Client: Shopping Mall A (online bookstore and shopping mall)
Project duration: Conducted over four months in 2013; K-ISMS certification obtained
Project background and subject
The client is an organization subject to an information security safety assessment under the Information and Communications Network Act and, following a recent amendment to the relevant law, is required to obtain K-ISMS certification. Because Client A had not obtained K-ISMS certification, it commissioned consulting to obtain K-ISMS certification as a candidate for an initial audit.
IT and Information Security Environment
Business and IT environment
The client’s main business areas are an online bookstore, sales of multimedia and various content, and a general shopping mall. The company operates a large logistics center and processes book and multimedia orders nationwide.
To support the business smoothly, the client’s IT organization outsources the operation of as many as 200 information systems to an IDC, and it maintains its own development staff that develops most of the information systems.
Information security environment
The client belongs to an industry with a very high dependence on IT. Centered on the CSO, it divides security activities by domain, and it operates an Information Security Committee and a working-level council so that information security issues can be prevented and addressed at the enterprise level.
Nearly 200 information systems are operated under outsourcing at an IDC, and the environment is set up so that the client’s dedicated staff can monitor them from within the company.
Because the client has its own development staff, sharing and cooperation among internal organizations on information security matters operate well compared with other companies.
Project CSF
- Monitor recent certification-audit trends and the composition of auditors, and maintain a cooperation framework
- Select an appropriate certification scope, and perform a technical security vulnerability assessment and a risk assessment
- Accurately identify information assets related to the certification scope and conduct a security vulnerability assessment
- Present measures for operational management of the certification obtained and for upgrading the version of the certification standard
Key Activities and Deliverables
| Execution phase | Key activities | Deliverables |
|---|---|---|
| Definition of the ISMS certification scope | – Analysis of the current IT and information security status – Consultation on and confirmation of the certification scope | – Certification scope definition document |
| Analysis of ISMS operational status | – Gap analysis against the K-ISMS certification standard | – Information security management system gap analysis |
| Vulnerability assessment and risk assessment | – Classification and analysis of information assets – Vulnerability assessment of information assets – Internal and external penetration tests – Risk assessment and selection of the DOA | – Asset inventory and criticality results – Security vulnerability assessment report (by information asset) – Penetration test results report – Risk assessment report |
| Establishment of the ISMS certification system | – Establishment and revision of information security policies and guidelines – Establishment of an information security improvement plan – Information security effectiveness measurement table – Preparation of requirement documents by control item – Analysis of information security effectiveness | – Information security policy and guidelines – ISMS operational status table – Effectiveness analysis report |
| Preparation for ISMS certification | – Conduct a mock audit – Improvements based on the mock audit results | – Mock audit plan – Mock audit results |
| Support for the certification audit response | – Conduct pre-audit training – Support for the audit response – Support for responding to nonconformities | – Pre- and post-support for the document review, on-site audit, and similar activities |
- Deliverable examples: risk analysis report, Statement of Applicability (SOA)
