How to build up operating evidence
when you prepare for ISMS-P
ISMS-P (Personal Information & Information Security Management System, 정보보호 및 개인정보보호 관리체계 인증) is Korea's national certification for information security and personal information management. Its criteria have 101 items. For the ones that have to run every day, such as log management, vulnerability assessment, anomaly monitoring and incident response, Genox Cybersecurity AI and our security services can leave records you can show auditors. We don't get certified on your behalf, and we don't guarantee audit results.
What it requires
ISMS-P combines two certifications into one scheme: information security management system certification under the Act on Promotion of Information and Communications Network Utilization and Information Protection (the Network Act, 정보통신망법), and personal information protection certification under the Personal Information Protection Act (개인정보 보호법).
The detailed criteria are in Annex 7 of the Notice on Certification of Information Security and Personal Information Management Systems (「정보보호 및 개인정보보호 관리체계 인증 등에 관한 고시」).
Under Article 23 of the Notice, ISMS-P certification applies parts A through C of Annex 7, while ISMS certification applies only parts A and B. So ISMS covers 80 items, and ISMS-P adds 21 requirements for each stage of personal information processing, for 101 in total.
Audits are run by KISA (Korea Internet & Security Agency) or a designated certification or audit body, through a document review and an on-site audit. Policy documents alone aren't enough. Auditors also want records showing you actually operated the way you said you would. You can fix documents in a few weeks, but you can't produce months of log review history or vulnerability remediation history all at once right before the audit. It's better to start building operating records early.
| Area | Domains (number of items) |
|---|---|
| 1. Establishing and operating the management system (16) | Laying the foundation (6), risk management (4), operating the management system (3), reviewing and improving the management system (3) |
| 2. Protection requirements (64) | Policy, organization and asset management (3), personnel security (6), third-party security (4), physical security (7), authentication and authorization management (6), access control (7), encryption (2), information system acquisition and development security (6), system and service operations management (7), system and service security management (9), incident prevention and response (5), disaster recovery (2) |
| 3. Requirements for each stage of personal information processing (21) | Protection at collection (7), protection during retention and use (5), protection when providing to others (4), protection at destruction (2), protecting data subjects' rights (3) |
How the criteria map to Genox features
We only listed items where Genox is relevant.
For items not in the table, such as personnel security or physical security, Genox has little to offer.
| Requirement | Related Genox features / services | What you have to do yourself |
|---|---|---|
| 1.2 Risk management Identifying and assessing risk | Vulnerability lists and priorities per asset from Vulnerability Scanner, plus penetration testing and assessment results, as input for your risk assessment | Choose the risk assessment method, decide the acceptable level of risk, get management approval |
| 1.4 Reviewing and improving the management system | Pre-certification gap analysis and a list of improvement tasks from security consulting | Plan and run internal reviews, approve corrective actions |
| 2.8 Information system acquisition and development security | SAST and SCA scans in your CI pipeline, penetration testing before release | Define security requirements, review test results and approve the move to production |
| 2.9.4 Log and access record management | Threat Correlator analyzes logs received from your SIEM and EDR, and Genox signs and keeps its own audit logs | Decide which logs to keep and for how long. Access records for personal information processing systems have to be kept by that system or by your DB access control solution |
| 2.10 System and service security management Patching, malware control and more | Patch priorities that factor in EPSS and KEV, sandbox analysis in Behavioral Analyzer | Decide on and carry out the patch schedule, run antivirus and other security programs |
| 2.11.2 Vulnerability assessment and remediation | Scheduled Vulnerability Scanner scans, penetration testing and assessment, records of rescans after fixes | Plan and carry out remediation for each finding, approve risk acceptance for anything left unfixed |
| 2.11.3 Anomaly analysis and monitoring | AI security monitoring and MDR, a record with evidence and reasoning for every verdict, monthly reports | Approve monitoring scope and thresholds, keep records showing you reviewed the monitoring reports |
| 2.11.4 Incident response training and improvement | Simulation exercises, proactive security validation (red team and blue team) | Approve the training plan, feed training results back into response procedures |
| 2.11.5 Incident response and recovery | Incident response, the case timeline in Threat Correlator | Legally required reports and notifications (such as personal information breach reports), external communication |
| 3. Requirements for each stage of personal information processing | Very few features apply directly. Behavioral Analyzer's detection of bulk lookups and exports can partly help watch for misuse during retention and use | All of it: consent and notice at collection, provision to third parties, destruction, and procedures for data subjects to exercise their rights |
Item numbers and names follow the certification criteria published by KISA and the Personal Information Protection Commission (PIPC). Detailed checkpoints can be revised, so read this alongside the latest certification criteria guide.
What Genox doesn't do for you
ISMS-P checks whether an organization sets up and runs its own management system.
The part a tool can fill in is narrower than most people expect.
- Certification audits and certificates come from KISA or a designated certification body. Genox is neither.
- You decide on approving security policies and guidelines, appointing the responsible executives, and how the organization is set up.
- Management decides which risks to accept. Genox only provides the information for that decision.
- Personnel security, physical security, third-party contract management and personal information consent procedures have nothing to do with Genox features.
- Genox itself does not yet hold ISMS-P certification. Our preparation schedule is in the Trust Center.
Frequently asked questions
Does using Genox help in an ISMS-P audit?
Auditors don't look at tool names. They look at whether you ran the procedures you defined. Scan history, remediation history and monitoring verdict records from Genox can serve as operating evidence, but you need to keep your own record of who reviewed them and when.
We already have a monitoring provider and a SIEM. Can we use Genox alongside them?
Yes. Threat Correlator receives alerts from your SIEM or EDR over API or Syslog, analyzes them, and sends results back to the SIEM and your ticketing system. If some systems fall outside your current monitoring contract, we suggest checking those first.
We only want ISMS. Does this still apply?
Areas 1 and 2 are the same for ISMS and ISMS-P. ISMS covers 80 items, leaving out area 3, the requirements for each stage of personal information processing.
In what form do we get the evidence?
Vulnerability results can be exported as SARIF and SBOM, and each monitoring verdict is stored together with its evidence, reasoning and confidence. If you use our services, the monthly report also includes the false positive rate and the cases we missed.
References
- Notice on Certification of Information Security and Personal Information Management Systems (정보보호 및 개인정보보호 관리체계 인증 등에 관한 고시), Korean National Law Information Center (in Korean)
- Overview of the ISMS-P certification scheme and its criteria, Korea Internet & Security Agency (KISA) (in Korean)
- Certification scheme (ISMS-P), Personal Information Protection Commission (in Korean)
If your certification date is set, start with a gap analysis
Tell us your certification scope and target date, and we'll start by listing the operating evidence you're missing today.