Korea ISMS-P
Personal Information and Information Security Management System - KISA certification (80 base + 22 PII controls).
Personal Information and Information Security Management System - KISA certification (80 base + 22 PII controls).
| Short name | ISMS-P |
| Region | Asia-Pacific |
| Country or scope | South Korea |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers ISMS-P
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for ISMS-P.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 23: 1 written for ISMS-P and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
KR-ISMSP-ASSET Asset Identification and Classification | Certification requires identifying and classifying the information assets within the management-system scope, so all software components must be inventoried (ISMS-P certification criteria, asset-management area) | Scan |
KR-ISMSP-DEV Secure Acquisition and Development | Security must be applied when introducing and developing information systems, including verifying the integrity of acquired and third-party software via hashes (ISMS-P certification criteria, system acquisition and development security area) | Scan |
KR-ISMSP-OPS Operational Patch and Change Control | System and service operation criteria require controlled changes and timely patching, which depends on recording the version of every deployed component (ISMS-P certification criteria, system and service operations management area) | Scan |
KR-ISMSP-VULN Vulnerability Inspection and Response | Organisations must periodically inspect for and remediate technical vulnerabilities, requiring standard component identifiers to match published advisories (ISMS-P certification criteria, vulnerability-management controls) | Scan |
KR-ISMSP-OUT Outsourcing and External-Party Security | Security must be managed for outsourced services and external parties, which requires knowing the supplier of the software components in use (ISMS-P certification criteria, external-party security area) | Scan |
KR-ISMSP-DOC Management-System Records | The management system must maintain documented policies and operational records for certification audit, so machine-readable records must carry a document identity and creation timestamp (ISMS-P certification criteria, management-system operation and documentation area; Network Act Art. 47) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
1.1.1 | Information Security Governance |
1.2.1 | Risk Management |
2.4.1 | Access Management |
2.10.1 | Breach Response & Notification |
3.1.1 | PII Collection Lawfulness |
3.2.1 | Minimum Collection & Purpose Limitation |
3.3.1 | Data Subject Rights |
2.1.1 | Security Policy & Procedures |
2.6.1 | Cryptography & Key Management |
Policy templates
Written for ISMS-P:
- ISMS-P Implementation & Certification Plan
And 22 from the standard set, adapted to ISMS-P.
Kiribati National ICT / Privacy Framework
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Kyrgyzstan Law on Personal Information
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.