Client: App and content platform A (operation of a marketplace for games and apps, mobile commerce, e-books, and video content)
Project duration
2016: one year of initial-audit consulting; ISMS certification obtained
2017: eight months of surveillance-audit (first) consulting
2018: six months of surveillance-audit (second) consulting
Project background and subject
The client spun off from its parent company in 2016 and is an organization required to maintain ISMS certification under the Information and Communications Network Act.
Because it had to obtain certification separately from the parent company, which had already obtained ISMS certification, it commissioned consulting covering everything from establishment of a management system suited to the company’s size through to operation.
IT and Information Security Environment
Business and IT environment
The client integrated the app markets that Korea’s three major telecommunications carriers had each operated, and it is the only domestic app market of its kind. Its main business areas are mobile games, mobile apps, mobile commerce, and sales of e-books and video content. It is increasing its domestic and overseas market share against the Apple App Store and Google Play Store, which currently divide the global market. To support the business smoothly, most of the client’s approximately 2,000 information systems are operated under outsourcing at an IDC, and in-house developers and external personnel are stationed on site to develop most of the information systems and services.
Information security environment
The client depends heavily on IT, including reliance on IT for most work processing, and for all services. Centered on the CISO, it divides security activities by domain and operates an Information Security Committee and a working-level council so that information security issues can be prevented and addressed at the enterprise level. Because electronic commerce occurs as a characteristic of the business, the client must comply with the Electronic Financial Transactions Act. Based on the Information and Communications Network Act, it must also comply with other laws, including the Personal Information Protection Act and the Credit Information Act. Most information systems are operated under outsourcing at an IDC, and the environment is set up so that the client’s dedicated staff can monitor them from within the company. Except for customer-service work, external development and operations personnel support the work of each practitioner from a separate workspace near the client. Sharing and cooperation among organizations on information security matters therefore operate smoothly.
Key Activities and Deliverables
| Execution phase | Key activities | Deliverables |
|---|---|---|
| ISMS certification scope definition | – Analysis of the current IT and information security status – Consultation on and confirmation of the certification scope | – Certification scope definition document |
| ISMS operational status analysis | – Analysis of the current information security management system and gap analysis against the ISMS certification standard | – Information security management system operational statement |
| Vulnerability assessment and risk assessment | – Classification and analysis of information assets – Vulnerability assessment of information assets – Internal and external penetration tests – Risk assessment and selection of the DOA | – Asset register – Security vulnerability assessment report (by information asset) – Penetration test results report – Risk assessment report |
| ISMS certification system establishment | – Establishment and revision of information security policies and guidelines – Establishment of an information security improvement plan – Information security effectiveness measurement table – Preparation of requirement documents by control item – Analysis of information security effectiveness | – Information security policy and guidelines – ISMS operational status table – Effectiveness analysis report |
| ISMS certification preparation | – Prepare the certification application – Internal audit and mock audit – Present an audit response plan | – Certification application – Internal audit and mock audit plan – Internal audit and mock audit results |
| Certification audit response support | – Conduct pre-audit training – Support for responding to nonconformities | – For document review, on-site audit, and similar activities, pre- and post-support |
- Deliverable examples: risk analysis report, Statement of Applicability (SOA)
