Government strengthens ISMS and ISMS-P certifications following data leaks

-

Strengthening Post-Certification Management for Information Security Systems

The government has taken significant steps to enhance the post-certification management and review criteria for two critical systems: the Information Security Management System (ISMS) and the Information Security and Personal Information Protection Management System (ISMS-P). This decision comes in response to multiple instances of personal information leaks at companies that had previously obtained these certifications, such as Coupang. The initiative aims to ensure that certified entities maintain high standards of data protection and security.

Reform Plan and Certification Requirements

The Personal Information Protection Commission (PIPC) and the Ministry of Science and ICT announced on the 6th that they held an interagency task force meeting to discuss improvements to the certification system. As part of the reform plan, the ISMS-P certification, which was previously voluntary, will now be mandatory for major public and private personal information processing systems. This change is intended to ensure continuous safety management across key sectors.

Key targets for this new requirement include essential public systems, telecom companies, and large platforms. To implement these changes, amendments to the Personal Information Protection Act and the Information and Communications Network Act will be pursued.

Enhanced Review Processes

The review process will also see comprehensive strengthening. During the preliminary review stage, core items will be verified first, while technical reviews and on-site verification inspections will be enhanced. The government plans to establish sector-specific certification committees and expand AI-related training for reviewers to improve their expertise.

Stricter Post-Certification Management

Post-certification management will become more rigorous. If a certified company experiences a data breach, an immediate special post-certification review will be conducted to verify compliance with certification standards. If severe deficiencies are found, the certification may be revoked following deliberation and resolution by the certification committee. So far, no certified company has had its certification revoked.

For companies where leaks occur, the number of personnel and the duration of post-certification reviews will be doubled compared to previous standards. This will allow for a more intensive inspection of the causes of the incident and measures to prevent recurrence. The PIPC will begin on-site inspections this month for certified companies involved in leaks.

Joint Inspections and Compliance Verification

In particular, companies currently under investigation, such as Coupang, will undergo joint inspections by the Ministry of Science and ICT’s public-private task force, the PIPC, the Korea Internet & Security Agency (KISA), and the Financial Security Agency. These inspections aim to verify compliance with certification standards and ensure that all necessary measures are in place to protect personal information.

Conclusion

The government's actions reflect a growing emphasis on ensuring the integrity and effectiveness of information security systems. By strengthening post-certification management and review processes, the authorities aim to create a more secure environment for handling personal information. This initiative not only addresses current vulnerabilities but also sets a precedent for future compliance and accountability in the digital age.

Comments

Post a Comment

Popular posts from this blog

Japan Firms Leverage Satellites and AI to Locate Abandoned Homes for Sale

-
Image
The Rise of AI-Powered Real Estate Discovery in Japan In Tokyo, a growing number of Japanese companies are leveraging satellite imagery and artificial intelligence to identify abandoned houses that could be repurposed or sold. This innovative approach is becoming increasingly vital as the country faces a rising number of deserted properties due to its aging population. Where Inc., a startup, offers a service that uses AI trained on tens of thousands of images to detect signs of aging roofs, such as rust and discoloration. These findings are then overlaid on satellite maps, helping users spot properties that may have been left unattended. One of Where Inc.'s users, Kotaro Yasue, recently discovered a two-story wooden house through this service. He was able to contact the owner via a real estate registry. It turned out that the house had been neglected for over a decade, and the owner was unsure how to proceed with its disposal. Yasue, who runs a house rental service company in G...
Read more

GEN Nigeria and Others Target Indigenous Firms with New Tech Fees

-
Image
Empowering Nigerian Entrepreneurs with AI Global Entrepreneurship Network (GEN Nigeria), in collaboration with Fidelity Bank Plc and other organizations, has called on young entrepreneurs in Nigeria to embrace new technologies, particularly Artificial Intelligence (AI), in their business operations. This initiative was highlighted during the Youth Entrepreneurship Dialogue, titled “Building the Future with AI: Technology, Talent, and Transformation Entrepreneurship,” which took place at the 2025 Global Entrepreneurship Week (GEW) in Lagos. Dr. Olawale Anifowose, the Managing Director of GEN Nigeria, emphasized that AI has become essential for local enterprises in Nigeria to boost productivity, drive innovation, and enhance competitiveness. According to Anifowose, this can be achieved by automating tasks, personalizing customer experiences through data analysis, and enabling entrepreneurs to develop and scale new products and services more efficiently. Enhancing Efficiency and Produc...
Read more

I Was Healthy Until a Dirty Habit Stopped My Heart

-
Image
A Rare Case of Cannabis-Induced Cardiac Arrest in a Young, Healthy Woman A 26-year-old woman from Georgia experienced a life-threatening cardiac arrest after smoking marijuana. The incident occurred when her fiancé discovered her unconscious on the bathroom floor, prompting immediate emergency medical intervention. Upon arrival at the hospital, doctors confirmed that she had suffered a cardiac arrest, where the heart suddenly stopped beating. The woman had no known pre-existing health conditions and tested negative for heart-related issues such as arrhythmia. However, she was found to have high levels of tetrahydrocannabinol (THC), the psychoactive compound in cannabis responsible for the "high" sensation. Doctors diagnosed her with ventricular fibrillation, a severe heart rhythm disorder that prevents the heart from effectively pumping blood and oxygen throughout the body. This led to what they described as a "cannabis-induced cardiac arrest." This case has rais...
Read more