KR101259579B1 - System and method of opertating information security task - Google Patents

Abstract

PURPOSE: An information protection work operation system and a method thereof are provided to perform information protection work without the help of a professional consultant for information protection. CONSTITUTION: An information protection control unit(3) transmits a work performance manual of a control item to a worker terminal(10) and requests work. The information protection control unit transmits work performance result information and approval request information to an information protection director terminal(20). The information protection control unit stores the work performance result information in an evidence database(4) corresponding to reception of payment approval information from the information protection director terminal. [Reference numerals] (1) Information protection work operation system; (10) Worker terminal; (2) Information protection DB; (20) Information protection director terminal; (3) Information protection control unit; (4) Evidence DB; (AA) Network;

Description

SYSTEM AND METHOD OF OPERTATING INFORMATION SECURITY TASK}

The present invention relates to a system and method for operating an information security service, and more particularly, to an information security service operating system and method that enables a person without a deep understanding of information security to perform an information security service using an information security management system. It is about.

The Information Security Management System (hereinafter referred to as ISMS) is a certification system for a comprehensive management system, including technical and physical protection measures that are established and operated to ensure the stability of information and communication networks. In other words, ISMS is an information security system from an administrative point of view. It is a certification given to manage the evidence in order to establish a systematic management framework in the operation of the organization and to perform and prove the continuous information security management work.

Due to the recent enactment of the Personal Information Protection Act and the proliferation of large-scale security accidents, ISMS certification from an administrative perspective has been changed from a recommendation to a mandatory one, and is scheduled to be implemented in 2013. In the event of an accident, 50% of fines and penalties can be reduced and used as a means of immunity in litigation.

Such ISMS includes the Federal Information Security Management Act (FISMA) in the United States, ISO27001 as the international standard, KISA-ISMS and G-ISMS (Government-ISMS), and Personal Information Management (KIS) of the Korea Internet & Security Agency in Korea. System: PIMS). In Korea, KISA-ISMS, G-ISMS and PIMS should be obtained.

The ISMS certification is based on the implementation of the control items for each of the control requirements for information protection through the consulting of an information security consultant. Afterwards, a number of personnel (information security consultants) check whether the action controls for each of the control requirements are followed. This check is done by leaving evidence. The control requirements for data protection may consist of about 130 requirements, and the number of control items for each of the control requirements may be about 400 in total.

This creates a costly problem because the creation of action controls for each of the control requirements is made by the information security consultant. In addition, many people have the difficulty of periodically checking to see if the same practice controls are followed and performing repetitive work that leaves them as evidence.

An information security service operation system and method is proposed that enables a person who does not have a deep understanding of information security to perform information security work without consulting a professional consultant.

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other problems that are not mentioned can be clearly understood by those skilled in the art from the following description.

The information security service operation system according to an aspect of the present invention, the control requirements for information protection, the control items to be carried out to comply with the control requirements for each of the control requirements and compliance with the control requirements for each of the control requirements An information security database storing a work performance manual of each control item to be performed for An evidence database that stores, as an evidence, the performance information of the control items that are to be performed to comply with the control requirements for each of the control requirements, and has received the approval of the information protection officer; And requesting the work to be carried out by transmitting the work performance manual of the control item to the work performer terminal when the control items to be carried out to comply with the control requirements for each of the control requirements, when appropriate Transmitting work performance result information and approval request information received from the performer terminal to the information security officer terminal and receiving the payment approval information from the information security officer terminal, and storing the approved business performance result information in the evidence database as evidence. And an information protection control unit.

Each of the control requirements may be a proposition defined by an information security management system.

Each of the control items that must be performed to comply with the control requirements for each of the above control requirements can be predefined by the information security consultant.

The work performance manual of each control item to be carried out to comply with the control requirements for each of the above control requirements is the approval of the date of performance of the control item, the information on the performer of the control item and the result of the performance of the work performer. The information on the person responsible for the information protection, the place where the performance of the control item is performed, the content of the control item which is the work performance of the business operator, the reason why the business operator performs the work on the control item, the control item It may include information on how to perform the work for.

The reason information that the performer performs the work on the control item may be to obtain certification of the work performance on the control item or to update the work performance on the control item.

The performance manual for each of the control items to be performed for compliance with the control requirements for each of the control requirements may further include form document data necessary to leave the performance information on the control items as evidence.

The form document data may include form data for leaving work performance result information for the control item, sample form data for reference in preparing the form, and procedural data for the performance of the control item.

The timing of the performance of each of the control items to be performed to comply with the control requirements for each of the control requirements may be periodic or aperiodic.

The information protection control unit determines whether the work performance date for the control item is periodic or non-periodical in the work execution manual of each control item to be performed to comply with the control requirement for each control condition. It is possible to determine whether the timing of work is periodic or non-periodic.

The information protection control unit can identify the performer of the control item by using the performer information on the control item in the work manual of each control item to be performed to comply with the control requirement for each control requirement. have.

The information protection control unit uses the information protection officer information in the work performance manual of each control item to be performed to comply with the control requirement for each control requirement, and the information protection controller performs the information on the work performance result of the business operator for the control item. The approvers can be identified.

The information security operation method according to another aspect of the present invention, the control requirements for the protection of information, the control items to be carried out to comply with the control requirements for each of the control requirements and to comply with the control requirements for each of the control requirements Information security database that stores work performance manual of each control item to be performed, and the work of each control item to be performed to comply with the control requirements for each of the above control requirements. Perform the work of each control item to be carried out in the information security business operation system with the evidence database that stores the approved work performance information as evidence. When it is time to send the work manual of the control item to the performer terminal Requesting performance while doing so; Receiving work performance result information of the control item from the work operator terminal; Transmitting the task execution result information received from the corresponding task performer terminal to the information protection officer terminal together with the approval request information for the received task performance result information; And storing the approval result of the performance of the payment in the evidence database as an evidence upon receiving payment approval information from the information protection officer terminal.

When the control requirements for each of the control requirements to be carried out to comply with the control requirements for each of the control period, the step of requesting the performance of the work while transmitting the work performance manual of the control item to the operator of the relevant control unit, For each control item, whether the date of performance of the control item is periodic or non-periodical in each of the control items to be performed to comply with the control requirement. It can be determined whether it is aperiodic.

When the control requirements for each of the control requirements to be carried out to comply with the control requirements for each of the control period, the step of requesting the performance of the work while transmitting the work performance manual of the control item to the operator of the relevant control unit, For each control requirement, the performer of the control item can be identified by using the performer information on the control item in each of the control manuals to be performed to comply with the control requirement.

When the control requirements for each of the control requirements to be carried out to comply with the control requirements for each of the control period, the step of requesting the performance of the work while transmitting the work performance manual of the control item to the operator of the relevant control unit, The information security officer information of each control item to be performed to comply with the control requirement by control requirements can be used to identify the approver for the performance result information of the performer of the control item. .

According to an embodiment of the present invention, it is possible to reduce the cost of performing the information protection service by enabling the personnel without a deep understanding of the information protection without performing a professional consultant for information protection, Will be.

In addition, even if a non-expert expert performs information security work, the same result as that of an information security expert can be obtained.

1 is a diagram showing the configuration of an information security service operating system according to an embodiment of the present invention.
2 is a diagram illustrating control requirements and control items.
3 is a diagram illustrating a form for leaving work performance result information as evidence.
4 is a diagram illustrating the procedure data for the performance of the control item.
5 is a diagram illustrating a question about an aperiodic control item.
6 is a flowchart illustrating a method for operating an information protection service according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art, and the following embodiments may be modified in various other forms, The present invention is not limited to the following embodiments. Rather, these embodiments are provided so that this disclosure will be more thorough and complete, and will fully convey the concept of the invention to those skilled in the art.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. As used herein, the singular forms "a", "an," and "the" include plural forms unless the context clearly dictates otherwise. Also, as used herein, "comprise" and / or "comprising" specifies the presence of the mentioned shapes, numbers, steps, actions, members, elements and / or groups of these. It is not intended to exclude the presence or the addition of one or more other shapes, numbers, acts, members, elements and / or groups. As used herein, the term "and / or" includes any and all combinations of one or more of the listed items.

Although the terms first, second, etc. are used herein to describe various elements, regions and / or regions, it should be understood that these elements, components, regions, layers and / Do. These terms do not imply any particular order, top, bottom, or top row, and are used only to distinguish one member, region, or region from another member, region, or region. Thus, the first member, region or region described below may refer to a second member, region or region without departing from the teachings of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings schematically showing embodiments of the present invention. In the figures, for example, variations in the shape shown may be expected, depending on manufacturing techniques and / or tolerances. Accordingly, embodiments of the present invention should not be construed as limited to any particular shape of the regions illustrated herein, including, for example, variations in shape resulting from manufacturing.

1 is a diagram showing the configuration of an information security service operating system according to an embodiment of the present invention.

Referring to FIG. 1, an information protection service operating system 1 according to an exemplary embodiment of the present invention includes an information protection database 2, an information protection control unit 3, and an evidence database 4, and is connected to a network to perform work. It is connected to the performer terminal 10 and the information protection officer terminal 20 to perform data communication. Accordingly, the information protection task operating system 1 should be understood as a concept having a communication module (not shown) for performing data communication with the task performer terminal 10 and the information protection officer terminal 20. Similarly, the task performer terminal 10 and the information protection officer terminal 20 should also be understood as a concept having a communication module for accessing a network to perform data communication.

The information security database (2) includes the control requirements for data protection, the controls to be carried out to comply with the control requirements for each of the above control requirements, and the controls to be carried out for compliance with the corresponding control requirements for each of the control requirements. Save each work manual. In this case, each of the control requirements may be a proposition determined by an information security management system. The information security management system may be any one of FISMA, ISO27001, KISA-ISMS, G-ISMS, and PIMS.

Each of the control items that must be performed to comply with the control requirements for each of the above control requirements can be predefined by the information security consultant.

A diagram illustrating such control requirements and control items is shown in FIG. 2. 2 illustrates control requirements according to control purposes for data center security among physical security areas of an organization, for example, a company, and control items according to each control requirement.

For example, the information security management system described above requires that access to the data center should be carried out by appropriate access control procedures, and the identification, recording and management of the persons entering the data center should be checked regularly. The control items to be carried out to comply with this control requirement include "is there a policy and procedure for access to the data center" and "are accesses made in accordance with access policies and procedures?" "Is the access to the data center identified, recorded and managed?", "Is the access log book checked regularly?" Is the validity of the pass or permit regularly reviewed? "

In addition, the work performance manual of each control item to be performed to comply with the control requirements for each of the control requirements may be defined by the information security consultant in principle. The principle of subordination consists of 'when, who, where, what, why and how'. "When" may be the date of performance of the control. “Who” may be the information security officer who is the performer of the control item and the approver for the performer's performance result information. "Where" may be the place where the performance of the control items takes place. "What" may be a corresponding control item that is performed by the performer, and in addition, "What" may further include the information protection domain, control sector, control objectives, and control requirements. "Why" indicates the reason why the performer performs the work on the control item and may be to obtain certification of the work performance on the control item or to update the work performance on the control item. “How” refers to the method for performing the control on the control item, including the business performance sample, the performance product, the policy document for the performance of the control item, the description of the business activity for the job performance, and the considerations for the performance of the control item. It may include evidence registration methods to register information, results of the control items, and business performance results as evidence.

For example, "when" corresponds to the date of performance of the control and may be 'July 15, 2012'. In "Who", the performer of the control item may be 'Hong Gil-dong' and the information security officer who is the approver for the performer's performance result information may be the 'Chu Jun CISO'. "Where" corresponds to the place where the performance of the control takes place and may be 'A. Office'. "What" corresponds to the relevant control item, which is the work performed by the performer, and may be, "Is the necessary guidelines, standards and procedures for implementing the policy implemented?" "What" should establish information protection guidelines, procedures and standards for the specific implementation of the information protection policy. In addition, a detailed information security policy for a specific system or service can be established if necessary ',' type of policy document 'for control purposes,' system of policy 'as a control section, and' information security policy 'as an information protection domain. This may be more applicable. "Why" refers to the reason why the performer performs the work on the control item and to obtain certification of the work performance on the control item or to update the work performance on the control item. It may be for.

In addition, the performance manual of each control item to be performed to comply with the control requirement for each of the control requirements may further include form document data necessary to leave the performance information of the control item as evidence. The form document data may include form data for leaving work performance result information for the control item, sample form data for reference in preparing the form, and procedural data for the performance of the control item.

For example, form data for storing the work performance result information for office security is shown in FIG. 3, and procedure data for work performance for this office security is shown in FIG. 4. Therefore, the performer can perform the work according to the procedure data shown in FIG. 4 and fill in the form shown in FIG. 3.

The evidence database (4) provides evidence of the performance results obtained by the person performing the tasks of each of the control items that must be performed to comply with the control requirements for each of the above control requirements. Save it.

The information protection control unit 3 transmits the work performance manual of the control item to the corresponding service performer terminal 10 when the control time to be performed for compliance with the control requirement for each of the control requirements falls under the task execution time. While requesting work performance, and transmits the work performance result information and the approval request information received from the work performer terminal 10 to the information protection officer terminal 20 to receive payment approval information from the information protection officer terminal 20. The work performance result information approved according to the certificate is stored in the evidence database (4).

At this time, the performance of each of the control items to be performed to comply with the control requirements for each of the control requirements may be periodic or aperiodic. The information protection control unit 3 determines whether the work performance date for the control item is periodic or non-periodical among the work execution manuals of the control items to be performed to comply with the control requirements for each of the control requirements. It is possible to determine whether the performance of the work is periodic or non-periodic.

Periodic tasks are tasks that are performed with periodicity such as once a month, quarterly, and once a year by tying up frequently occurring tasks such as daily security log records and entry / exit managers. Aperiodic tasks represent tasks generated when events occur, such as resignation of an organization, acquisition of information assets, and occurrence of an information security incident. A more specific example is shown in FIG. 4. Such non-periodic work is performed under the control of the information protection control unit 3 and corresponds to the question about the non-periodic control item illustrated in FIG. 5 on the date set by the information security officer, for example, the information security inspection date. The aperiodic control item transmitted to the performer's terminal and the aperiodic control item received from the performer's terminal is transmitted to the information security officer's terminal. The control items are transmitted to the terminal of the operator, so that the task is performed on the task execution date. For example, if the non-periodic control item received is "Have the personnel movement of the information security person in charge?", The information protection control unit 3 transmits it to the information security officer terminal and the response from the information protection terminal. Upon receiving the work performance date of the received aperiodic control item, the non-periodic work performance information and the work performance manual of the received aperiodic control item are transmitted to the work performer terminal, and the received answer to the work performer. Requests to perform work on periodic control items.

Meanwhile, each of the control items to be carried out to comply with the control requirements for each of the above control requirements is designated by the information security officer in advance, which means that the control items to be carried out to comply with the corresponding control requirements for each of the above control requirements Each of these tasks is included as information on the performer of the control item. Therefore, the information protection control unit 3 uses the operator's information on the control item in the work manual of each control item to be performed for compliance with the control requirement for each control condition. I can figure it out.

In addition, the information protection control unit 3 uses the information protection officer information in the work performance manual of each control item to be performed for compliance with the control requirement for each control requirement, and performs the work performed by the performer of the control item for the control item. Identify approvers for the information.

The configuration diagram of the information security service operating system 1 according to the embodiment of the present invention shown in FIG. 1 is merely classified from a functional point of view, and does not mean an actual implementation method or a hardware method. One or more of the configuration modules shown in FIG. 1 may be integrated or subdivided into one or more configuration modules, which will be apparent to those of ordinary skill in the art.

Hereinafter, the operation of the information security service operating system according to an embodiment of the present invention will be described with reference to FIG. 6.

The information protection control unit 3 of the information protection service operation system 1 controls the control items that are to be undertaken during the work period among the control items to be performed for compliance with any control requirements stored in the information protection database 2. Sending a work performance manual of the control item to the work performer terminal of the work performer of the item and requests the work performance (S10). At this time, the performance manual of the control item may include data of the form documents necessary to leave the performance information of the control item as evidence. The form document data may include form data for leaving work performance result information for the corresponding control item, sample form data for reference in preparing the form, and procedure data in which the order of preparing the form is defined. Can be.

For example, an arbitrary control requirement is "entry into the data center must be implemented by appropriate access control procedures, and must identify, record and manage the accessor. The accessor record book should be checked on a regular basis." If the control item that has passed the control is "identified, recorded and managed by the data center," the information security control unit 3 checks whether the control item "identified by the data center is identified, recorded and managed." It is a task performer terminal of a business performer who requests a task to be performed while transmitting a task manual about whether the person in the data center is identified, recorded and managed.

Accordingly, the service operator terminal may output the form document data in the work performance manual of the control item received with the work performance request on the screen. The performer performs the work of the relevant control item by using the form document data displayed on the screen of the performer terminal and inputs the result of the work to the form in the form document data. For example, the operator's terminal outputs the form document data included in the practice manual of the control item "Identifier of the data center is identified, recorded and managed" received with the task execution request on the screen. Accordingly, the performer performs the verification work on whether or not the person in the data center is identified, recorded and managed using the form document data displayed on the screen of the performer's terminal, and the result of the work is carried out in the form document data. Type in

After the completion of the input of the business performance result information on the form, the business operator terminal transmits the business performance result information to the information protection business operation system (1). For example, when input of work performance result information on whether a person in a data center is identified, recorded and managed on a form is completed, the work operator terminal may display the completed information on the work performance information operation system (1). To send.

The information protection control unit 3 in the information protection task operation system 1 receives the task performance result information received from the task performer terminal 10 and the approval request information for the received task performance result information. Transfer to (S12). For example, when the information protection control unit 3 receives the work performance result information on whether the person in the data center is identified, recorded, and managed from the work execution terminal 10, the information protection control unit 3 receives the work performance result information together with the work performance result information. The approval request information for the work performance result information is transmitted to the information protection officer terminal (20).

Accordingly, the information protection officer terminal 20 outputs the work performance result information for the control item on the screen and also outputs the approval request correction information for the work performance result information. For example, the information security officer terminal 20 outputs the work performance result information on the control item " is the person in the data center identified, recorded and managed? The approval request information on the received work performance result information is also output on the screen. When the information protection officer reviews the work performance result information displayed on the screen of the information protection officer terminal 20 and inputs the approval information to the information protection officer terminal 20 when there is no abnormality, the information protection officer terminal 20 The payment approval information is transmitted to the information protection service operating system (1).

The information protection control unit 3 in the information protection service operation system 1 stores the approval result of the business performance in the evidence database 4 as a result of receiving approval information from the information protection officer terminal 20. do. For example, when the information protection control unit 3 receives the payment approval information for the business performance result information of the control item "Identifier of the data center is identified, recorded and managed", the information protection control unit 3 accumulates the approved business performance result information. In the evidence database 4 (S14).

In this case, if the result of approval of the performance of one control item is approved and stored as evidence, the process repeats this process to generate a record of all control items that must be performed in order to keep any control requirements. Save it to (4).

The present invention has been described above with reference to the embodiments. It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. Therefore, the scope of the present invention is not limited to the above-described embodiments, but should be construed to include various embodiments within the scope of the claims and equivalents thereof.

1: Information security business operation system
2: Information Security Database
3: Information protection control
4: evidence database

Claims (22)

Stores the work performance manual for each of the control requirements for information protection, the control items to be carried out for compliance with the corresponding control requirements and the control items to be carried out for compliance with the control requirements for the control requirements. An information security database;
An evidence database that stores, as an evidence, the performance information of the control items that are to be performed to comply with the control requirements for each of the control requirements, and has received the approval of the information protection officer; And
When each of the control items to be performed to comply with the control requirements for each of the above control requirements falls within the task execution time set in the relevant work execution manual, the work performance of the control item is transmitted to the corresponding work performer's terminal. And transmits the performance result information and the approval request information received from the relevant business operator's terminal to the information security officer's terminal and receives the payment approval information from the information protection officer's terminal. And an information protection control unit for storing in the evidence database. The method according to claim 1,
And each of the control requirements is a proposition defined by an information security management system. The method according to claim 2,
Information security service operating system, characterized in that each of the control items to be performed for compliance with the control requirements for each of the control requirements are predefined by the information security consultant. The method according to claim 1,
The work performance manual of each control item to be carried out to comply with the control requirements for each of the above control requirements is the approval of the date of performance of the control item, the information on the performer of the control item and the result of the performance of the work performer. The information on the person responsible for the information protection, the place where the performance of the control item is performed, the content of the control item which is the work performance of the business operator, the reason why the business operator performs the work on the control item, the control item Information security service operating system comprising a method information for performing a task for. The method of claim 4,
The information on the reason for performing the work on the control item is performed by the corresponding work performer for obtaining the certification of the work performance on the control item or updating the work performance on the control item. Operating system. The method of claim 4,
The work performance manual of each control item to be performed for compliance with the control requirement for each of the control requirements may further include form document data necessary to leave the performance information of the control item as evidence. Information Security Service Operation System. The method of claim 6,
The form document data includes form data for leaving work performance result information for the control item, sample form data for reference in preparing the form, and procedural data for the performance of the control item. Information security service operation system. The method of claim 4,
Information security service operation system, characterized in that the performance of each of the control items to be performed to comply with the control requirements for each of the control requirements, periodically or aperiodic. The method according to claim 8,
The information protection control unit,
According to the above control requirements, whether the work performance date for the control item is periodic or non-periodical in the work performance manual of each control item to be performed to comply with the control requirement. Or information security service operating system, characterized in that it determines whether or not. The method of claim 4,
The information protection control unit,
Information protection characterized by identifying the performer of the control item by using the performer information on the control item in the work execution manual of each control item to be performed to comply with the control requirement for each control requirement Business operation system. The method of claim 4,
The information protection control unit,
Identifying the approval approver on the work performance result information of the performer of the control item using the information protection officer information in the work performance manual of each control item to be performed to comply with the control requirement for each control requirement Information security service operating system, characterized in that. Stores the work performance manual for each of the control requirements for information protection, the control items to be carried out for compliance with the corresponding control requirements and the control items to be carried out for compliance with the control requirements for the control requirements. Evidence of the information security database and the business performance result information obtained by approval of the information security officer by performing the work of each control item to be performed to comply with the control requirements for each of the above control requirements. The information security service operation method of the information security service operation system having the stored evidence database,
When each of the control items to be performed to comply with the control requirements for each of the above control requirements falls within the task execution time set in the relevant work execution manual, the work performance of the control item is transmitted to the corresponding work performer's terminal. Requesting;
Receiving work performance result information of the control item from the work operator terminal;
Transmitting the task execution result information received from the corresponding task performer terminal to the information protection officer terminal together with the approval request information for the received task performance result information; And
And storing the approved business performance result information as an evidence in the evidence database upon receiving payment approval information from the information protection officer terminal. The method of claim 12,
And each of the control requirements is a proposition specified by an information security management system. The method according to claim 13,
And each control item to be performed for compliance with the control requirements for each of the control requirements is defined by an information security consultant. The method of claim 12,
For each of the above control requirements, the business performance manual for each of the control items to be carried out to comply with the control requirements,
The date of performance of the control item, the information security officer information, which is the approver for the performance information of the control item and the performance result of the business operator, the place where the performance of the control item is performed, and the performance of the business operator. Information control operation method comprising the content of the control item, the reason that the performer performs the work on the control item, the method information for performing the work on the control item. The method according to claim 15,
The information on the reason for performing the work on the control item is performed by the corresponding work performer for obtaining the certification of the work performance on the control item or updating the work performance on the control item. How it works. The method according to claim 15,
The work performance manual of each control item to be performed for compliance with the control requirement for each of the control requirements may further include form document data necessary to leave the performance information of the control item as evidence. How Information Security Works. 18. The method of claim 17,
The form document data includes form data for leaving work performance result information for the control item, sample form data for reference in preparing the form, and procedural data for the performance of the control item. How to operate information security services. The method according to claim 15,
Method of operating the information security service, characterized in that the performance of each of the control items to be performed to comply with the control requirements for each of the control requirements, periodically or aperiodically. The method of claim 19,
When the control requirements for each of the control requirements to be carried out for compliance with the control requirements of each of the control requirements to meet the timing of the task performing the task of transmitting the work manual of the control item to the operator of the control unit, requesting the performance of the work,
According to the above control requirements, whether the work performance date for the control item is periodic or non-periodical in the work performance manual of each control item to be performed to comply with the control requirement. Or aperiodic determining whether the information security service operating method. The method according to claim 15,
When the control requirements for each of the control requirements to be carried out for compliance with the control requirements of each of the control requirements to meet the timing of the task performing the task of transmitting the work manual of the control item to the operator of the control unit, requesting the performance of the work,
Information protection characterized by identifying the performer of the control item by using the performer information on the control item in the work execution manual of each control item to be performed to comply with the control requirement for each control requirement How to do business. The method according to claim 15,
When the control requirements for each of the control requirements to be carried out for compliance with the control requirements of each of the control requirements to meet the timing of the task performing the task of transmitting the work manual of the control item to the operator of the control unit, requesting the performance of the work,
Identifying the approval approver on the work performance result information of the performer of the control item using the information protection officer information in the work performance manual of each control item to be performed to comply with the control requirement for each control requirement Information security service operating method characterized in that.

Images