Regional · South Korea

ISMS-P Certification Criteria (November 2023)

Attestkeep maps what your cluster's admission control and image scanning recorded in a period to 32 clauses of 정보보호 및 개인정보보호 관리체계 인증기준 (Annex 7 of the joint notification of the Personal Information Protection Commission and the Ministry of Science and ICT), as explained in KISA's 인증기준 안내서 of November 2023. 21 are assessed from those records; 11 are marked outside scope, each with the reason.

Create an account How a package is built

What the framework asks

21 clauses a cluster can answer.

Citations and titles as the report prints them. Open a clause to read what it asks, restated close to the instrument's own words.

ISMS-P Certification Criteria

정보보호 및 개인정보보호 관리체계 인증기준 (Annex 7 of the joint notification of the Personal Information Protection Commission and the Ministry of Science and ICT), as explained in KISA's 인증기준 안내서 of November 2023

Domain 1 (Establishing and operating management system): risk management and operation of the management system. Domain 2 (Requirements for protection measures): policy, organization, and asset management; outsider security; certification and authorization management; introduction of data system and development security; system and service operation management; system and service security management; incident prevention and response. Personal security, physical security, access control, application of encryption, disaster recovery and the whole of Domain 3 (Requirements in each step of personal information processing) are named and left outside

Citation	Clause	Report sections
Criterion 1.2.1 정보자산 식별 (Identification of information assets), 인증기준 sentence translated from the Korean guide, 2023.11	All information assets in scope are identified, classified and kept current A classification standard for information assets shall be established according to the characteristics of the organization's business; all information assets within the scope of the management system shall be identified and classified, their criticality assessed, and the resulting inventory kept current.	CoverageSupply chain
Criterion 1.3.3 운영현황 관리 (Management of operating status), 인증기준 sentence translated from the Korean guide, 2023.11	Operating activities are recorded so they can be identified and traced The operational activities that must be carried out continuously or periodically under the management system the organization has established, and the record of their performance, shall be recorded and managed so that they can be identified and traced; and management shall periodically confirm and manage the effectiveness of those operational activities.	Evidence chain
Criterion 2.1.3 정보자산 관리 (Management of information assets), 인증기준 sentence translated from the Korean guide, 2023.11	Handling procedures by criticality, and responsibility defined per asset Handling procedures and protective measures appropriate to the purpose and criticality of an information asset shall be established and carried out, and responsibility for each asset shall be clearly defined and managed.	CoverageSupply chainControl statement
Criterion 2.3.3 외부자 보안 이행 관리 (Management of an outsider's security performance), 인증기준 sentence translated from the Korean guide, 2023.11	An outsider's protective measures are supervised by periodic inspection or audit Whether an outsider carries out the protective measures required by the information security and personal information protection requirements stated in the contract, the agreement or internal policy shall be managed and supervised through periodic inspection, audit or the like.	Supply chainControl statementProducer statements (VEX)
Criterion 2.5.3 사용자 인증 (User authentication), 인증기준 sentence translated from the Korean guide, 2023.11	Access applies a secure authentication procedure, strengthened where needed User access to information systems and to personal and important information shall apply a secure authentication procedure and, where necessary, a strengthened authentication method. Measures to control access by unauthorized persons — limits on the number of log-in attempts, warnings on illegal log-in attempts and the like — shall also be established and carried out.	Evidence chain
Criterion 2.5.5 특수 계정 및 권한 관리 (Management of special accounts and privileges), 인증기준 sentence translated from the Korean guide, 2023.11	Special-purpose accounts and privileges are minimal, separately identified Accounts and privileges used for special purposes — administration of information systems, management of personal and important information and the like — shall be granted to the minimum extent, identified separately and controlled.	Evidence chain
Criterion 2.5.6 접근권한 검토 (Review of access rights), 인증기준 sentence translated from the Korean guide, 2023.11	Account and privilege changes are recorded and reviewed periodically A record shall be kept of the registration, use and deletion of user accounts that access information systems and personal and important information, and of the granting, changing and removal of access rights, and it shall be reviewed periodically to check that they remain appropriate.	Evidence chain
Criterion 2.8.2 보안 요구사항 검토 및 시험 (Review and testing of security requirements), 인증기준 sentence translated from the Korean guide, 2023.11	Security requirements reviewed and tested, and the problems found corrected To review whether an information system has been introduced or implemented in accordance with the security requirements defined in advance, review criteria and procedures — compliance with legal requirements, inspection for the latest security vulnerabilities, implementation of secure coding, a privacy impact assessment and the like — shall be established and carried out, and corrective action shall be taken on the problems found.	CoverageAdmission decisionsOutcomesControl statement
Criterion 2.8.5 소스 프로그램 관리 (Management of source programs), 인증기준 sentence translated from the Korean guide, 2023.11	Source programs are reachable only by authorized users and kept out of production Source programs shall be managed so that only authorized users can access them, and as a rule shall not be kept in the operational environment.	Supply chainControl statement
Criterion 2.8.6 운영환경 이관 (Transfer to the operational environment), 인증기준 sentence translated from the Korean guide, 2023.11	The move into production follows a controlled procedure, and code runs only once accepted When a newly introduced, developed or changed system is moved into the operational environment a controlled procedure shall be followed, and executable code shall be run only after the testing and user acceptance procedures.	Control statementAdmission decisionsSupply chain
Criterion 2.9.1 변경관리 (Change management), 인증기준 sentence translated from the Korean guide, 2023.11	Every change to a system asset is managed, and its effect analysed beforehand A procedure shall be established and carried out so that every change to an information-system-related asset can be managed, and the effect on the performance and security of the system shall be analysed before the change.	Admission decisionsEvidence chain
Criterion 2.9.4 로그 및 접속기록 관리 (Management of logs and access records), 인증기준 sentence translated from the Korean guide, 2023.11	Log types, retention period and method are decided, and logs kept safe from tampering For information systems such as servers, applications, security systems and network systems, the types of log — user access records, system logs, records of privileges granted and the like — their retention period and the method of retention shall be decided, and they shall be retained and managed securely so that they are not forged, altered, stolen or lost.	Evidence chain
Criterion 2.9.5 로그 및 접속기록 점검 (Inspection of logs and access records), 인증기준 sentence translated from the Korean guide, 2023.11	Logs are reviewed against criteria on a cycle, and problems acted on in time To assure the normal use of an information system and to prevent misuse or abuse by users (unauthorized connection, excessive querying and the like), criteria for reviewing the logs of access and use shall be established and the logs inspected periodically, and where a problem arises follow-up action shall be taken in good time.	Evidence chainAdmission decisionsBreak-glass events
Criterion 2.10.1 보안시스템 운영 (Operation of security systems), 인증기준 sentence translated from the Korean guide, 2023.11	Operating procedures per security system, and the state of policy application managed For each type of security system, operating procedures — designation of an administrator, updating of the policy to the latest version, changes to the rule set, event monitoring and the like — shall be established and carried out, and the state of policy application shall be managed for each security system.	Control statementAdmission decisionsTriage decisionsEvidence chain
Criterion 2.10.2 클라우드 보안 (Cloud security), 인증기준 sentence translated from the Korean guide, 2023.11	Administrator access and security settings protected against misconfiguration and unauthorized access When a cloud service is used, protective measures for administrator access and security settings shall be established and carried out so that important information and personal information are not leaked or exposed through unauthorized access or misconfiguration arising from the type of service (SaaS, PaaS, IaaS and the like).	Control statementAdmission decisionsEvidence chain
Criterion 2.10.3 공개서버 보안 (Security of public servers), 인증기준 sentence translated from the Korean guide, 2023.11	A server exposed to an external network is separated and given strengthened measures A server exposed to an external network shall be separated from the internal network, and strengthened protective measures — vulnerability inspection, access control, authentication, and procedures for collecting, storing and publishing information — shall be established and carried out.	CoverageControl statementAdmission decisions
Criterion 2.10.8 패치관리 (Patch management), 인증기준 sentence translated from the Korean guide, 2023.11	The latest patches are applied, with compensating measures where they cannot be The latest patches shall be applied in order to prevent an intrusion incident arising from a vulnerability in software, an operating system, a security system and the like. Where, having reviewed the effect on the service, applying the latest patch is difficult, separate compensating measures shall be prepared and carried out.	CoverageControl statementClusterTriage decisionsIssues
Criterion 2.11.1 사고 예방 및 대응체계 구축 (Establishing an incident prevention and response framework), 인증기준 sentence translated from the Korean guide, 2023.11	A framework for detecting, responding to, analysing and sharing intrusion attempts A framework and procedures for detecting, responding to, analysing and sharing internal and external intrusion attempts shall be established so that intrusion incidents and leaks of personal information are prevented and are responded to quickly and effectively when they occur, and a cooperative arrangement shall be built with the relevant external bodies and experts.	Admission decisionsBreak-glass events
Criterion 2.11.2 취약점 점검 및 조치 (Vulnerability inspection and action), 인증기준 sentence translated from the Korean guide, 2023.11	Vulnerabilities inspected periodically and acted on, and new ones tracked A vulnerability inspection shall be carried out periodically to confirm whether an information system's vulnerabilities are exposed, and a vulnerability that is found shall be dealt with promptly. Whether new security vulnerabilities have appeared shall also be established continuously, and their effect on the information system analysed and acted upon.	CoverageAdmission decisionsOutcomesClusterControl statementIssues
Criterion 2.11.3 이상행위 분석 및 모니터링 (Analysis and monitoring of anomalous behaviour), 인증기준 sentence translated from the Korean guide, 2023.11	Flows are collected and analysed so intrusion attempts are detected quickly Network and data flows and the like shall be collected and analysed so that intrusion attempts from inside or outside, attempts to leak personal information, and fraudulent acts can be detected and responded to quickly, and follow-up action on the results of monitoring and inspection shall be taken in good time.	CoverageRuntime events
Criterion 2.11.5 사고 대응 및 복구 (Incident response and recovery), 인증기준 sentence translated from the Korean guide, 2023.11	Incidents are notified as the law requires, responded to, and their recurrence prevented When a sign or an occurrence of an intrusion incident or a leak of personal information is recognized, the legal duties of notification and reporting shall be complied with; response and recovery shall follow the procedure promptly; and after analysing the incident, measures to prevent recurrence shall be established and reflected in the response framework.	Admission decisionsEvidence chainBreak-glass events

11 clauses marked outside scope, and why

Citation	Clause and reason
Section 1.1 Setting up foundation for management system; the text quoted is criterion 1.1.1 경영진의 참여, 인증기준 sentence translated from the Korean guide, 2023.11	Setting up foundation for management system participation by management, the appointment of a chief officer, the composition of the organisation, the scope of certification, the policy and the allocation of resources are decisions taken and minuted by the organisation; none of them is a property of a cluster
Criterion 1.4.2 관리체계 점검 (Inspection of the management system), 인증기준 sentence translated from the Korean guide, 2023.11	The management system is inspected at least once a year by independent, expert staff this document is evidence such an inspection reads, not the inspection itself; the independence the criterion asks for is a property of who performs it, and a control cannot inspect itself
Section 2.2 Personal security; the text quoted is criterion 2.2.1 주요 직무자 지정 및 관리, 인증기준 sentence translated from the Korean guide, 2023.11	Personal security designating the holders of key duties, separating duties, security undertakings, awareness training, handling of leavers and transfers, and the action taken after a security breach are statements about people; an admission decision taken on an image observes none of them
Criterion 2.3.1 외부자 현황 관리 (Management of the outsider position), 인증기준 sentence translated from the Korean guide, 2023.11	Outsourcing and external services are identified and their risks understood the position this criterion asks to be identified is a register of who the organisation has engaged and what it has bought; a cluster sees the software those parties shipped and is reported against 2.3.3, not the commercial relationships behind it
Section 2.4 Physical security; the text quoted is criterion 2.4.1 보호구역 지정, 인증기준 sentence translated from the Korean guide, 2023.11	Physical security protection areas, entry control, protective plant, work inside a protected area, control of equipment carried in and out, and clear-desk rules are properties of buildings; a webhook inside a cluster sees none of the building it is running in
Section 2.6 Access control; the text quoted is criterion 2.6.2 정보시스템 접근, 인증기준 sentence translated from the Korean guide, 2023.11	Access control network access, operating system access, application and database access, wireless networks, remote access and internet access control are configured in the network, the hosts and the applications themselves; what this control governs is which images may run, and the administrative access to the control itself is reported under 2.5.3 and 2.5.5
Section 2.7 Application of encryption; the text quoted is criterion 2.7.1 암호정책 적용, 인증기준 sentence translated from the Korean guide, 2023.11	Application of encryption what must be encrypted and to what strength is fixed by the Personal Information Protection Act and by the organisation's policy, and applied in the systems that hold and move the data; the signatures this control verifies prove who vouched for an image and are not the encryption this criterion asks for
Criterion 2.8.1 보안 요구사항 정의 (Definition of security requirements), 인증기준 sentence translated from the Korean guide, 2023.11	Security requirements are defined and applied when a system is introduced or changed the requirements this criterion asks for are written at the analysis and design stage and reflected in what is built; this cluster meets the result as a built image, and whether the requirements were defined before the work started is evidenced where that work was done. What admission does with the finished artefact is reported under 2.8.2 and 2.8.6
Criterion 2.10.9 악성코드 통제 (Control of malicious code), 인증기준 sentence translated from the Korean guide, 2023.11	Malicious code is prevented, detected and responded to the scanning this product performs is vulnerability scanning, not malware scanning: it reads an image's components against a database of known vulnerabilities, which finds weaknesses in software somebody meant to install, and it looks for no virus, worm, Trojan or ransomware. The check questions here ask for anti-virus software kept at its latest signature and a procedure for containing an infection, and this control is neither
Section 2.12 Disaster recovery; the text quoted is criterion 2.12.1 재해·재난 대비 안전조치, 인증기준 sentence translated from the Korean guide, 2023.11	Disaster recovery identifying disaster types, setting recovery objectives and rehearsing a recovery are planning and exercise work done across the organisation; an admission control decides what may run and holds no copy of anything to restore
Domain 3 Requirements in each step of personal information processing; the text quoted is criterion 3.1.1 개인정보 수집·이용, 인증기준 sentence translated from the Korean guide, 2023.11	Requirements in each step of personal information processing the whole of domain 3 follows the personal information itself through its lifecycle — collection, retention and use, provision to third parties, destruction, and the rights of the data subject — and is answered from the organisation's consent records, its privacy notice and its processing systems. This control never sees personal information: it decides which container images may run, and knows nothing about what they process

What Attestkeep produces

Evidence from records the cluster already keeps.

Nothing is filled in by hand. Each clause's answer carries a status (met, partial, gap or outside scope), a note with the period's own numbers, and the report sections those numbers come from.

Statements the mapping draws on

Each assessed clause is answered by one or more of these statements about the period's records. The same statement answers the same question under every framework, so two reports for one period cannot disagree.

Every decision and administrative action is recorded9 clauses
Every image in the inventory carries a scan record6 clauses
Admission refuses non-compliant workloads4 clauses
Administrative access is federated to a directory3 clauses
A refusal or a critical finding reaches a person3 clauses
Only images of established provenance may run3 clauses
A bill of materials is held for the images in service3 clauses
Every image change is recorded against the policy that governed it2 clauses
Workloads name images by digest, not by a movable tag2 clauses
Accepted risks are named, justified and expire2 clauses
Findings are matched against a national catalogue of exploited vulnerabilities2 clauses
Remediation windows are declared for each severity2 clauses
Images carrying severe findings are refused2 clauses
Workload privilege is constrained at admission2 clauses
Images whose base OS is past end of support are refused1 clause
A trusted producer's own statement about their product is read and acted on1 clause
Images may enter only from named registries1 clause
A runtime detector's findings are recorded against the images that produced them1 clause

The package

What the report contains.

Every package carries the same sections, whatever the framework. The ones marked are those ISMS-P answers cite, with the number of clauses citing each.

The scope paragraph, as the report states it.

This document reports what one Kubernetes cluster's admission control and image scanning recorded during the period, mapped onto the ISMS-P Certification Criteria — the 101 criteria a Korean organisation is certified against for information security and personal information protection. The criteria are addressed to the applicant organisation and cover its whole management system, its people, its buildings, its networks and the entire lifecycle of the personal information it processes. Nothing here is a certification audit and nothing here establishes conformity: an auditor from a certification body works through the criteria against the organisation, and this cluster is one system inside its scope. What the period's records support is a part of two of the three domains, and only for the software inside container images: the asset identification of 1.2.1 and 2.1.3, the operating record of 1.3.3, the supplier assurance of 2.3.3, the authentication and privileged accounts of 2.5.3, 2.5.5 and 2.5.6, the development and hand-over criteria of 2.8.2, 2.8.5 and 2.8.6, the change and log criteria of 2.9.1, 2.9.4 and 2.9.5, the security system, cloud and public server criteria of 2.10.1 to 2.10.3, patch management in 2.10.8, and incident prevention, vulnerability inspection, anomaly monitoring and incident response in 2.11.1 to 2.11.5. Domain 3, the requirements at each step of personal information processing, is outside it entirely, as are personal security, physical security, access control, application of encryption and disaster recovery. No criterion is reported as fully met: an ISMS-P criterion states a technical measure and a procedure, a designation or a periodic review together, and a cluster's records answer the first half only. Every criterion sentence quoted below is our translation of the Korean 인증기준 sentence as printed in KISA's guide of November 2023; there is no official English text of the criteria, and each citation says which criterion the translation came from.

Questions

About ISMS-P and Attestkeep

Is this a ISMS-P certification?

No. The package is evidence produced from your cluster's own records. It is not a certification, and no auditor is obliged to accept it. The scope paragraph on this page is the one the report itself carries.

Why are 11 of the clauses outside scope?

They ask about things one cluster's admission and scanning records cannot show. They are listed with the reason rather than left out, so whoever reads the report can see the gap is deliberate.

Which plan includes ISMS-P?

Every plan can report against it. Community and Team include one framework of your choice, Business three, Enterprise every one. Prices are on the pricing page.

How does an auditor check the package?

In a browser at attestkeep.com/verify.html, where nothing is uploaded, or with the short script on the documentation site. Neither needs us. For auditors has the details.

Install it yourself.

Create an account, confirm your e-mail with the code we send, take the free Community key from the Licenses page, and install with Helm.

Create an account