.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1455
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.3
      description: If the transferee is subject to legal notification requirements,
        they must promptly inform the data subject of the fact that they have received
        the personal data and other necessary details.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1456
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1455
      description: If the transferor has already notified the data subject of the
        transfer, the transferee does not need to provide additional notice.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1457
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1455
      description: However, if the personal data has been transferred without the
        transferor notifying the data subject, the transferee must inform the data
        subject of the transfer.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1458
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.3
      description: The recipient of the personal data must use the data only for the
        original purposes at the time of the transfer or provide it to third parties
        only for those purposes.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1459
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1458
      description: If the recipient of personal data intends to use or provide the
        data beyond the original purpose for which it was transferred, they must obtain
        separate consent from the data subject.
      annotation: 'Key Points for Verification:

        - When transferring all or part of a business, or in cases of mergers, is
        the data subject informed in advance of the necessary details regarding the
        transfer of personal data?

        - If the person receiving the personal data is subject to legal notification
        requirements, are they promptly informing the data subject of the fact of
        receiving the personal data and other necessary details?

        - Is the person receiving the personal data using it only for the original
        purposes at the time of the transfer, or not providing it to third parties?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.3.4
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3
      ref_id: 3.3.4
      name: International Transfer of Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1461
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.4
      description: When providing (including in cases of retrieval), outsourcing,
        or storing personal data to a third party abroad (hereinafter referred to
        as 'transfer'), all required notifications about the overseas transfer must
        be provided to the data subject, and separate consent must be obtained or
        legal requirements such as certification or acknowledgment must be complied
        with.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1462
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1461
      description: 'Conditions under which the transfer of personal data abroad is
        permissible (Article 28-8, Paragraph 1 of the Personal Information Protection
        Act):'
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1463
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1461
      description: When agreeing to transfer personal information overseas, all five
        items below must be notified and consent must be obtained.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1464
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.4
      description: 'When outsourcing the processing or storage of personal data abroad
        for the purpose of contract execution with the data subject, the following
        must be communicated adequately:'
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1465
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1464
      description: 'Methods for Informing the Data Subject:'
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1466
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1465
      description: 1. Disclosure in the Privacy Policy.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1467
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1465
      description: "2. Written methods\_(such as written notice, email, fax, phone,\
        \ text messaging, or similar methods)."
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1468
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1464
      description: 'Information to be Provided to the Data Subject:'
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1469
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1468
      description: 1.The items of personal data being transferred.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1470
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1468
      description: 2. The countries, timing, and methods of data transfer.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1471
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1468
      description: 3. The name (or designation and contact information, if a corporation)
        of the entity receiving the data.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1472
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1468
      description: 4.The purpose and retention period of the data by the recipient.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1473
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1468
      description: 5. How to refuse the data transfer, the procedure for refusal,
        and the consequences of refusal.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1474
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.3.4
      description: Contracts for overseas transfers must comply with data protection
        laws and include terms related to the protection of personal data.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1475
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1474
      description: 'Key Aspects to Include in the Contract:'
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1476
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1475
      description: 1. Safety measures for data protection as per Article 30(1) of
        the Enforcement Decree of the Personal Information Protection Act.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1477
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1475
      description: 2. Measures for handling complaints and resolving disputes related
        to data breaches.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1478
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1475
      description: "3. Additional necessary measures for protecting the data subject\u2019\
        s personal data."
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1474
      description: 'Protection Measures Required for Overseas Transfers:'
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1480
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      description: 1. Compliance with relevant regulations on overseas data transfers
        under the Personal Information Protection Act.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1481
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      description: 2. Adherence to Articles 17 through 19 of the Personal Information
        Protection Act.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1482
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      description: "3. Compliance with Chapter 5 of the Personal Information Protection\
        \ Act, concerning the protection of the data subject\u2019s rights."
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1483
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      description: 4. Safety measures as per Article 30(1) of the Enforcement Decree
        of the Personal Information Protection Act.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1484
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      description: 5. Measures for handling complaints and resolving disputes related
        to data breaches.
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1485
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1479
      description: "6. Additional necessary measures to protect the data subject\u2019\
        s personal data."
      annotation: 'Key Points for Verification:

        - When transferring personal data abroad, are all required notifications about
        the overseas transfer provided to the data subject, and is separate consent
        obtained or are legal requirements such as certification or acknowledgment
        being complied with?

        - When notifying the data subject about the overseas processing and storage
        of personal data for the purpose of fulfilling a contract with them, is all
        necessary information included and communicated in an appropriate manner?

        - Are contracts related to the overseas transfer of personal data being executed,
        including compliance with data protection laws and regulations?

        - When transferring personal data abroad, are necessary measures being taken
        to ensure data protection?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.4
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3
      ref_id: '3.4'
      name: Protection Measures When Destroying Personal Information
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.4.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4
      ref_id: 3.4.1
      name: ' Destruction of Personal Information'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1488
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.1
      description: 'Internal policies regarding the retention period and destruction
        of personal data should include the following:'
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1489
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1488
      description: 'For each collection item, purpose, and method: Storage location
        (e.g., databases, backup data), destruction method, timing of destruction,
        and legal basis.'
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1490
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1488
      description: Public institutions must establish and implement a personal data
        destruction plan reflecting the retention period and processing purpose of
        personal data files and may include this plan in their internal management
        plan. (Standard Personal Data Protection Guidelines, Article 55, Paragraph
        2)
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1491
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.1
      description: When the purpose of processing personal data is achieved or the
        retention period has expired, the data must be destroyed without delay.
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1492
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1491
      description: When personal data is no longer needed, due to achievement of processing
        purposes, discontinuation of the service, termination of business, or expiration
        of the legal retention period, the data must be destroyed within 5 days unless
        there is a valid reason.
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1493
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.1
      description: When destroying personal data, it must be done in a manner that
        prevents recovery or reconstruction.
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1494
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1493
      description: Complete destruction (e.g., incineration, shredding)
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1495
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1493
      description: Use of specialized equipment (e.g., devices that use magnetic fields
        to delete data from storage)
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1496
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1493
      description: Initialization or overwriting to prevent data recovery
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1497
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1493
      description: 'If only part of the data is destroyed, and the above methods are
        difficult, implement the following measures:'
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1498
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1497
      description: '1. For electronic files: Manage and supervise to prevent recovery
        and reconstruction after deletion.'
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1499
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1497
      description: '2. For non-electronic records, printed materials, written documents,
        etc.: Delete using methods such as masking or punching.'
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1500
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1493
      description: If the above methods are significantly difficult due to technical
        reasons, process the data as information covered by Article 58-2 of the Act
        (anonymization) to make recovery impossible.
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1501
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.1
      description: Records of personal data destruction must be maintained and managed.
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1502
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1501
      description: "The destruction and results\_must be verified under the responsibility\
        \ of the personal data protection officer, and matters related to destruction\
        \ must be recorded and managed."
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1503
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1501
      description: "Records of destruction\_should be recorded in a destruction management\
        \ ledger or stored as records, such as photos of the destruction."
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1504
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1501
      description: "Public institutions\_must verify the destruction results and create\
        \ a destruction management ledger for personal data files. (Standard Personal\
        \ Data Protection Guidelines, Article 55)"
      annotation: 'Key Points for Verification:

        - Are the following practices in place regarding the retention and destruction
        of personal data?

        - Have internal policies been established regarding the retention period and
        destruction of personal data?

        - When the purpose of processing personal data is fulfilled or the retention
        period expires, is the data destroyed without delay?

        - When destroying personal data, is it done in a manner that prevents recovery
        or reconstruction of the data?

        - Are records of the destruction of personal data maintained and managed?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.4.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4
      ref_id: 3.4.2
      name: Measures When Retaining Information After Achieving Processing Purpose
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1506
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.2
      description: If personal data is retained beyond the retention period or after
        the purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, it must be managed to retain only the
        minimum information necessary for the minimum period required by those laws.
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1507
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1506
      description: "Limit the personal data items\_to the minimum required for the\
        \ intended purpose."
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1508
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1506
      description: "Set the retention period\_according to the minimum duration specified\
        \ by the relevant laws."
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1509
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.2
      description: 'If personal data is retained beyond the retention period or after
        the purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, the personal data or personal data files
        must be stored and managed separately from other personal data.

        '
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1510
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1509
      description: "Separate databases\_should be configured either physically or\
        \ logically."
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1511
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.2
      description: "Manage the separated personal data\_so that it can only be processed\
        \ within the scope of purposes specified by the laws."
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1512
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1511
      description: Separated personal data must not be used for purposes other than
        those specified by law, such as marketing.
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1513
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.4.2
      description: Access to separated personal data should be restricted to the minimum
        number of people.
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1514
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1513
      description: Limit access permissions to the smallest number of individuals
        for separated databases.
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1515
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1513
      description: Maintain access logs for separated databases and review them regularly.
      annotation: 'Key Points for Verification:

        - When personal data is retained beyond the retention period or after the
        purpose of processing has been achieved, without destruction in accordance
        with relevant laws and regulations, is it managed to retain only the minimum
        information for the minimum period required by those laws?

        - If personal data is retained beyond the retention period or after the processing
        purpose has been achieved, is the data or personal data file stored and managed
        separately from other personal data?

        - Is the retained personal data managed to ensure it is only processed within
        the scope of the purposes specified by the law?

        - Is access to the retained personal data limited to the minimum number of
        authorized personnel?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.5
      assessable: false
      depth: 2
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3
      ref_id: '3.5'
      name: Protection of Data Subject Rights
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.5.1
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5
      ref_id: 3.5.1
      name: Disclosure of Personal Information Processing Policy
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1518
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.1
      description: The privacy policy must be written in a clear and specific manner
        using easy-to-understand terms, including all content required by law.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1519
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1518
      description: Mandatory items to include in the privacy policy (refer to Article
        30 of the Personal Information Protection Act and Article 31 of the Enforcement
        Decree of the same Act).
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1520
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1518
      description: Other items to include in the privacy policy (refer to Article
        19 of the Standard Privacy Protection Guidelines).
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1521
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1518
      description: For personal data that can be processed without consent, differentiate
        it from personal data that requires consent by disclosing the items and legal
        grounds for processing in the privacy policy.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1522
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1518
      description: The content of the privacy policy, including the purpose of processing,
        the items of personal data processed, and third-party provision details, must
        accurately reflect the actual data processing situation and be written clearly
        and specifically in easy-to-understand terms, considering the characteristics
        of the service and the data subjects.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1523
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1522
      description: 1. Establish specific and appropriate details on processing grounds,
        data subject rights, and other legally required aspects.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1524
      assessable: true
      depth: 6
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1522
      description: 2. Prepare the privacy policy in clear and understandable language
        for the data subjects.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1525
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1518
      description: In cases where exceptions apply under the Personal Information
        Protection Act, it may not be necessary to establish a privacy policy.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1526
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.1
      description: The privacy policy must be continuously updated and made accessible
        on the internet homepage or other platforms so that data subjects can easily
        review it.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1527
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1526
      description: Use the standardized term "Privacy Policy".
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1528
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1526
      description: When posting on the homepage, differentiate it from other notices
        by using font size, color, etc., to make it easily noticeable to data subjects.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1529
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1526
      description: If no website is available, the privacy policy can be disclosed
        using other legally prescribed methods.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1530
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.1
      description: When changes are made to the privacy policy, promptly notify the
        reasons and details of the changes, and ensure that data subjects can easily
        access and understand the updated information.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1531
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1530
      description: Compare and disclose the changes before and after the update so
        that data subjects can easily review the modifications.
      annotation: 'Key Points for Verification:

        - Has the privacy policy been written in a way that includes all the legal
        requirements and is clear and specific in easy-to-understand terms?

        - Is the privacy policy continuously updated and publicly available on the
        website or other accessible platforms so that individuals can easily review
        it?

        - When changes are made to the privacy policy, are the reasons for and details
        of the changes promptly communicated, and are measures in place to ensure
        that individuals can easily see the updated information at any time?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5
      ref_id: 3.5.2
      name: Guaranteeing the Rights of Data Subjects
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: The method and procedure for exercising the rights to access, correct,
        delete, suspend processing, and withdraw consent regarding personal information
        (hereinafter referred to as 'requests for access, etc.') by the data subject
        or their representative must be established and disclosed in a manner that
        is not more difficult than the methods and procedures for collecting personal
        information.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1534
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      description: A specific method and procedure must be established for the data
        subject to make requests for access, etc., and this must be made easily accessible
        to the data subject.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1535
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      description: The method and procedure for the data subject to exercise their
        rights must be at least as easy and convenient as the procedure for collecting
        personal information or signing up as a member, and additional documents that
        were not required during the collection of personal information should not
        be requested.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1536
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      description: It is necessary to provide a variety of methods for exercising
        these rights (e.g., in-person, written request, phone, email, website) to
        ensure the data subject can choose the most convenient option.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1537
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      description: It must be verified that the person making the request for access,
        etc. is the data subject themselves or a legitimate representative. The verification
        method should be an objectively recognized reasonable means (e.g., electronic
        signature, i-PIN, ID verification, etc.).
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1538
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      description: If the personal information controller is a public institution,
        identity verification should be conducted through the joint use of administrative
        information in accordance with the "Electronic Government Act" if possible.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1539
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1533
      description: You may charge the person requesting access, etc., a fee and postage
        within the scope of the actual cost required to perform the related work.
        However, if the reason for the request is due to the personal information
        controller, fees and postage cannot be charged.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1540
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: When the data subject or their representative requests access to
        personal information, the necessary measures must be taken within 10 days
        to allow the data subject to view the relevant personal information.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1541
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1540
      description: 'The data subject may request access to the following items regarding
        their personal information processed by the personal information controller:'
      annotation: You will find it on page 253
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1542
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1540
      description: If there is a legitimate reason why access cannot be provided within
        10 days, the data subject must be informed of the reason, and the access can
        be postponed. After the reason for the postponement has been resolved, access
        to the personal information must be granted within 10 days from the date the
        reason is resolved.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1543
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1540
      description: If there is a reason to restrict or deny access to personal information,
        the data subject must be informed of the reason, and access may be restricted
        or denied
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1544
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1540
      description: If certain parts of the requested information have reasons for
        access restriction or denial, access to those specific parts can be restricted,
        while allowing access to the remaining parts.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1545
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: If you are subject to legal obligations, procedures and measures
        must be established and implemented to respond to requests for the transfer
        of personal information from the data subject or their representative.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1546
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1545
      description: The legal obligations to respond to a data subject's request for
        the transfer of personal information (data transferor).
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1547
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1545
      description: 'Information that can be requested for transfer (personal data
        that meets all of the following requirements):'
      annotation: You will find it on page 254
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1548
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1545
      description: 'Requirements for the personal information processor who can receive
        the transferred personal data under the transfer request (information recipient):'
      annotation: The amended provisions of the Personal Information Protection Act
        related to the right to data portability (Article 35-2) will come into effect
        from the date specified by Presidential Decree, which will be within one to
        two years after one year has passed since its announcement (March 14, 2023).
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1549
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: 'When the data subject or their representative requests correction
        or deletion of personal information, if the request is deemed justified, the
        personal information must be examined within 10 days, and actions such as
        correction or deletion must be taken accordingly, with the results communicated
        to the data subject:'
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1550
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1549
      description: Respond with the results of the action within 10 days of receiving
        the request for correction or deletion of personal information.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1551
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1549
      description: If the personal information has been outsourced or provided to
        a third party, notify the contractor or third party to take action upon receiving
        the correction request or withdrawal of consent.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1552
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1549
      description: If the collection of that personal information is specified by
        other laws, the request for deletion may be refused. In such cases, the decision
        not to comply, the content of the relevant laws, the reasons, and the methods
        for objection must be communicated to the data subject within 10 days of receiving
        the correction or deletion request, using a personal information correction
        or deletion notification (e.g., records related to contract or withdrawal
        of subscription under the Electronic Commerce Act).
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1553
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: 'When the data subject or their representative requests the suspension
        of personal information processing, unless there is a special reason, the
        processing must be partially or fully suspended immediately, and the result
        must be communicated to the data subject:'
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1554
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1553
      description: Respond with the results within 10 days of receiving the request
        for suspension of personal information processing.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1555
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1553
      description: If there are reasons to refuse the suspension of personal information
        processing, notify the requester within 10 days of receiving the request.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1556
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: When the data subject or their representative withdraws consent
        for the collection, use, or provision of personal information, necessary actions,
        including the immediate destruction of the collected personal information,
        must be taken.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1557
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: When the data subject or their representative requests to refuse
        or obtain an explanation for decisions made through fully automated systems
        (including those using artificial intelligence technology), necessary actions
        must be taken.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1558
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1557
      description: The data subject has the right to refuse automated decisions or
        request an explanation.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1559
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1557
      description: If the data subject requests to refuse or seek explanations for
        automated decisions, unless there are legitimate reasons, the automated decision
        should not be applied, or necessary actions such as human intervention or
        reprocessing and explanations should be taken. Procedures should be established
        and implemented accordingly.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1560
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1557
      description: When making automated decisions, the criteria and procedures for
        the automated decision, as well as how personal information is processed,
        should be disclosed in a manner easily accessible to the data subject.
      annotation: 'Note: The revised provisions of Article 37-2 of the Personal Information
        Protection Act related to refusal and explanation of automated decisions will
        come into effect one year after its promulgation (March 15, 2024).'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1561
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: "If there is any dispute regarding the measures taken in response\
        \ to the data subject\u2019s request for access or other actions, necessary\
        \ procedures must be established to allow for objections."
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1562
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1561
      description: In such cases, the objection procedures should be operated fairly,
        possibly involving external experts or internal checks and balances.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1563
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: Records of the data subject's requests and the results of processing
        those requests must be maintained.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1564
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1563
      description: Regular reviews of records related to data subject requests should
        be conducted to ensure that rights are being appropriately protected, and
        corrective measures should be taken if necessary.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1565
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.2
      description: When personal rights are infringed upon through information communication
        networks, procedures must be established and implemented to allow the affected
        party to request the deletion of the information or other remedies from the
        information communication service provider, and necessary measures should
        be taken to prevent personal information from being exposed to the public
        through these networks.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1566
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1565
      description: If personal information is disclosed to the public through information
        communication networks and infringes on privacy or defames others, the affected
        party should be able to request the deletion or posting of rebuttals from
        the service provider by proving the infringement.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1567
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1565
      description: If a service provider receives a request to delete or take temporary
        action regarding information that infringes on others' rights, they must take
        necessary actions promptly and notify the requester and the information publisher
        immediately.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1568
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1565
      description: The terms and procedures related to remedies for infringed rights
        should be clearly specified in the terms of service.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1569
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1565
      description: Personal information controllers must ensure that unique identification
        information, account information, credit card information, and other personal
        data are not exposed to the public through information communication networks,
        and must take necessary actions, such as deleting or blocking the information,
        if requested by the Personal Information Protection Commission or the Korea
        Internet & Security Agency.
      annotation: 'Key Points for Verification:

        - Has a method and procedure been established and disclosed that allows data
        subjects or their representatives to exercise their rights to access, correct,
        delete, suspend processing, and withdraw consent (hereinafter referred to
        as ''requests for access, etc.'') without being more difficult than the methods
        and procedures for collecting personal information?

        - When a data subject or their representative makes a request for access,
        etc., are the necessary actions being taken within the required timeframe?

        - When a data subject or their representative withdraws consent for the collection,
        use, or provision of personal information, are necessary actions, such as
        promptly destroying the collected personal information, being taken without
        delay?

        - In case the data subject is dissatisfied with the actions taken in response
        to their request for access, etc., is a procedure in place to allow them to
        file an objection, and is this procedure being communicated to them?

        - Are records being kept regarding the data subject''s requests for access,
        etc., and the results of those requests?

        - Is a procedure in place and being implemented that allows individuals who
        have had their privacy or reputation infringed upon by someone else on the
        information network to request the deletion of that information from the information
        and communications service provider?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:3.5.3
      assessable: false
      depth: 3
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5
      ref_id: 3.5.3
      name: Notification to Data Subjects
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1571
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.3
      description: 'If the entity is subject to legal obligations, they must periodically
        notify the data subject of the method to access information systems where
        they can verify the details of personal data usage or provision.

        '
      annotation: 'Key Points for Verification:

        - If the entity is subject to legal obligations, are they regularly notifying
        the data subject of the method to access information systems that allow for
        checking the details of personal data usage or provision?

        - Are the notification items regarding personal data usage and provision details
        including all legally required items?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1572
      assessable: true
      depth: 5
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:node1571
      description: Legal Requirements for Notifying Personal Data Usage and Provision
        Details
      annotation: 'Key Points for Verification:

        - If the entity is subject to legal obligations, are they regularly notifying
        the data subject of the method to access information systems that allow for
        checking the details of personal data usage or provision?

        - Are the notification items regarding personal data usage and provision details
        including all legally required items?'
    - urn: urn:intuitem:risk:req_node:k_isms_p:node1573
      assessable: true
      depth: 4
      parent_urn: urn:intuitem:risk:req_node:k_isms_p:3.5.3
      description: The notification of personal data usage and provision details must
        include all legally required items.
      annotation: 'Items to Include in the Notification of Personal Data Usage and
        Provision Details

        1. The purpose of collecting and using personal data and the items of personal
        data collected.

        2. The recipients of the personal data and the purpose of provision, as well
        as the items of personal data provided (excluding information provided under
        the Communication Privacy Protection Act, Articles 13, 13-2, 13-4, and the
        Telecommunications Business Act, Article 83, Paragraph 3).'
