diff --git a/dashboard/common_methods.py b/dashboard/common_methods.py index 89ce89ebe4..23ec36845e 100644 --- a/dashboard/common_methods.py +++ b/dashboard/common_methods.py @@ -2223,3 +2223,232 @@ def get_section_containers_ens(data, section_1, section_2, section_3, section_4) section_containers.append(section_container) return html.Div(section_containers, className="compliance-data-layout") + + +# This function extracts and compares up to two numeric values, ensuring correct sorting for version-like strings. +def extract_numeric_values(value): + numbers = re.findall(r"\d+", str(value)) + if len(numbers) >= 2: + return int(numbers[0]), int(numbers[1]) + elif len(numbers) == 1: + return int(numbers[0]), 0 + return 0, 0 + + +def get_section_containers_kisa_ismsp(data, section_1, section_2): + data["STATUS"] = data["STATUS"].apply(map_status_to_icon) + data[section_1] = data[section_1].astype(str) + data[section_2] = data[section_2].astype(str) + data.sort_values( + by=section_1, + key=lambda x: x.map(extract_numeric_values), + ascending=True, + inplace=True, + ) + + findings_counts_section = ( + data.groupby([section_2, "STATUS"]).size().unstack(fill_value=0) + ) + findings_counts_name = ( + data.groupby([section_1, "STATUS"]).size().unstack(fill_value=0) + ) + + section_containers = [] + + for name in data[section_1].unique(): + success_name = ( + findings_counts_name.loc[name, pass_emoji] + if pass_emoji in findings_counts_name.columns + else 0 + ) + failed_name = ( + findings_counts_name.loc[name, fail_emoji] + if fail_emoji in findings_counts_name.columns + else 0 + ) + + fig_name = go.Figure( + data=[ + go.Bar( + name="Failed", + x=[failed_name], + y=[""], + orientation="h", + marker=dict(color="#e77676"), + width=[0.8], + ), + go.Bar( + name="Success", + x=[success_name], + y=[""], + orientation="h", + marker=dict(color="#45cc6e"), + width=[0.8], + ), + ] + ) + + fig_name.update_layout( + barmode="stack", + margin=dict(l=10, r=10, t=10, b=10), + paper_bgcolor="rgba(0,0,0,0)", + plot_bgcolor="rgba(0,0,0,0)", + showlegend=False, + width=350, + height=30, + xaxis=dict(showticklabels=False, showgrid=False, zeroline=False), + yaxis=dict(showticklabels=False, showgrid=False, zeroline=False), + annotations=[ + dict( + x=success_name + failed_name, + y=0, + xref="x", + yref="y", + text=str(success_name), + showarrow=False, + font=dict(color="#45cc6e", size=14), + xanchor="left", + yanchor="middle", + ), + dict( + x=0, + y=0, + xref="x", + yref="y", + text=str(failed_name), + showarrow=False, + font=dict(color="#e77676", size=14), + xanchor="right", + yanchor="middle", + ), + ], + ) + + graph_name = dcc.Graph( + figure=fig_name, config={"staticPlot": True}, className="info-bar" + ) + + graph_div = html.Div(graph_name, className="graph-section") + + direct_internal_items = [] + + for section in data[data[section_1] == name][section_2].unique(): + specific_data = data[ + (data[section_1] == name) & (data[section_2] == section) + ] + success_section = ( + findings_counts_section.loc[section, pass_emoji] + if pass_emoji in findings_counts_section.columns + else 0 + ) + failed_section = ( + findings_counts_section.loc[section, fail_emoji] + if fail_emoji in findings_counts_section.columns + else 0 + ) + + data_table = dash_table.DataTable( + data=specific_data.to_dict("records"), + columns=[ + {"name": i, "id": i} + for i in ["CHECKID", "STATUS", "REGION", "ACCOUNTID", "RESOURCEID"] + ], + style_table={"overflowX": "auto"}, + style_as_list_view=True, + style_cell={"textAlign": "left", "padding": "5px"}, + ) + + fig_section = go.Figure( + data=[ + go.Bar( + name="Failed", + x=[failed_section], + y=[""], + orientation="h", + marker=dict(color="#e77676"), + ), + go.Bar( + name="Success", + x=[success_section], + y=[""], + orientation="h", + marker=dict(color="#45cc6e"), + ), + ] + ) + + fig_section.update_layout( + barmode="stack", + margin=dict(l=10, r=10, t=10, b=10), + paper_bgcolor="rgba(0,0,0,0)", + plot_bgcolor="rgba(0,0,0,0)", + showlegend=False, + width=350, + height=30, + xaxis=dict(showticklabels=False, showgrid=False, zeroline=False), + yaxis=dict(showticklabels=False, showgrid=False, zeroline=False), + annotations=[ + dict( + x=success_section + failed_section, + y=0, + xref="x", + yref="y", + text=str(success_section), + showarrow=False, + font=dict(color="#45cc6e", size=14), + xanchor="left", + yanchor="middle", + ), + dict( + x=0, + y=0, + xref="x", + yref="y", + text=str(failed_section), + showarrow=False, + font=dict(color="#e77676", size=14), + xanchor="right", + yanchor="middle", + ), + ], + ) + + graph_section = dcc.Graph( + figure=fig_section, + config={"staticPlot": True}, + className="info-bar-child", + ) + + graph_div_section = html.Div(graph_section, className="graph-section-req") + + internal_accordion_item = dbc.AccordionItem( + title=section, + children=[html.Div([data_table], className="inner-accordion-content")], + ) + + internal_section_container = html.Div( + [ + graph_div_section, + dbc.Accordion( + [internal_accordion_item], start_collapsed=True, flush=True + ), + ], + className="accordion-inner--child", + ) + + direct_internal_items.append(internal_section_container) + + accordion_item = dbc.AccordionItem( + title=f"{name}", children=direct_internal_items + ) + section_container = html.Div( + [ + graph_div, + dbc.Accordion([accordion_item], start_collapsed=True, flush=True), + ], + className="accordion-inner", + ) + + section_containers.append(section_container) + + return html.Div(section_containers, className="compliance-data-layout") diff --git a/dashboard/compliance/kisa_isms_p_2023_aws.py b/dashboard/compliance/kisa_isms_p_2023_aws.py new file mode 100644 index 0000000000..1d079d46af --- /dev/null +++ b/dashboard/compliance/kisa_isms_p_2023_aws.py @@ -0,0 +1,25 @@ +import warnings + +from dashboard.common_methods import get_section_containers_kisa_ismsp + +warnings.filterwarnings("ignore") + + +def get_table(data): + aux = data[ + [ + "REQUIREMENTS_ID", + "REQUIREMENTS_ATTRIBUTES_SUBDOMAIN", + "REQUIREMENTS_ATTRIBUTES_SECTION", + # "REQUIREMENTS_DESCRIPTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ].copy() + + return get_section_containers_kisa_ismsp( + aux, "REQUIREMENTS_ATTRIBUTES_SUBDOMAIN", "REQUIREMENTS_ATTRIBUTES_SECTION" + ) diff --git a/dashboard/compliance/kisa_isms_p_2023_korean_aws.py b/dashboard/compliance/kisa_isms_p_2023_korean_aws.py new file mode 100644 index 0000000000..1d079d46af --- /dev/null +++ b/dashboard/compliance/kisa_isms_p_2023_korean_aws.py @@ -0,0 +1,25 @@ +import warnings + +from dashboard.common_methods import get_section_containers_kisa_ismsp + +warnings.filterwarnings("ignore") + + +def get_table(data): + aux = data[ + [ + "REQUIREMENTS_ID", + "REQUIREMENTS_ATTRIBUTES_SUBDOMAIN", + "REQUIREMENTS_ATTRIBUTES_SECTION", + # "REQUIREMENTS_DESCRIPTION", + "CHECKID", + "STATUS", + "REGION", + "ACCOUNTID", + "RESOURCEID", + ] + ].copy() + + return get_section_containers_kisa_ismsp( + aux, "REQUIREMENTS_ATTRIBUTES_SUBDOMAIN", "REQUIREMENTS_ATTRIBUTES_SECTION" + ) diff --git a/prowler/__main__.py b/prowler/__main__.py index 73477dd3a0..fd0401e1b5 100644 --- a/prowler/__main__.py +++ b/prowler/__main__.py @@ -54,6 +54,7 @@ from prowler.lib.outputs.compliance.compliance import display_compliance_table from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS from prowler.lib.outputs.compliance.generic.generic import GenericCompliance from prowler.lib.outputs.compliance.iso27001.iso27001_aws import AWSISO27001 +from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp_aws import AWSKISAISMSP from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_aws import AWSMitreAttack from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import ( AzureMitreAttack, @@ -430,6 +431,20 @@ def prowler(): ) generated_outputs["compliance"].append(iso27001) iso27001.batch_write_data_to_file() + elif compliance_name.startswith("kisa"): + # Generate KISA-ISMS-P Finding Object + filename = ( + f"{global_provider.output_options.output_directory}/compliance/" + f"{global_provider.output_options.output_filename}_{compliance_name}.csv" + ) + kisa_ismsp = AWSKISAISMSP( + findings=finding_outputs, + compliance=bulk_compliance_frameworks[compliance_name], + create_file_descriptor=True, + file_path=filename, + ) + generated_outputs["compliance"].append(kisa_ismsp) + kisa_ismsp.batch_write_data_to_file() else: filename = ( f"{global_provider.output_options.output_directory}/compliance/" diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json new file mode 100644 index 0000000000..c64c4195e6 --- /dev/null +++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json @@ -0,0 +1,4335 @@ +{ + "Framework": "KISA-ISMS-P", + "Version": "2023", + "Provider": "AWS", + "Description": "The ISMS-P certification, established by KISA (Korea Internet & Security Agency), is a system where an independent certification body evaluates whether a company or organization's information security and privacy protection measures comply with certification standards, and grants certification. This helps organizations improve public trust in their services and respond effectively to increasingly complex cyber threats. The ISMS-P framework also provides comprehensive guidelines for systematically establishing, implementing, and managing information security and privacy protection.", + "Requirements": [ + { + "Id": "1.1.1", + "Name": "Executive Participation", + "Description": "The CEO must establish and operate a reporting and decision-making system to ensure executive participation in the establishment and operation of the information protection and personal information protection management system.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.1. Management System", + "Section": "1.1.1 Executive Participation", + "AuditChecklist": [ + "Is there documentation outlining the responsibilities and roles of executives to ensure their participation in the establishment and operation of the information protection and personal information protection management system?", + "Is there a reporting, review, and approval process in place to ensure that executives actively participate in decision-making regarding information protection and personal information protection activities?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information protection and personal information protection reporting system (e.g., communication plan)", + "Minutes of the Information Protection and Personal Information Protection Committee", + "Information protection and personal information protection policies/guidelines (including executive approval records)", + "Information protection plans and internal management plans (including executive approval records)", + "Information protection and personal information protection organization chart" + ], + "NonComplianceCases": [ + "Case 1: Although it is stated in the information protection and personal information protection policy to report the status of information protection and personal information protection to the executives on a quarterly basis, no such reports have been made for an extended period.", + "Case 2: In performing major information protection activities (e.g., risk assessment, determining risk acceptance levels, reviewing information protection measures and implementation plans, reviewing the results of information protection measures, security audits, etc.), executives or those authorized by the executives did not participate in decision-making or there was no evidence of their involvement." + ] + } + ] + }, + { + "Id": "1.1.2", + "Name": "Designation of Chief Officers", + "Description": "The CEO must appoint a Chief Information Security Officer (CISO) responsible for information protection and a Chief Privacy Officer (CPO) responsible for personal information protection, both at an executive level with authority to allocate resources such as budget and personnel.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.1. Management System", + "Section": "1.1.2 Designation of Chief Officers", + "AuditChecklist": [ + "Has the CEO officially designated a chief officer responsible for overseeing information protection and personal information protection?", + "Are the CISO and CPO appointed at an executive level with authority to allocate resources such as budget and personnel, and do they meet the qualifications required by relevant laws?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures), Article 31 (Designation of a Personal Information Protection Officer)", + "Information and Communications Network Act, Article 45-3 (Designation of a Chief Information Security Officer, etc.)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Documents related to the appointment of the CISO and CPO (e.g., personnel orders, personnel records)", + "Information protection and personal information protection organization chart", + "Information protection and personal information protection policies/guidelines", + "Job descriptions (roles and responsibilities of the CISO and CPO)", + "Records of CISO reports", + "Internal management plans (regarding the appointment of the CPO)" + ], + "NonComplianceCases": [ + "Case 1: Failure to appoint and report a CISO as required under the Information and Communications Network Act, even though the organization is obligated to do so.", + "Case 2: Appointing a person without substantial authority and status as the CPO, making it difficult to believe that they are responsible for overseeing personal information processing.", + "Case 3: Although the organization chart specifies the CISO and CPO, the formal appointment process, such as issuing personnel orders, was not followed.", + "Case 4: Although the entity is subject to ISMS certification and had over 5 trillion won in assets at the end of the previous year, the CISO also holds the position of CIO, in violation of the ISMS requirements." + ] + } + ] + }, + { + "Id": "1.1.3", + "Name": "Organization Structure", + "Description": "The CEO must establish and operate a working group to effectively implement information protection and personal information protection, a committee that can review and approve key matters related to information protection and personal information protection across the organization, and a consultative body consisting of department-level information protection and personal information protection officers for enterprise-wide protection activities.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.1. Management System", + "Section": "1.1.3 Organization Structure", + "AuditChecklist": [ + "Has the organization established and operated a working group with expertise to support the work of the CISO and CPO and systematically implement the organization's information protection and personal information protection activities?", + "Has the organization established and operated a committee that can review, approve, and make decisions on important information protection and personal information protection matters across the organization?", + "Has the organization established and operated a working group composed of information protection and personal information protection officers and department-level personnel for enterprise-wide information protection and personal information protection activities?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Information protection and personal information protection committee regulations/minutes", + "Information protection and personal information protection working group regulations/minutes", + "Information protection and personal information protection organization chart", + "Internal management plan", + "Job descriptions" + ], + "NonComplianceCases": [ + "Case 1: The Information Protection and Personal Information Protection Committee was established, but it consists only of department heads without the inclusion of executives, making it difficult to make decisions on the organization's key information and personal information protection matters.", + "Case 2: Although a working group for information protection and personal information protection was established, including heads of departments that handle important information and personal data, it has not been active for an extended period.", + "Case 3: Although the Information Protection and Personal Information Protection Committee was convened, major matters such as the annual information protection and personal information protection plan, training plan, budget, and personnel were not reviewed or decided upon.", + "Case 4: Although an Information Protection Committee was established for deliberation and decision-making on information protection and personal information protection matters, only the operations and IT security departments participated, without the involvement of departments responsible for personal information protection, leaving personal information protection matters undecided." + ] + } + ] + }, + { + "Id": "1.1.4", + "Name": "Scope Setting", + "Description": "The organization must set the scope of the management system by considering its core services and the current state of personal information processing, and document the related services, personal information processing tasks, organizations, assets, and physical locations.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.1. Management System", + "Section": "1.1.4 Scope Setting", + "AuditChecklist": [ + "Has the organization set the scope of the management system to include key assets that may affect core services and personal information processing?", + "If there are exceptions within the defined scope, are clear reasons documented, and are consultations with relevant stakeholders and approvals from responsible parties recorded and managed?", + "Is the organization maintaining documentation that includes the major services, operational status, and systems, allowing for clear verification of the scope of the information protection and personal information protection management system?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Scope definition document for information protection and personal information protection management system", + "List of information assets and personal information", + "Document list", + "Service flowchart", + "Personal information flowchart", + "Organization-wide organizational chart", + "System and network configuration diagram" + ], + "NonComplianceCases": [ + "Case 1: The development and test systems, external staff, PCs, and test devices related to the development work for information systems and personal information processing systems were omitted from the management system's scope.", + "Case 2: Key organizations (personnel) in departments and business units that play critical roles in decision-making for services or businesses within the scope of the information protection and personal information protection management system were not included in the certification scope.", + "Case 3: The development and test systems, developer PCs, test devices, and development organizations related to the development work for information systems and personal information processing systems were omitted from the management system's scope." + ] + } + ] + }, + { + "Id": "1.1.5", + "Name": "Policy Establishment", + "Description": "The organization must establish and document information protection and personal information protection policies and implementation documents, clearly stating the organization's information protection and personal information protection guidelines and direction. These policies and implementation documents must be approved by the executive management and communicated in an understandable form to employees and relevant parties.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.1. Management System", + "Section": "1.1.5 Policy Establishment", + "AuditChecklist": [ + "Has the organization established a top-level information protection and personal information protection policy that serves as the foundation for all information protection and personal information protection activities?", + "Has the organization established detailed guidelines, procedures, and manuals specifying the methods, processes, and frequencies required to implement the information protection and personal information protection policies?", + "Are the information protection and personal information protection policies and implementation documents approved by the CEO or by someone delegated by the CEO when newly established or revised?", + "Are the latest versions of the information protection and personal information protection policies and implementation documents provided to relevant employees in an easily understandable format?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Information protection and personal information protection policies/guidelines/procedures (including records of new/revised versions)", + "Meeting minutes of stakeholder reviews of newly established/revised information protection and personal information protection policies/guidelines/procedures", + "Internal management plans for personal information", + "Notifications of new/revised information protection and personal information protection policies/guidelines (via groupware, intranet, etc.)", + "Minutes of the Information Protection and Personal Information Protection Committee" + ], + "NonComplianceCases": [ + "Case 1: Although internal regulations stipulate that revisions to the information protection and personal information protection policies must be approved by the Information Protection and Personal Information Protection Committee, recent revisions were made solely based on the approval of the CISO and CPO without presenting the revisions to the committee.", + "Case 2: The information protection and personal information protection policies and guidelines were recently revised, but these changes were not communicated to relevant departments and employees, leading some departments to continue operating based on outdated guidelines.", + "Case 3: The information protection and personal information protection policies and guidelines are managed solely by the security department and are not made available for employees to access through bulletin boards or documents." + ] + } + ] + }, + { + "Id": "1.1.6", + "Name": "Resource Allocation", + "Description": "The CEO must allocate the necessary resources, including budget and personnel with expertise in the fields of information protection and personal information protection, for the effective implementation and continuous operation of the management system.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.1. Management System", + "Section": "1.1.6 Resource Allocation", + "AuditChecklist": [ + "Has the organization secured personnel with expertise in the fields of information protection and personal information protection?", + "Has the organization evaluated and allocated the necessary resources, including budget and personnel, for the effective implementation and continuous operation of the information protection and personal information protection management system?", + "Has the organization established and implemented an annual detailed action plan for information protection and personal information protection, and conducted audits, analyses, and evaluations of the results?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Annual action plan for information protection and personal information protection activities (including budget and personnel plans)", + "Reports on the results of information protection and personal information protection activities", + "Records of investments in information protection and personal information protection", + "Information protection and personal information protection organization chart" + ], + "NonComplianceCases": [ + "Case 1: The organization assembled an information protection and personal information protection team, but the team consisted only of personnel without expertise in information protection or IT, resulting in inadequate security staffing.", + "Case 2: The CEO failed to allocate sufficient resources, such as budget and security solutions, for implementing the technical and managerial safeguards required for personal information processing systems.", + "Case 3: After obtaining certification, the organization significantly reduced personnel and budget support, reassigned existing staff to other departments, and repurposed part of the budget for other uses." + ] + } + ] + }, + { + "Id": "1.2.1", + "Name": "Identification of Information Assets", + "Description": "Organizations must establish classification criteria for information assets according to the characteristics of their operations, identify and classify all information assets within the scope of the management system, assess their importance, and maintain an up-to-date list.", + "Checks": [ + "organizations_tags_policies_enabled_and_attached", + "organizations_account_part_of_organizations", + "macie_is_enabled", + "config_recorder_all_regions_enabled", + "resourceexplorer2_indexes_found" + ], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.2. Risk Management", + "Section": "1.2.1 Identification of Information Assets", + "AuditChecklist": [ + "Has the organization established classification criteria for information assets and identified all assets within the scope of the information protection and personal information protection management system, maintaining them in a list?", + "For the identified information assets, does the organization determine their importance by considering legal requirements and their impact on operations, and assign security levels?", + "Does the organization regularly review the status of information assets to keep the list up-to-date?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information asset and personal information asset classification criteria", + "Information asset and personal information asset list (from asset management system screen)", + "Information asset and personal information security levels", + "Asset audit details", + "Risk analysis report (including asset identification)" + ], + "NonComplianceCases": [ + "Case 1: The list of assets within the scope of the information protection and personal information protection management system omits internal information leakage control systems, such as print security, document encryption, and USB media control, which are used to manage PCs handling important information and personal information.", + "Case 2: Personal information provided by third parties within the scope of the information protection and personal information protection management system has not been identified as an asset.", + "Case 3: The asset classification criteria in the internal guidelines and the classification criteria in the asset management register are inconsistent.", + "Case 4: Although on-premises assets have been identified, assets related to externally entrusted IT services (web hosting, server hosting, cloud, etc.) have been omitted (only for assets within the certification scope).", + "Case 5: The backup server storing unique identification information and other personal data has been classified with a low confidentiality rating, raising concerns about the reasonableness and reliability of the importance assessment." + ] + } + ] + }, + { + "Id": "1.2.2", + "Name": "Status and Flow Analysis", + "Description": "Organizations must analyze the status of information services and personal information processing across all areas of the management system, document the procedures and workflows, and review them regularly to maintain their accuracy.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.2. Risk Management", + "Section": "1.2.2 Status and Flow Analysis", + "AuditChecklist": [ + "Has the organization identified and documented the status and workflows of information services across all areas of the management system?", + "Has the organization identified and documented the status of personal information processing within the scope of the management system, and mapped out personal information flows in flowcharts?", + "Does the organization regularly review procedures and workflows in response to changes in services, operations, and information assets, and keep the flowcharts and related documents up-to-date?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information service status table", + "Information service workflow charts and process maps", + "Personal information processing status table (for ISMS-P certification)", + "Personal information flowcharts (for ISMS-P certification)" + ], + "NonComplianceCases": [ + "Case 1: There are no documents outlining the workflows and procedures for major services within the scope of the management system.", + "Case 2: The personal information flowchart contains significant discrepancies from the actual personal information flow, or important personal information flows are missing.", + "Case 3: After the initial creation of the personal information flowchart, it has not been updated to reflect changes in the personal information flow." + ] + } + ] + }, + { + "Id": "1.2.3", + "Name": "Risk Assessment", + "Description": "Organizations must collect threat information by analyzing internal and external environments, select a risk assessment method suitable for the organization, conduct a risk assessment at least once a year across all areas of the management system, and manage acceptable risks with the approval of the executives.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.2. Risk Management", + "Section": "1.2.3 Risk Assessment", + "AuditChecklist": [ + "Has the organization defined methods for identifying and assessing risks that could arise from various aspects, depending on the characteristics of the organization or service?", + "Does the organization annually develop a risk management plan that specifies the personnel, timeline, targets, methods, and budget for risk management activities?", + "Does the organization conduct regular or ad-hoc risk assessments at least once a year according to the risk management plan?", + "Has the organization established an acceptable target risk level and identified risks that exceed that level?", + "Are the results of risk identification and assessment reported to the executives?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Risk management guidelines", + "Risk management manuals/guides", + "Risk management plan", + "Risk assessment report", + "Minutes of the Information Protection and Personal Information Protection Committee", + "Minutes of the Information Protection and Personal Information Protection Working Group", + "Information asset and personal information asset list", + "Information service and personal information flowcharts" + ], + "NonComplianceCases": [ + "Case 1: The risk management plan specifies the risk assessment period and the targets and methods for risk management, but lacks details on the personnel and budget required for execution.", + "Case 2: While a risk assessment was conducted in the previous year, no risk assessment was conducted this year due to a lack of changes in assets.", + "Case 3: The organization conducted risk identification and assessment according to the risk management plan, but failed to assess the risks of important information assets within the scope, or failed to assess compliance with legal requirements related to information protection.", + "Case 4: The organization identified and assessed risks and set an acceptable target risk level according to the risk management plan, but did not report and seek approval from the executives (e.g., the Chief Information Security Officer).", + "Case 5: The method defined in the internal guidelines for risk assessment differs from the method actually used.", + "Case 6: The organization failed to identify and assess risks in the administrative and physical areas related to the information protection management system, and used only the results of technical vulnerability assessments as the risk assessment outcome.", + "Case 7: The organization set the acceptable target risk level (DoA) unreasonably high, designating risks that required action as acceptable risks, even though these risks were significant and required immediate or short-term action." + ] + } + ] + }, + { + "Id": "1.2.4", + "Name": "Selection of Protective Measures", + "Description": "Based on the results of the risk assessment, appropriate protective measures must be selected to address the identified risks, and an implementation plan including the priority, schedule, responsible department/personnel, and budget for the protective measures must be established and approved by management.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.2. Risk Management", + "Section": "1.2.4 Selection of Protective Measures", + "AuditChecklist": [ + "Has the organization developed risk treatment strategies (e.g., risk reduction, avoidance, transfer, acceptance) and selected protective measures to address the identified risks?", + "Has the organization established and reported to management an implementation plan that includes priority, schedule, responsible department/personnel, and budget for the protective measures?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information protection and personal information protection implementation plans/risk management plans", + "Information protection and personal information protection measures", + "Information protection and personal information protection master plan", + "Records of management reports and approvals for the information protection and personal information protection implementation plan" + ], + "NonComplianceCases": [ + "Case 1: Although an implementation plan for the information protection and personal information protection measures was established, it was not reported to the CISO and CPO.", + "Case 2: Some risk mitigation actions that were required were missing from the implementation plan.", + "Case 3: Mandatory legal requirements and risks with high security vulnerabilities were accepted without additional protective measures, instead of being addressed by a risk treatment plan.", + "Case 4: The rationale and validity for risk acceptance were insufficient, and some risks that could have been addressed immediately or in the short term due to urgency or ease of implementation were classified under long-term plans without specific justification." + ] + } + ] + }, + { + "Id": "1.3.1", + "Name": "Implementation of Protective Measures", + "Description": "The selected protective measures must be effectively implemented according to the implementation plan, and management must verify the accuracy and effectiveness of the implementation results.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.3. Operation of the Management System", + "Section": "1.3.1 Implementation of Protective Measures", + "AuditChecklist": [ + "Are the protective measures effectively implemented according to the implementation plan, and are the implementation results reported to management to verify their accuracy and effectiveness?", + "Has the organization created and documented detailed operating statements recording the implementation and operation status of protective measures according to the certification standards of the management system?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information protection and personal information protection implementation plans/risk management plans", + "Information protection and personal information protection measures", + "Information protection and personal information protection implementation progress reports (including reports to management)", + "Information protection and personal information protection implementation completion reports (including reports to management)", + "Information protection and personal information protection operating statements" + ], + "NonComplianceCases": [ + "Case 1: The results of the completion of the information protection and personal information protection measures were not reported to the CISO and CPO.", + "Case 2: The risk action implementation result report indicated 'completed,' but related risks still existed, or the accuracy and effectiveness of the implementation results were not verified.", + "Case 3: Risks classified as medium- to long-term in the previous year's information protection measures implementation plan were not implemented in the current year, or the results were not reviewed and verified by management.", + "Case 4: The actual operating status described in the operating statements did not match reality, and related documents, approvals, and meeting minutes mentioned in the operating statements did not exist.", + "Case 5: Although the implementation results were reported to the CISO and CPO, some incomplete items were not followed up with reasons and corrective actions." + ] + } + ] + }, + { + "Id": "1.3.2", + "Name": "Sharing of Protective Measures", + "Description": "The departments and personnel responsible for the actual operation or implementation of the protective measures must be identified, and the related information must be shared and provided through training to ensure continuous operation.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.3. Operation of the Management System", + "Section": "1.3.2 Sharing of Protective Measures", + "AuditChecklist": [ + "Has the organization clearly identified the departments and personnel responsible for the operation or implementation of the protective measures?", + "Has the organization shared or provided training to the departments and personnel responsible for the operation or implementation of the protective measures?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "List of operating or implementing departments for each protective measure", + "Evidence of internal sharing of information protection and personal information protection plans (e.g., notices, training materials, shared documents)" + ], + "NonComplianceCases": [ + "Case 1: Although protective measures were developed and implemented, the relevant information was not sufficiently shared or provided through training, so the departments or personnel responsible for the actual operation or implementation were unaware of the details." + ] + } + ] + }, + { + "Id": "1.3.3", + "Name": "Operation Status Management", + "Description": "According to the management system established by the organization, operational activities that must be performed continuously or periodically must be recorded and managed in a way that allows identification and tracking, and management must regularly review the effectiveness of operational activities and manage them accordingly.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.3. Operation of the Management System", + "Section": "1.3.3 Operation Status Management", + "AuditChecklist": [ + "Are information protection and personal information protection activities that need to be performed periodically or continuously for the operation of the management system documented and managed?", + "Does management periodically review the effectiveness of the operation of the management system and manage it accordingly?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 31 (Designation of a Personal Information Protection Officer)", + "Information and Communications Network Act, Article 45-3 (Designation of a Chief Information Security Officer, etc.)" + ], + "AuditEvidence": [ + "Annual plan for information protection and personal information protection", + "Operation status report for information protection and personal information protection", + "Results of inspections on the implementation of information protection and personal information protection activities" + ], + "NonComplianceCases": [ + "Case 1: Failure to document activities that are required to be performed periodically or continuously as part of the operation of the information protection and personal information protection management system.", + "Case 2: Although documentation of the operational status of the information protection and personal information protection management system has been completed, periodic reviews have not been conducted, resulting in the omission of some required monthly and quarterly activities, and some activities have not been verified for implementation." + ] + } + ] + }, + { + "Id": "1.4.1", + "Name": "Review of Legal Requirements Compliance", + "Description": "The organization must regularly identify and reflect legal requirements related to information protection and personal information protection and continuously review whether compliance is being maintained.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.4. Inspection and Improvement of the Management System", + "Section": "1.4.1 Review of Legal Requirements Compliance", + "AuditChecklist": [ + "Is the organization regularly identifying and maintaining up-to-date legal requirements related to information protection and personal information protection?", + "Is the organization conducting regular reviews of compliance with legal requirements at least once a year?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Records of legal compliance reviews", + "Records of reviews and revisions of information protection and personal information protection policies and guidelines", + "Comparison tables of revised policies and guidelines", + "Internal sharing documents of legal revisions", + "Proof of personal information liability insurance or equivalent guarantees (e.g., cyber insurance contracts)", + "Information protection disclosure records" + ], + "NonComplianceCases": [ + "Case 1: Although the Information and Communications Network Act and Personal Information Protection Act were recently revised, the organization did not review the impact of the changes on the organization, and as a result, the policy documents, implementation documents, and legal compliance checklists were not updated, leading to inconsistencies between the documents and the law.", + "Case 2: Although legal requirements that the organization must comply with were amended, the organization failed to conduct legal compliance reviews for an extended period.", + "Case 3: Inadequate legal compliance reviews resulted in numerous violations of the Personal Information Protection Act and other regulations.", + "Case 4: The organization was subject to the Personal Information Liability Compensation Guarantee system under the Personal Information Protection Act but failed to recognize this, resulting in non-compliance with insurance or reserve requirements. In cases where insurance was obtained, the organization failed to meet the minimum coverage requirements based on the number of users and revenue.", + "Case 5: Although the organization was required by law to disclose information protection status, it failed to do so within the legally mandated timeframe.", + "Case 6: The organization used a mobile app to receive personal location information from a location-based service provider, but failed to report its location-based service business.", + "Case 7: A foreign personal information controller without a domestic address or business office, whose personal information of domestic subjects stored and managed in the previous three months averaged over one million persons per day, failed to appoint a domestic representative in writing as required." + ] + } + ] + }, + { + "Id": "1.4.2", + "Name": "Management System Audit", + "Description": "The organization must audit its management system at least once a year with a team of personnel who possess independence and expertise, to ensure the system is operating effectively in accordance with internal policies and legal requirements, and report any identified issues to management.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.4. Inspection and Improvement of the Management System", + "Section": "1.4.2 Management System Audit", + "AuditChecklist": [ + "Has the organization established a management system audit plan that includes the criteria, scope, frequency, and qualifications for audit personnel to audit the management system's effectiveness in accordance with legal requirements and established policies?", + "Has the organization conducted audits at least once a year with personnel who have independence, objectivity, and expertise, and reported any identified issues to management?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Management system audit plan (internal audit plan, internal inspection plan)", + "Management system audit report", + "Minutes of the Information Protection and Personal Information Protection Committee" + ], + "NonComplianceCases": [ + "Case 1: The audit team included personnel from the IT department, which was also the subject of the audit, compromising the independence of the audit.", + "Case 2: Although a management system audit was conducted this year, the audit scope was limited to certain areas, failing to cover the full scope of the information protection and personal information protection management system.", + "Case 3: The management system audit team was composed solely of internal staff and external consultants who participated in the development of the management system, compromising the independence of the audit." + ] + } + ] + }, + { + "Id": "1.4.3", + "Name": "Management System Improvement", + "Description": "The root causes of the issues identified during legal compliance reviews and management system inspections must be analyzed, and preventive measures must be established and implemented. The management must confirm the accuracy and effectiveness of the improvement results.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. Establishment and Operation of the Management System", + "Subdomain": "1.4. Management System Inspection and Improvement", + "Section": "1.4.3 Management System Improvement", + "AuditChecklist": [ + "Are the root causes of the issues identified during legal compliance reviews and management system inspections analyzed, and are preventive and improvement measures established and implemented?", + "Are there criteria and procedures in place to verify the accuracy and effectiveness of preventive and improvement results?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Management system inspection result reports", + "Management system inspection action plans and implementation result reports", + "Preventive measures", + "Effectiveness measurement indicators and results (including reports to management)" + ], + "NonComplianceCases": [ + "Case 1: The same issues in the operation of the information protection and personal information protection management system, identified during internal inspections, are repeated each time.", + "Case 2: Although internal regulations require the analysis of root causes and the establishment of preventive measures for issues identified during internal inspections, recent internal inspections failed to include root cause analysis and preventive measures.", + "Case 3: Preventive measures for the issues in the management system were established, and key performance indicators (KPIs) were developed for periodic measurement, but the results were not reported to management for a long period.", + "Case 4: Action plans were not established or the completion of actions was not confirmed for issues identified during management system inspections." + ] + } + ] + }, + { + "Id": "2.1.1", + "Name": "Policy Maintenance", + "Description": "Information protection and personal information protection policies and implementation documents must be periodically reviewed and, if necessary, revised in response to changes in laws and regulations, policies of higher organizations and related agencies, and changes in the internal and external environment. These changes must be documented and tracked.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Control Measures Requirements", + "Subdomain": "2.1. Policies, Organization, and Asset Management", + "Section": "2.1.1 Policy Maintenance", + "AuditChecklist": [ + "Has the organization established and implemented a procedure for regularly reviewing the validity of information protection and personal information protection policies and implementation documents?", + "When there are significant changes in the internal and external environment, are the impacts on information protection and personal information protection policies and implementation documents reviewed and revised as necessary?", + "Are stakeholders consulted when revising information protection and personal information protection policies and implementation documents?", + "Is there a system in place to track the revision history of information protection and personal information protection policies and implementation documents?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Information protection and personal information protection policies and implementation documents (e.g., guidelines, procedures, manuals)", + "Results of regular and ad hoc validity reviews of policies and guidelines", + "Meeting minutes and circulation records with relevant departments regarding policies and guidelines", + "Revision history of policies and guidelines" + ], + "NonComplianceCases": [ + "Case 1: There is inconsistency between password setting rules in guidelines and procedures.", + "Case 2: Information protection activities (e.g., training, encryption, backup) have different targets, frequencies, levels, and methods described in internal regulations, guidelines, and procedures, leading to inconsistency.", + "Case 3: A new database access control solution was introduced to effectively record and manage access and operation logs for the database, but internal security guidelines such as those for security systems and database security management have not been updated to reflect these new controls.", + "Case 4: Although the personal information protection policy was revised, the policy implementation date was not specified, and information such as the author, creation date, and approval date were missing from the relevant policy.", + "Case 5: Although significant changes occurred in laws and regulations related to personal information protection, these changes were not reviewed or reflected in the personal information protection policy and implementation documents." + ] + } + ] + }, + { + "Id": "2.1.2", + "Name": "Organization Maintenance", + "Description": "Roles and responsibilities related to information protection and personal information protection must be assigned to all members of the organization, and systems must be established for evaluating these activities and for communication between members and departments.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Control Measures Requirements", + "Subdomain": "2.1. Policies, Organization, and Asset Management", + "Section": "2.1.2 Organization Maintenance", + "AuditChecklist": [ + "Are the roles and responsibilities of those responsible for and involved in information protection and personal information protection clearly defined?", + "Has the organization established a system for evaluating the activities of those responsible for and involved in information protection and personal information protection?", + "Has the organization established and implemented systems and procedures for communication between the information protection and personal information protection organization and its members?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures), Article 31 (Designation of a Personal Information Protection Officer)", + "Information and Communications Network Act, Article 45-3 (Designation of a Chief Information Security Officer, etc.)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Information protection and personal information protection organization chart", + "Job descriptions for the information protection and personal information protection organization", + "Assignment tables for information protection and personal information protection roles", + "Information protection and personal information protection policies/guidelines and internal management plans", + "Information protection and personal information protection communication management plans", + "Records of communication activities (e.g., monthly/weekly reports, internal notices)", + "Communication channels (e.g., information protection portal, bulletin boards)" + ], + "NonComplianceCases": [ + "Case 1: Although the roles and responsibilities of the CISO, CPO, and related personnel are defined in internal guidelines and job descriptions, they do not align with the actual operating status.", + "Case 2: There are no goals, criteria, or performance indicators in place for the periodic evaluation of the activities of the CISO and related personnel.", + "Case 3: Although internal guidelines require departments to set KPIs related to information protection for the information protection officers in each department to be reflected in performance evaluations, no information protection-related KPIs were set for any of the departmental information protection officers.", + "Case 4: Although the CISO and CPO are designated, the roles and responsibilities required by law are not specifically defined in internal guidelines or job descriptions." + ] + } + ] + }, + { + "Id": "2.1.3", + "Name": "Management of Information Assets", + "Description": "The procedures and protection measures for handling information assets according to their purpose and importance must be established and implemented, and the responsibilities for each asset must be clearly defined and managed.", + "Checks": [ + "organizations_tags_policies_enabled_and_attached", + "organizations_account_part_of_organizations", + "macie_is_enabled", + "config_recorder_all_regions_enabled", + "resourceexplorer2_indexes_found", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_questions_are_registered_in_the_aws_account", + "account_security_contact_information_is_registered" + ], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.1. Policy, Organization, Asset Management", + "Section": "2.1.3 Management of Information Assets", + "AuditChecklist": [ + "Are handling procedures (creation, introduction, storage, use, disposal) and protection measures defined and implemented according to the security classification of information assets?", + "Have responsible persons and managers been designated for identified information assets?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "List of information assets (designation of responsible persons and managers)", + "Handling procedures for information assets (documents, information systems, etc.)", + "Information asset management system screen", + "Security classification indicators for information assets" + ], + "NonComplianceCases": [ + "Case 1: Although internal guidelines require security classification to be indicated on documents, this has not been followed.", + "Case 2: Responsible persons and managers for information assets have not been identified, or the asset list has not been updated, leading to changes in responsible personnel due to resignations, transfers, etc., not being reflected.", + "Case 3: Although security classifications were assigned to identified information assets after evaluating their importance, handling procedures based on the security classification were not defined." + ] + } + ] + }, + { + "Id": "2.2.1", + "Name": "Designation and Management of Key Personnel", + "Description": "Criteria and management plans for key duties, such as handling personal information and important information or accessing key systems, must be established, and the number of key personnel must be minimized and their list kept up-to-date.", + "Checks": [ + "organizations_delegated_administrators", + "account_security_contact_information_is_registered", + "iam_support_role_created" + ], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.2. Personnel Security", + "Section": "2.2.1 Designation and Management of Key Personnel", + "AuditChecklist": [ + "Are the criteria for key duties, such as handling personal information and important information or accessing key systems, clearly defined?", + "Are employees and external personnel performing key duties designated as key personnel, and is the list kept up-to-date?", + "Are personnel handling personal information designated as personal information handlers, and is the list kept up-to-date?", + "Is the designation of key personnel and personal information handlers minimized based on business needs, and are management plans established and implemented?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 28 (Supervision of Personal Information Handlers), Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Criteria for key duties", + "List of key personnel", + "List of personal information handlers", + "Account and authority management ledger for key information systems and personal information processing systems", + "Management status of key personnel (e.g., training results, security pledges)" + ], + "NonComplianceCases": [ + "Case 1: Although a list of key personnel (e.g., personal information handlers, secret information managers) has been created, some employees who handle large volumes of personal information (e.g., DBAs, DLP managers) were omitted.", + "Case 2: Although the list of key personnel and personal information handlers is being managed, it has not been updated, including resigned employees and newly hired personnel.", + "Case 3: Personal information handler privileges were granted collectively to entire departments, leading to personnel without the need to handle personal information being excessively designated as personal information handlers.", + "Case 4: Although internal guidelines require approval from the security team and the signing of security pledges when granting key personnel privileges, many key personnel were registered without following this process." + ] + } + ] + }, + { + "Id": "2.2.2", + "Name": "Separation of Duties", + "Description": "Criteria for the separation of duties must be established and applied to prevent potential harm from the misuse or abuse of authority. If separation of duties is unavoidable, supplementary measures must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.2. Personnel Security", + "Section": "2.2.2 Separation of Duties", + "AuditChecklist": [ + "Are criteria for the separation of duties established and applied to prevent potential harm from the misuse or abuse of authority?", + "If separation of duties is difficult, have supplementary controls such as mutual review between personnel, regular monitoring and approval of changes by senior management, and ensuring accountability been established?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Guidelines on the separation of duties (e.g., personnel security guidelines)", + "Job descriptions (e.g., system operation/management, development/operation)", + "Status of supplementary controls when duties are not separated" + ], + "NonComplianceCases": [ + "Case 1: Although the organization has sufficient size and personnel to enable separation of duties, the established internal separation of duties criteria were not followed due to operational convenience.", + "Case 2: Although the organization received approval from senior management to combine development and operation duties due to the organization's characteristics, supplementary control measures such as mutual review between personnel, regular monitoring and review of changes by senior management, and ensuring accountability were not established." + ] + } + ] + }, + { + "Id": "2.2.3", + "Name": "Security Pledge", + "Description": "Employees, temporary staff, or external personnel handling information assets or granted access must sign a security and confidentiality agreement in accordance with internal policies.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.2. Human Security", + "Section": "2.2.3 Security Pledge", + "AuditChecklist": [ + "When hiring new personnel, is there a signed security and personal information protection agreement that specifies their responsibilities?", + "If temporary or external personnel are granted access to information assets, is there a signed agreement outlining their responsibilities for information protection and confidentiality?", + "Upon the resignation of an employee, is a separate confidentiality agreement obtained?", + "Are security, personal information protection, and confidentiality agreements stored safely and managed in a way that they can be easily retrieved when necessary?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Security and personal information protection pledge (for employees and external personnel)", + "Confidentiality agreement (for resigned employees)" + ], + "NonComplianceCases": [ + "Case 1: While it is stipulated that new hires must sign a security pledge, some recently hired employees have not completed the pledge.", + "Case 2: Although employees sign a security pledge, external personnel with direct access to information systems have not signed such an agreement.", + "Case 3: Submitted security and personal information protection pledges are poorly managed, with documents left accessible on desks where unauthorized personnel can access them.", + "Case 4: Although personal information handlers have signed security pledges, the content only covers confidentiality and does not include specific responsibilities related to personal information protection." + ] + } + ] + }, + { + "Id": "2.2.4", + "Name": "Awareness and Training", + "Description": "Organizations must establish and operate an annual awareness and training plan to ensure that employees and related external personnel understand the organization's management system and policies and acquire the necessary job-specific expertise. The effectiveness of this plan must be evaluated and reflected in future plans.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.2. Human Security", + "Section": "2.2.4 Awareness and Training", + "AuditChecklist": [ + "Is an annual training plan approved by management, detailing the timing, duration, target audience, content, and method of information protection and personal information protection training?", + "Are all employees and external personnel within the scope of the management system provided with regular training at least once per year, and are additional training sessions provided when there are significant changes in relevant laws and regulations?", + "Is information protection and personal information protection training provided to new hires and external personnel before they begin their duties?", + "Are IT, information protection, and personal information protection staff receiving specialized training to enhance their job-specific expertise?", + "Are training records maintained, and is the effectiveness of the training evaluated and reflected in future training plans?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 26 (Limitation on the Processing of Personal Information by Outsourcing), Article 28 (Supervision of Personal Information Handlers), Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans)" + ], + "AuditEvidence": [ + "Information protection and personal information protection training plan", + "Training result report", + "General and job-specific training materials", + "List of training attendees" + ], + "NonComplianceCases": [ + "Case 1: Although an annual information protection and personal information protection training plan was established and implemented last year, no such plan was established for the current year without a valid reason.", + "Case 2: The annual information protection and personal information protection training plan includes the frequency and target audience but lacks details such as schedule, content, and method.", + "Case 3: Although the annual training plan includes general personal information awareness training for all employees, it does not include job-specific training for those responsible for personal information protection, such as the personal information protection officer.", + "Case 4: Upon reviewing the training plan and result reports, it was found that certain external contractors (e.g., cleaning staff and security guards who have access to critical facilities within the certification scope) were not included in the training.", + "Case 5: Although information protection and personal information protection training was conducted, some records (e.g., training materials, attendance lists, evaluation surveys, result reports) were not retained.", + "Case 6: There is no system in place to identify employees who did not complete the required training or to provide make-up sessions for them (e.g., additional training, online courses)." + ] + } + ] + }, + { + "Id": "2.2.5", + "Name": "Management of Resignation and Job Changes", + "Description": "Procedures must be established and managed for the return of assets, the revocation or adjustment of accounts and access rights, and confirmation of results when there is a resignation, job change, or leave of absence, involving departments such as HR, information protection, personal information protection, and IT.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.2. Human Security", + "Section": "2.2.5 Management of Resignation and Job Changes", + "AuditChecklist": [ + "Are personnel changes (e.g., resignation, job changes, department transfers, leave of absence) shared among HR, information protection, personal information protection, and IT system operations departments?", + "Are procedures in place and implemented to promptly return information assets, revoke or adjust access rights, and confirm results when an employee (including temporary staff and external contractors) resigns or changes roles?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)" + ], + "AuditEvidence": [ + "Procedures for resignation and job changes", + "Asset (account) return management ledger upon resignation", + "Security checklists and inspection records for resigned employees" + ], + "NonComplianceCases": [ + "Case 1: Accounts and access rights for personnel no longer handling personal information due to job changes remain active in the personal information processing system.", + "Case 2: No records of asset returns or access rights revocation procedures were found for recently resigned key personnel and personal information handlers.", + "Case 3: While asset returns are properly managed for resigned employees, the security check and resignation confirmation forms required by HR regulations are not being completed.", + "Case 4: Although access rights to personal information processing systems were revoked promptly upon the resignation of personal information handlers, access rights to systems like physical access control and VPN were not revoked in a timely manner." + ] + } + ] + }, + { + "Id": "2.2.6", + "Name": "Actions in Case of Security Violations", + "Description": "In the event that employees or relevant external parties violate laws, regulations, or internal policies, the organization must establish and implement procedures to take appropriate actions.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.2. Human Security", + "Section": "2.2.6 Actions in Case of Security Violations", + "AuditChecklist": [ + "Has the organization established disciplinary measures for employees and relevant external parties in case of violations of information protection and personal information protection responsibilities and obligations under laws, regulations, and internal policies?", + "When violations of information protection and personal information protection are detected, are actions taken in accordance with internal procedures?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "HR regulations (disciplinary measures for violations of information protection and personal information protection regulations)", + "Records of disciplinary actions for violations of information protection and personal information protection guidelines", + "Incident case studies (company-wide notices, training materials)" + ], + "NonComplianceCases": [ + "Case 1: No disciplinary measures or procedures are included in internal regulations for handling violations of information protection and personal information protection regulations.", + "Case 2: Although warning messages are sent to those who violate policies detected by security systems (e.g., DLP, database access control system, internal information leakage control system), follow-up actions such as explanations, additional investigations, or disciplinary actions are not carried out in accordance with internal regulations." + ] + } + ] + }, + { + "Id": "2.3.1", + "Name": "Management of External Parties", + "Description": "When outsourcing part of the work (e.g., handling personal information, information protection, operating or developing information systems) or using external facilities or services (e.g., data centers, cloud services, application services), the organization must identify the current status, understand the legal requirements and risks arising from external organizations or services, and establish appropriate protective measures.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.3. External Security", + "Section": "2.3.1 Management of External Parties", + "AuditChecklist": [ + "Has the organization identified the status of outsourcing and the use of external facilities and services within the scope of the management system?", + "Has the organization identified the legal requirements and risks associated with outsourcing and the use of external facilities and services, and established appropriate protective measures?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 26 (Restrictions on the Processing of Personal Information by Outsourcing)", + "Information and Communications Network Act, Article 50-3 (Entrustment of the Transmission of Commercial Information for Profit)" + ], + "AuditEvidence": [ + "List of outsourced services and external facilities/services", + "Outsourcing contracts", + "Risk analysis reports and protective measures", + "Outsourcing security management guidelines, checklists, etc." + ], + "NonComplianceCases": [ + "Case 1: Although the organization manages a list of outsourced services and external facilities/services as required by internal regulations, the list is outdated and does not reflect changes made to vendors several months ago.", + "Case 2: The organization has migrated some personal information processing systems to external cloud services within the scope of the management system, but no identification or risk assessment has been performed." + ] + } + ] + }, + { + "Id": "2.3.2", + "Name": "Security in Contracts with External Parties", + "Description": "When using external services or outsourcing work to external parties, the organization must identify the information protection and personal information protection requirements and specify them in contracts or agreements.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.3. External Security", + "Section": "2.3.2 Security in Contracts with External Parties", + "AuditChecklist": [ + "When selecting external services or outsourcing vendors related to the handling of important information and personal information, does the organization follow procedures to consider the vendors' capabilities in information protection and personal information protection?", + "Has the organization identified the information protection and personal information protection requirements associated with the use of external services and outsourcing, and specified them in contracts or agreements?", + "When outsourcing the development of information systems and personal information processing systems, has the organization specified the information protection and personal information protection requirements that must be followed during development in the contract?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 26 (Restrictions on the Processing of Personal Information by Outsourcing)" + ], + "AuditEvidence": [ + "Outsourcing contracts", + "Information protection and personal information protection agreements (agreements, annexes)", + "Internal guidelines on outsourcing", + "RFPs (Requests for Proposals), evaluation forms related to the selection of outsourcing vendors" + ], + "NonComplianceCases": [ + "Case 1: No outsourcing contract exists for external vendors performing IT operations, development, or personal information processing tasks.", + "Case 2: The outsourcing contract with an external vendor handling personal information does not include some items required by the Personal Information Protection Act (e.g., management and supervision provisions).", + "Case 3: Although infrastructure operation and part of personal information processing tasks are outsourced to external vendors, the contract does not specify security requirements related to the nature of the outsourced work, but only includes general provisions on confidentiality and liability for damages." + ] + } + ] + }, + { + "Id": "2.3.3", + "Name": "External Party Security Implementation Management", + "Description": "Security measures specified in contracts, agreements, and internal policies must be regularly inspected or audited to ensure external parties comply with information protection and personal information protection requirements.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.3. External Party Security", + "Section": "2.3.3 External Party Security Implementation Management", + "AuditChecklist": [ + "Are periodic inspections or audits conducted to ensure external parties comply with information protection and personal information protection requirements specified in contracts, agreements, and internal policies?", + "When issues are identified during inspections or audits of external parties, are improvement plans established and implemented?", + "If a contractor entrusted with personal information processing re-outsources related tasks to a third party, does the contractor obtain the principal's consent?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 26 (Restrictions on the Outsourcing of Personal Information Processing)", + "Information and Communications Network Act, Article 50-3 (Outsourcing of the Transmission of Commercial Information for Profit)" + ], + "AuditEvidence": [ + "Security inspection results for external parties and contractors", + "Training details for external parties and contractors (training outcomes, attendee list, training materials, etc.)", + "Personal information outsourcing contract", + "Evidence of consent for re-outsourcing of personal information processing tasks" + ], + "NonComplianceCases": [ + "Case 1: Failure to regularly conduct security inspections of external contractors who perform IT development and operations tasks on-site.", + "Case 2: Sending a notification to contractors entrusted with personal information processing to conduct security training, but failing to verify whether the training has been conducted.", + "Case 3: Allowing contractors to perform their own security inspections and report the results, without a verification process to ensure the inspections were properly conducted, thus undermining the reliability of the inspection results.", + "Case 4: Allowing contractors to re-outsource personal information processing tasks to a third party without the principal's consent.", + "Case 5: Failure to supervise contractors entrusted with transmitting commercial information for profit." + ] + } + ] + }, + { + "Id": "2.3.4", + "Name": "Security for External Party Contract Changes and Expiry", + "Description": "When an external party contract expires, the task is completed, or there is a personnel change, security measures such as returning provided information assets, deleting information system access accounts, destroying sensitive information, and obtaining confidentiality agreements for acquired information must be implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.3. External Party Security", + "Section": "2.3.4 Security for External Party Contract Changes and Expiry", + "AuditChecklist": [ + "Has the organization established and implemented security measures to ensure the return of information assets, deletion of information system access accounts, and the acquisition of confidentiality agreements in accordance with official procedures when an external party contract expires, a task is completed, or there is a personnel change?", + "When an external party contract expires, has the organization established and implemented procedures to confirm whether the external party holds any sensitive or personal information related to the outsourced task, and to retrieve or destroy such information?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 26 (Restrictions on the Outsourcing of Personal Information Processing)", + "Information and Communications Network Act, Article 50-3 (Outsourcing of the Transmission of Commercial Information for Profit)" + ], + "AuditEvidence": [ + "Information protection and personal information protection agreements", + "Confidentiality agreements", + "Information and personal information destruction agreements", + "Internal policies and guidelines related to the termination of external party contracts" + ], + "NonComplianceCases": [ + "Case 1: Failure to delete accounts and permissions for external parties after their contract has expired, allowing access to certain information systems.", + "Case 2: During an outsourcing project, failure to take appropriate measures for some contractors who were replaced or whose contracts expired, including failing to obtain security agreements as required by internal regulations.", + "Case 3: After terminating a contract with a contractor entrusted with personal information processing, failure to verify whether the contractor destroyed any personal information they held." + ] + } + ] + }, + { + "Id": "2.4.1", + "Name": "Designation of Protected Zones", + "Description": "To protect personal and sensitive information, documents, storage media, key facilities, and systems from physical and environmental threats, physical protection zones such as controlled areas, restricted areas, and reception areas must be designated, and protection measures for each zone must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.1 Designation of Protected Zones", + "AuditChecklist": [ + "Has the organization established criteria for designating physical protection zones such as controlled areas, restricted areas, and reception areas to protect personal and sensitive information, documents, storage media, key facilities, and systems from physical and environmental threats?", + "Has the organization designated physical protection zones in accordance with the criteria and established and implemented protection measures for each zone?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)" + ], + "AuditEvidence": [ + "Physical security guidelines (criteria for designating protected zones)", + "List of designated protected zones", + "Protected zone signage", + "List of protection measures for each zone" + ], + "NonComplianceCases": [ + "Case 1: Although internal physical security guidelines state that areas where personal information is stored and processed must be designated as controlled zones, certain document storage rooms containing membership application forms were omitted from the list of controlled zones.", + "Case 2: Internal physical security guidelines require that controlled zones be marked with specific signs, but some controlled zones do not have the required signage." + ] + } + ] + }, + { + "Id": "2.4.2", + "Name": "Access Control", + "Description": "Access to protected areas must be restricted to authorized personnel only, and entry and access logs should be reviewed periodically to ensure accountability.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.2 Access Control", + "AuditChecklist": [ + "Is access to protected areas controlled so that only authorized personnel are allowed to enter according to access procedures?", + "Are entry records for internal and external personnel for each protected area retained for a certain period, and are entry records and access permissions reviewed periodically?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)" + ], + "AuditEvidence": [ + "Access logbook and entry logs", + "Access registration application form and approval records", + "Entry record review report", + "Access control system management screen (status of registered personnel, etc.)" + ], + "NonComplianceCases": [ + "Case 1: Although control areas are defined, protective measures are established, and employees with access are managed, the entry records are not reviewed periodically, resulting in many inactive personnel (due to retirement, transfer, etc.) having long periods of no entry.", + "Case 2: Although access control devices are installed in controlled areas such as data centers and document storage rooms, they are left open for extended periods without valid reasons or approval.", + "Case 3: Some external partner employees are excessively granted all-area access cards for unrestricted entry." + ] + } + ] + }, + { + "Id": "2.4.3", + "Name": "Information System Protection", + "Description": "Information systems should be arranged considering their importance and characteristics to reduce environmental threats, harmful factors, and unauthorized access, and communication and power cables should be protected from damage.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.3 Information System Protection", + "AuditChecklist": [ + "Are information systems placed in separated locations based on their importance, usage, and characteristics?", + "Are there measures in place to easily verify the actual physical location of the information systems?", + "Are power and communication cables protected from physical damage and electrical interference from external sources?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Data processing facility diagram", + "Information system layout", + "Asset list" + ], + "NonComplianceCases": [ + "Case 1: The system layout is not updated to reflect the latest changes, making it difficult to quickly identify the information system that has experienced a failure.", + "Case 2: Many cables are tangled and not properly organized on the server room floor or in racks, increasing the risk of failure due to electrical interference, damage, leakage, or negligence." + ] + } + ] + }, + { + "Id": "2.4.4", + "Name": "Operation of Protective Facilities", + "Description": "Based on the importance and characteristics of the information systems located in protected areas, protective facilities such as temperature and humidity control, fire detection, firefighting equipment, leak detection, UPS, emergency generators, and dual power lines should be established and operated according to operational procedures.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.4 Operation of Protective Facilities", + "AuditChecklist": [ + "Are necessary facilities established and operational procedures set up based on the importance and characteristics of each protected area to prevent disasters such as fire, flood, and power failure caused by human error or natural disasters?", + "If operating outsourced integrated data centers (IDC), are physical security requirements included in the contract, and is the operational status periodically reviewed?" + ], + "RelatedRegulations": [ + "Information and Communications Network Act, Article 46 (Protection of Integrated Data Centers)", + "Guidelines for the Protection of Integrated Data Centers", + "Fire Facility Installation and Management Act, Article 12 (Management of Fire Protection Facilities in Specific Fire Protection Objects), Article 16 (Management of Evacuation Facilities, Fire Zones, and Fire Protection Facilities)" + ], + "AuditEvidence": [ + "Physical security guidelines (related to protective facilities)", + "Data center facility status and inspection checklist", + "IDC outsourcing contract, SLA, etc." + ], + "NonComplianceCases": [ + "Case 1: In some protected areas, such as the main office data center, the required protective facilities specified in internal guidelines are not installed.", + "Case 2: Although protective facilities such as UPS and fire suppression systems are in place in the data center, operational and inspection standards for the related facilities are not established.", + "Case 3: Although temperature and humidity control devices were installed in the data center according to operational guidelines, insufficient capacity means that the standard temperature and humidity levels are not maintained, increasing the risk of failure." + ] + } + ] + }, + { + "Id": "2.4.5", + "Name": "Operations in Secure Zones", + "Description": "Procedures to prevent unauthorized actions and abuse of privileges within secure zones must be established and implemented, and the records of operations should be periodically reviewed.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.5 Operations in Secure Zones", + "AuditChecklist": [ + "When operations within secure zones, such as the introduction and maintenance of information systems, are required, are formal procedures for application and execution of such operations established and implemented?", + "Are the records of operations within secure zones periodically reviewed to confirm that the operations were carried out in accordance with the control procedures?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Operation request forms, operation logs", + "Entry logs for controlled areas", + "Records of review of entry and operation logs for controlled areas" + ], + "NonComplianceCases": [ + "Case 1: The entry log of the data center shows the presence of external maintenance personnel, but there is no record of an operation request or approval for work within the secure zone (i.e., entry and work in the secure zone were carried out without an operation request as required by internal regulations).", + "Case 2: Although internal regulations state that the records of operations within secure zones must be reviewed at least once per quarter, the review of such records has not been conducted for a long period without a valid reason." + ] + } + ] + }, + { + "Id": "2.4.6", + "Name": "Device Control for Inbound and Outbound", + "Description": "Procedures to control the inbound and outbound movement of information systems, mobile devices, storage media, etc., within secure zones must be established, implemented, and periodically reviewed.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.6 Device Control for Inbound and Outbound", + "AuditChecklist": [ + "Are control procedures established and implemented to prevent security incidents such as information leakage and malware infection when information systems, mobile devices, storage media, etc., are brought into or taken out of secure zones?", + "Are records maintained and managed in accordance with the inbound and outbound control procedures, and is the compliance with the procedures periodically checked by reviewing the history of inbound and outbound activities?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)" + ], + "AuditEvidence": [ + "Inbound and outbound application forms for secure zones", + "Inbound and outbound management logs", + "Results of the review of inbound and outbound records" + ], + "NonComplianceCases": [ + "Case 1: Although control procedures for the inbound and outbound of mobile computing devices are established, there is no control over the movement of such devices within the controlled area, allowing both internal and external personnel with access to the controlled area to use mobile computing devices without restriction.", + "Case 2: Although internal guidelines state that inbound and outbound details of IT equipment must be recorded in the operation plan and signed by the person responsible for management, many signatures of responsible managers are missing from the records." + ] + } + ] + }, + { + "Id": "2.4.7", + "Name": "Work Environment Security", + "Description": "Protection measures such as clean desk policies and regular inspections must be established and implemented to prevent unauthorized exposure or leakage of personal and sensitive information through shared office equipment (e.g., document storage, shared PCs, multifunction printers, file servers) and individual work environments (e.g., work PCs, desks).", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.4. Physical Security", + "Section": "2.4.7 Work Environment Security", + "AuditChecklist": [ + "Are protection measures established and implemented for shared facilities and office equipment such as document storage, shared PCs, multifunction printers, file servers, etc.?", + "Are protection measures established and implemented to prevent the exposure or leakage of personal and sensitive information through individual work environments such as work PCs, desks, drawers, etc.?", + "Are appropriate protection measures in place to ensure the safe handling of printed or copied materials containing personal information, such as paper documents?", + "Is compliance with information protection requirements in both individual and shared work environments periodically reviewed?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures), Article 12 (Safety Measures for Printing and Copying)" + ], + "AuditEvidence": [ + "Security inspection reports for offices and shared spaces", + "Security inspection checklists for offices and shared spaces", + "Actions taken for non-compliance (e.g., training, rewards and penalties)", + "Current status of protection measures for printed and copied materials" + ], + "NonComplianceCases": [ + "Case 1: Although the internal management plan for personal information specifies that regular security inspections (e.g., clean desk policies) must be conducted, no such inspections have been carried out.", + "Case 2: Documents containing personal information, such as membership application forms, are stored in an office cabinet without a lock.", + "Case 3: Employee computers do not have screen savers or passwords set, and important documents have been left on vacationing employees' desks for an extended period.", + "Case 4: No protection measures are in place for shared PCs installed in shared office spaces such as meeting rooms, resulting in personal information files being stored unencrypted, or security updates not applied, or antivirus software not installed, leaving the systems vulnerable." + ] + } + ] + }, + { + "Id": "2.5.1", + "Name": "User Account Management", + "Description": "To control unauthorized access to information systems, personal information, and critical information, organizations must establish and implement procedures for user registration, termination, and granting, changing, or revoking access rights, ensuring that access rights are granted only to the minimum necessary for work purposes. Additionally, when registering or granting user rights, it must be made clear to users that they are responsible for the security of their accounts.", + "Checks": [ + "organizations_scp_check_deny_regions", + "cognito_user_pool_self_registration_disabled", + "cloudtrail_threat_detection_privilege_escalation", + "iam_user_administrator_access_policy", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_policy_allows_privilege_escalation", + "iam_policy_no_full_access_to_kms", + "iam_role_cross_service_confused_deputy_prevention", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_role_cross_account_readonlyaccess_policy", + "iam_inline_policy_no_full_access_to_kms", + "iam_user_accesskey_unused", + "iam_securityaudit_role_created", + "iam_no_custom_policy_permissive_role_assumption", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_user_console_access_unused", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_no_full_access_to_cloudtrail", + "iam_role_administratoraccess_policy" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.5. Authentication and Access Management", + "Section": "2.5.1 User Account Management", + "AuditChecklist": [ + "Has the organization established and implemented formal procedures for registering, changing, and deleting user accounts and access rights to information systems, personal information, and critical information?", + "When creating and registering user accounts and access rights to information systems, personal information, and critical information, is access limited to the minimum necessary for each job based on the job-specific access classification system?", + "When granting users accounts and access rights, are they made fully aware that they are responsible for the security of those accounts?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)" + ], + "AuditEvidence": [ + "User account and access request forms", + "User account and access management log or screen", + "Access classification table for information systems and personal information processing systems", + "Lists of users, administrators, and personal information handlers for each information system and personal information processing system" + ], + "NonComplianceCases": [ + "Case 1: User registration, termination, and approval procedures for accounts and permissions for users and personal information handlers were processed through verbal requests, email, etc., without proper approval and handling records.", + "Case 2: A personal information handler shared their account with an unauthorized individual for backup purposes during vacations, business trips, or other absences without going through official procedures.", + "Case 3: Users of information systems or personal information processing systems were granted excessive permissions, allowing access to unnecessary information or personal data." + ] + } + ] + }, + { + "Id": "2.5.2", + "Name": "User Identification", + "Description": "User accounts must be assigned unique identifiers that distinguish each user individually, and the use of easily guessable identifiers must be restricted. If the same identifier is shared by multiple users, the reason and justification must be reviewed, supplementary measures such as approval from a responsible party must be established, and accountability must be ensured.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.5. Authentication and Access Management", + "Section": "2.5.2 User Identification", + "AuditChecklist": [ + "Are unique identifiers assigned to users and personal information handlers in information systems and personal information processing systems, and is the use of easily guessable identifiers restricted?", + "If the same identifier is shared by multiple users for unavoidable reasons, has the justification been reviewed and have supplementary measures such as approval from the responsible party been established?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)" + ], + "AuditEvidence": [ + "Login screen for information systems and personal information processing systems", + "Lists of administrators, users, and personal information handlers for information systems and personal information processing systems", + "Records of approvals for exceptions" + ], + "NonComplianceCases": [ + "Case 1: The account status of information systems (servers, networks, firewalls, DBMS, etc.) shows that default administrator accounts provided by the manufacturer are still in use, despite being technically modifiable.", + "Case 2: Developers are sharing personal information processing system accounts for common use without any justification or approval from responsible parties.", + "Case 3: External personnel maintaining information systems are using operational accounts like personal accounts without going through the required approval procedures." + ] + } + ] + }, + { + "Id": "2.5.3", + "Name": "User Authentication", + "Description": "User access to information systems, personal information, and critical information must be secured through safe authentication procedures and, if necessary, enhanced authentication methods. In addition, access control measures such as limiting login attempts and issuing warnings for illegal login attempts must be established and implemented.", + "Checks": [ + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_self_registration_disabled", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "directoryservice_supported_mfa_radius_enabled", + "iam_rotate_access_key_90_days", + "iam_root_hardware_mfa_enabled", + "iam_user_no_setup_initial_access_key", + "iam_root_mfa_enabled", + "iam_user_with_temporary_credentials", + "iam_user_hardware_mfa_enabled", + "iam_check_saml_providers_sts", + "iam_user_two_active_access_key", + "iam_user_accesskey_unused", + "iam_user_mfa_enabled_console_access", + "iam_administrator_access_with_mfa", + "apigatewayv2_api_authorizers_enabled", + "kafka_cluster_unrestricted_access_disabled", + "rds_cluster_iam_authentication_enabled", + "rds_instance_iam_authentication_enabled", + "apigateway_restapi_authorizers_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.5. Authentication and Authorization Management", + "Section": "2.5.3 User Authentication", + "AuditChecklist": [ + "Is access to information systems and personal information processing systems controlled through secure user authentication procedures, login attempt limitations, and warnings for illegal login attempts?", + "When accessing personal information processing systems from outside via a communication network, are secure authentication methods or secure access measures applied in accordance with legal requirements?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights), Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Login screen for information systems and personal information processing systems", + "Login attempt limitation setting screen", + "Login failure message screen", + "Procedures for external access (e.g., external access request forms, list of external accessors)" + ], + "NonComplianceCases": [ + "Case 1: When a personal information handler accesses a personal information processing system through the public external internet, secure authentication methods are not applied, and authentication is done only through ID and password.", + "Case 2: In the login process for information systems and personal information processing systems, detailed messages are displayed about whether the ID exists or the password is incorrect, and there is no limit on login failure attempts." + ] + } + ] + }, + { + "Id": "2.5.4", + "Name": "Password Management", + "Description": "Procedures for managing passwords used by users of information systems, as well as customers and members, must be established and implemented, taking into account legal requirements and external threats.", + "Checks": [ + "cognito_user_pool_temporary_password_expiration", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_password_policy_number", + "cognito_user_pool_password_policy_lowercase", + "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_symbol", + "iam_password_policy_number", + "iam_password_policy_minimum_length_14", + "iam_password_policy_expires_passwords_within_90_days_or_less", + "iam_password_policy_symbol", + "iam_password_policy_reuse_24", + "iam_password_policy_lowercase", + "iam_password_policy_uppercase" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.5. Authentication and Authorization Management", + "Section": "2.5.4 Password Management", + "AuditChecklist": [ + "Are procedures for managing and creating secure user passwords for information systems established and implemented?", + "Are password creation rules established and enforced to ensure that users can use secure passwords?", + "Are authentication methods for personal information handlers and users securely applied and managed?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)" + ], + "AuditEvidence": [ + "Password setting screens for web pages, information systems, and personal information processing systems", + "Password management policies and procedures" + ], + "NonComplianceCases": [ + "Case 1: Although password creation rules are set in policies and guidelines related to information protection and personal information protection, some information systems and personal information processing systems use passwords that differ from internal guidelines.", + "Case 2: Internal regulations state that when passwords are reset, temporary passwords must be assigned and forced to be changed, but in practice, temporary passwords are being used without change.", + "Case 3: Although internal regulations require users and personal information handlers to change their passwords periodically, passwords are being used without change." + ] + } + ] + }, + { + "Id": "2.5.5", + "Name": "Management of Special Accounts and Privileges", + "Description": "Accounts and privileges used for special purposes, such as managing information systems, personal information, and important information, should be granted minimally, separately identified, and controlled.", + "Checks": [ + "organizations_delegated_administrators", + "cloudwatch_log_metric_filter_root_usage", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_support_role_created", + "iam_avoid_root_usage", + "iam_no_root_access_key", + "rds_instance_default_admin", + "rds_cluster_default_admin", + "sagemaker_notebook_instance_root_access_disabled", + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.5. Authentication and Privilege Management", + "Section": "2.5.5 Management of Special Accounts and Privileges", + "AuditChecklist": [ + "Is there a formal privilege request and approval process established and implemented to ensure that special privileges, such as administrative privileges, are only granted to a minimal number of people?", + "Is there a control procedure established and implemented to identify and manage accounts and privileges granted for special purposes in a separate list?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)" + ], + "AuditEvidence": [ + "Guidelines related to special privileges", + "Records of special privilege requests and approvals", + "List of special privilege holders", + "Records of special privilege reviews" + ], + "NonComplianceCases": [ + "Case 1: The approval history for granting administrator and special privileges in the information system and personal information processing system is not documented or does not match the special privileges list.", + "Case 2: Internal regulations require that personal information administrators and special privilege holders be documented and managed in a list, but the list is not maintained or some special privileges, such as security system administrators, are not identified or managed.", + "Case 3: A maintenance special account for visiting maintenance once a quarter remains active at all times without a time limit on usage.", + "Case 4: Regular reviews of administrator and special privilege usage are not conducted, and some individuals retain special privileges even after their roles have changed." + ] + } + ] + }, + { + "Id": "2.5.6", + "Name": "Review of Access Rights", + "Description": "The registration, use, and deletion of user accounts accessing information systems, personal information, and important information, as well as the history of granting, changing, and deleting access rights, should be recorded and periodically reviewed to ensure their appropriateness.", + "Checks": [ + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "accessanalyzer_enabled_without_findings", + "accessanalyzer_enabled", + "cloudtrail_insights_exist", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.5. Authentication and Privilege Management", + "Section": "2.5.6 Review of Access Rights", + "AuditChecklist": [ + "Are the histories of account and access right creation, registration, granting, use, modification, and deletion for information systems, personal information, and important information being recorded?", + "Are standards, review subjects, review methods, and periodic review schedules established to regularly review the appropriateness of user accounts and access rights to information systems, personal information, and important information?", + "When issues such as excessive access rights, failure to follow access right granting procedures, or misuse of access rights are identified in the review results, are appropriate response procedures established and implemented?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights)" + ], + "AuditEvidence": [ + "Access rights review standards and procedures", + "History of access rights reviews", + "Access rights review reports and follow-up action records" + ], + "NonComplianceCases": [ + "Case 1: The methods, review periods, reporting structure, and misuse criteria related to access rights reviews are not clearly defined in the relevant guidelines, leading to irregular performance of access rights reviews.", + "Case 2: Although internal policies and guidelines require locking (deactivating) or deleting long-unused accounts, some accounts that have not been accessed for more than six months remain active (indicating that the access rights review was not thoroughly conducted, failing to identify these accounts).", + "Case 3: During the access rights review, cases of excessive privileges or suspected misuse were identified, but no detailed investigation, internal reporting, or follow-up actions were taken." + ] + } + ] + }, + { + "Id": "2.6.1", + "Name": "Network Access", + "Description": "In order to control unauthorized access to the network, management procedures such as IP management and device authentication must be established and implemented. Network segmentation (DMZ, server farm, DB zone, development zone, etc.) and access controls must be applied according to the business purpose and importance.", + "Checks": [ + "ssm_documents_set_as_public", + "s3_access_point_public_access_block", + "s3_bucket_public_write_acl", + "s3_bucket_acl_prohibited", + "s3_account_level_public_access_blocks", + "s3_bucket_level_public_access_block", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "documentdb_cluster_public_snapshot", + "sns_topics_not_publicly_accessible", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cloudfront_distributions_geo_restrictions_enabled", + "opensearch_service_domains_not_publicly_accessible", + "glacier_vaults_policy_public_access", + "lightsail_instance_public", + "lightsail_database_public", + "neptune_cluster_uses_public_subnet", + "neptune_cluster_public_snapshot", + "ecr_repositories_not_publicly_accessible", + "workspaces_vpc_2private_1public_subnets_nat", + "elb_internet_facing", + "sqs_queues_not_publicly_accessible", + "redshift_cluster_public_access", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "awslambda_function_url_public", + "awslambda_function_url_cors_policy", + "awslambda_function_not_publicly_accessible", + "iam_user_administrator_access_policy", + "iam_group_administrator_access_policy", + "iam_user_mfa_enabled_console_access", + "networkfirewall_in_all_vpc", + "eks_cluster_network_policy_enabled", + "eks_control_plane_endpoint_access_restricted", + "eks_cluster_private_nodes_enabled", + "eks_endpoints_not_publicly_accessible", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_no_public_ip_by_default", + "vpc_endpoint_services_allowed_principals_trust_boundaries", + "vpc_endpoint_connections_trust_boundaries", + "vpc_subnet_separate_private_public", + "dms_instance_no_public_access", + "elbv2_internet_facing", + "elbv2_listeners_underneath", + "elasticache_cluster_uses_public_subnet", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout", + "rds_snapshots_public_access", + "rds_instance_no_public_access", + "rds_instance_event_subscription_security_groups", + "rds_instance_iam_authentication_enabled", + "apigateway_restapi_public", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_public_with_authorizer", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_models_vpc_settings_configured", + "sagemaker_training_jobs_vpc_settings_configured", + "sagemaker_models_network_isolation_enabled", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_notebook_instance_vpc_settings_configured", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_securitygroup_not_used", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_elastic_ip_shodan", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_networkacl_allow_ingress_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_ebs_public_snapshot", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_ami_public", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_instance_imdsv2_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_public_ip", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. Control Measures", + "Subdomain": "2.6. Access Control", + "Section": "2.6.1 Network Access", + "AuditChecklist": [ + "Has the organization identified all access paths to its network and ensured that internal networks are controlled so that only authorized users can access them according to the access control policy?", + "Has the organization physically or logically segmented the network based on services, user groups, information asset importance, and legal requirements, and applied access control between different network segments?", + "Has the organization established IP address allocation standards for each network segment, and applied measures such as assigning private IPs to systems like database servers that do not require external connections?", + "Has the organization implemented protective measures for communication paths when connecting networks between physically separated locations, such as IDCs, branches, and agents?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Network diagram", + "IP management ledger", + "Information asset list", + "Firewall rules" + ], + "NonComplianceCases": [ + "Case 1: The network configuration and interviews revealed that data transmission and reception between external sites and the servers located in the IDC are being processed through the general internet line, rather than using VPN or dedicated lines as specified in internal regulations.", + "Case 2: The IP addresses of some important servers, such as database servers located in the internal network, were set to public IPs instead of private IPs as per internal regulations, and network access blocking was not applied.", + "Case 3: Although a server farm was established, access from the internal network to the server farm was excessively allowed due to insufficient network access control settings.", + "Case 4: The network provided to external parties (e.g., external developers, visitors) was not separated from the internal business network without appropriate controls.", + "Case 5: Contrary to internal regulations, the organization's network could be accessed and used simply by connecting a network cable without applying protective measures such as MAC address authentication and mandatory security software installation." + ] + } + ] + }, + { + "Id": "2.6.2", + "Name": "Access to Information Systems", + "Description": "The users, access restriction methods, and secure access means for accessing information systems such as servers and network systems must be defined and controlled.", + "Checks": [ + "lightsail_instance_public", + "lightsail_static_ip_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_elastic_ip_unassigned", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_elastic_ip_shodan", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_instance_managed_by_ssm", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_public_ip", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.6. Access Control", + "Section": "2.6.2 Access to Information Systems", + "AuditChecklist": [ + "Have users, access locations, and access means allowed to access operating systems (OS) of information systems such as servers, network systems, and security systems been defined and controlled?", + "Is the system automatically disconnected when there is no work processed after accessing the information system for a certain period?", + "Are services unrelated to the purpose of using the information system removed?", + "Are information systems that provide key services operated on independent servers?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)" + ], + "AuditEvidence": [ + "List of operating system accounts of information systems", + "Server security settings", + "Server access control policy (e.g., SecureOS management screen)", + "Server and network configuration diagram", + "Information asset list" + ], + "NonComplianceCases": [ + "Case 1: When a server administrator accesses a Windows server located in the IDC from the office using terminal services, session timeout settings are not configured, allowing the session to remain open for a long period without any activity.", + "Case 2: Due to improper restrictions on server-to-server access, a user authorized to access a particular server can access other unauthorized servers via that server.", + "Case 3: Unsafe access protocols (e.g., telnet, ftp) are being used without valid reasons or compensatory measures, and unnecessary services and ports are open.", + "Case 4: Although the access control policy requires all access to servers to go through a server access control system, bypass routes exist that allow access to servers without going through the system." + ] + } + ] + }, + { + "Id": "2.6.3", + "Name": "Access to Applications", + "Description": "Access rights to applications must be restricted according to the user's tasks and the importance of the accessed information, and criteria should be established to minimize exposure of unnecessary or sensitive information.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Requirements", + "Subdomain": "2.6. Access Control", + "Section": "2.6.3 Access to Applications", + "AuditChecklist": [ + "Are access rights to applications granted differentially based on the user's tasks to control access to sensitive information?", + "Are sessions automatically disconnected after a certain period of inactivity, and is the number of simultaneous sessions per user restricted?", + "Is access to administrator-exclusive applications (e.g., admin web pages, admin consoles) restricted to unauthorized users?", + "Are criteria established and applied to ensure consistency in protection measures for limiting the display of personal and sensitive information?", + "Are applications implemented and operated to minimize unnecessary exposure (e.g., viewing, screen display, printing, downloading) of personal and sensitive information?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights), Article 6 (Access Control), Article 12 (Safety Measures for Printing and Copying)" + ], + "AuditEvidence": [ + "Application access rights classification system", + "Application account and rights management screen", + "Application user and administrator screens (e.g., personal information viewing, etc.)", + "Application session time and concurrent session restriction settings", + "Application administrator access log monitoring details", + "Information asset list", + "Personal information processing system's personal information viewing and search screens", + "Personal information masking standards", + "Personal information masking application screen" + ], + "NonComplianceCases": [ + "Case 1: There is a flaw in the authorization control function of certain personal information processing screens in the application, allowing users without permission to view personal information.", + "Case 2: The administrator page of the application is open to the public internet without secure authentication methods applied.", + "Case 3: Session timeouts or concurrent logins for the same user account are not restricted without valid reasons.", + "Case 4: When personal information is downloaded through the application, the file contains excessive unnecessary information such as resident registration numbers.", + "Case 5: The application excessively allows 'like' searches, allowing all users to retrieve all customer information by searching only for a surname, even beyond their work scope.", + "Case 6: Due to the lack of criteria for limiting the display of personal information or failure to adhere to them, different masking standards are applied to the same personal information items on different screens of the personal information processing system.", + "Case 7: Although personal information is masked on the screen of the personal information processing system, unmasked personal information is exposed by viewing the web browser source." + ] + } + ] + }, + { + "Id": "2.6.4", + "Name": "Database Access", + "Description": "Identify the information stored and managed in the database, such as the table list, and establish and implement access control policies according to the importance of the information and the type of applications and users.", + "Checks": [ + "documentdb_cluster_public_snapshot", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_not_publicly_accessible", + "accessanalyzer_enabled_without_findings", + "accessanalyzer_enabled", + "lightsail_database_public", + "neptune_cluster_iam_authentication_enabled", + "neptune_cluster_uses_public_subnet", + "neptune_cluster_public_snapshot", + "dynamodb_table_cross_account_access", + "redshift_cluster_public_access", + "vpc_subnet_separate_private_public", + "dms_instance_no_public_access", + "rds_cluster_iam_authentication_enabled", + "rds_snapshots_public_access", + "rds_instance_no_public_access", + "rds_instance_iam_authentication_enabled", + "rds_instance_transport_encrypted", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.6. Access Control", + "Section": "2.6.4 Database Access", + "AuditChecklist": [ + "Are you identifying the information stored and managed in the database, such as the table list?", + "Are you clearly identifying the applications, information systems (servers), and users that need access to information in the database and controlling access according to the access control policy?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 5 (Management of Access Rights), Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Database status (e.g., tables, columns)", + "List of database user accounts and permissions", + "Database access control policy (e.g., database access control system management screen)", + "Network diagram (e.g., database zone)", + "Information asset list" + ], + "NonComplianceCases": [ + "Case 1: A database that stores and processes a large amount of personal information is operated on the same physical server as a web application accessible via the Internet, without separating them.", + "Case 2: Developers and operators share accounts used by the application to access the production database.", + "Case 3: Although internal regulations require database access rights to be restricted by object, access rights to the database are granted uniformly to administrators, even those who do not need access to personal information tables.", + "Case 4: A database access control solution has been implemented, but access to the database is not properly restricted by IP address, allowing users to bypass the access control solution.", + "Case 5: The table status of a database storing personal information has not been identified, resulting in the unnecessary retention of personal information in temporary tables that have not been deleted." + ] + } + ] + }, + { + "Id": "2.6.5", + "Name": "Wireless Network Access", + "Description": "When using a wireless network, wireless network protection measures such as user authentication, encryption of transmitted and received data, and AP control must be applied. In addition, protection measures must be established and implemented to prevent unauthorized wireless network access, such as AD Hoc connections and the use of unauthorized APs.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.6. Access Control", + "Section": "2.6.5 Wireless Network Access", + "AuditChecklist": [ + "When using a wireless network for business purposes, are you establishing and implementing protection measures such as authentication and encryption of transmitted and received data to ensure the security of the wireless AP and network segment?", + "Have you established and implemented procedures for applying for and terminating access to ensure that only authorized employees can use the wireless network?", + "Have you established and implemented protection measures against unauthorized wireless networks, such as detecting and blocking AD Hoc connections and unauthorized wireless APs within the organization?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Network diagram", + "AP security settings history", + "Inspection records of unauthorized wireless networks", + "Wireless network usage application and approval records" + ], + "NonComplianceCases": [ + "Case 1: The wireless network segments for external users and internal users are the same, allowing external users to access the internal network without separate control via the wireless network.", + "Case 2: Although the encryption function for information transmission and reception was enabled when configuring the wireless AP, it was set in an insecure manner.", + "Case 3: A wireless AP connected to the internal network for business purposes has security settings that are insufficient, such as exposure of the administrator password (using the default password) and lack of access control." + ] + } + ] + }, + { + "Id": "2.6.6", + "Name": "Remote Access Control", + "Description": "Managing information systems and handling personal information outside of protected areas is, in principle, prohibited. However, if remote access is allowed for unavoidable reasons such as telecommuting, incident response, or remote collaboration, protective measures must be established and implemented, including approval from responsible personnel, designation of access devices, setting access scope and duration, enhanced authentication, encrypted communication, and securing access devices (e.g., antivirus, patches).", + "Checks": [ + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_self_registration_disabled", + "workspaces_vpc_2private_1public_subnets_nat", + "workspaces_volume_encryption_enabled", + "iam_user_console_access_unused", + "iam_user_mfa_enabled_console_access", + "networkfirewall_in_all_vpc", + "vpc_subnet_no_public_ip_by_default", + "vpc_flow_logs_enabled", + "vpc_subnet_separate_private_public", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_allow_ingress_tcp_port_22" + ], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.6. Access Control", + "Section": "2.6.6 Remote Access Control", + "AuditChecklist": [ + "Is remote operation of information systems through external networks such as the internet prohibited in principle, and are compensatory measures in place if allowed for unavoidable reasons such as incident response?", + "Is access through remote operation of information systems allowed only for specific devices when done through internal networks?", + "Are protective measures established and implemented to prevent security incidents such as data breaches and hacking during remote work, such as telecommuting, remote collaboration, and smart work?", + "Are the devices used for remote access to personal information processing systems for management, operation, development, and security purposes designated as management terminals, and are safety measures such as prohibiting unauthorized operations and use for purposes other than those intended being applied?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Remote access application form (e.g., VPN)", + "VPN account list", + "VPN access control policy settings", + "IP management log", + "Remote access control settings (server settings, security system settings, etc.)", + "Designation and management of management terminals", + "Network diagram" + ], + "NonComplianceCases": [ + "Case 1: Although internal regulations state that remote access to the system is prohibited in principle and, when allowed, access is restricted through IP-based access control, remote desktop connections and SSH access to the system are not limited by IP addresses, allowing access from any PC.", + "Case 2: A VPN has been established for remote management, but it is always available without usage approval or access period restrictions.", + "Case 3: Work-related mobile apps have been installed on personal smart devices for external workers, but appropriate protective measures (e.g., antivirus, encryption, wiping in case of loss or theft) to prevent personal information leaks are not being applied.", + "Case 4: VPN access for external users is not limited by network segments and information systems, allowing excessive access to the entire internal network and information systems for authenticated remote users." + ] + } + ] + }, + { + "Id": "2.6.7", + "Name": "Internet Access Control", + "Description": "To prevent information leaks, malware infections, and intrusions into the internal network through the internet, policies must be established and implemented to restrict internet access or services (e.g., P2P, web hard drives, messengers) on key information systems, devices handling sensitive duties, and terminals processing personal information.", + "Checks": [ + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_changes_to_network_acls_alarm_configured", + "workspaces_vpc_2private_1public_subnets_nat", + "workspaces_volume_encryption_enabled", + "networkfirewall_in_all_vpc", + "vpc_subnet_no_public_ip_by_default", + "vpc_flow_logs_enabled", + "vpc_subnet_separate_private_public", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout", + "route53_dangling_ip_subdomain_takeover", + "ec2_elastic_ip_unassigned", + "ec2_elastic_ip_shodan", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_public_ip" + ], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.6. Access Control", + "Section": "2.6.7 Internet Access Control", + "AuditChecklist": [ + "Is there an established and implemented policy to control internet access for work PCs used for key duties and personal information handling terminals?", + "Is unnecessary external internet access from key information systems (e.g., database servers) being controlled?", + "Are internet access restrictions being applied in a secure manner for individuals who are required by law to have their internet access restricted?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Policy for blocking non-work-related sites (e.g., P2P) (management screen of non-work-related site blocking system)", + "Internet access monitoring history", + "List of individuals subject to internet access restriction measures", + "Procedures and records for data transfer between networks (e.g., application and approval records)", + "Network diagram" + ], + "NonComplianceCases": [ + "Case 1: Internet access restriction measures were applied according to the Personal Information Protection Act, but the restriction was not applied to some individuals with the authority to set access rights for personal information processing systems.", + "Case 2: Although internet access restriction measures were applied as required under the Personal Information Protection Act, it was possible to bypass the restriction by accessing the system through another server, allowing the download and deletion of personal information.", + "Case 3: Some servers located in the DMZ and internal network were unnecessarily able to access the internet directly.", + "Case 4: Although a physical network separation system was applied between internet PCs and internal work PCs, and a data transfer system was established, there was no approval process for data transfers, and there was no periodic review of the data transfer records.", + "Case 5: Internal regulations require that individuals handling personal information obtain approval from a responsible person before accessing P2P or web hard drive sites, and access is only permitted for a specific period, but there are numerous cases of exceptions being made without going through the approval process." + ] + } + ] + }, + { + "Id": "2.7.1", + "Name": "Application of Encryption Policy", + "Description": "To protect personal and important information, encryption policies that reflect legal requirements, such as encryption targets, encryption strength, and encryption usage policies, must be established. Encryption must be applied during the storage, transmission, and transfer of personal and important information.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "ssm_document_secrets", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_secrets_in_logs", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_database_connections_ssl_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_default_encryption", + "s3_bucket_secure_transport_policy", + "documentdb_cluster_storage_encrypted", + "sns_subscription_not_using_http_endpoints", + "sns_topics_kms_encryption_at_rest_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "opensearch_service_domains_encryption_at_rest_enabled", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_node_to_node_encryption_enabled", + "neptune_cluster_storage_encrypted", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_tables_kms_cmk_encryption_enabled", + "storagegateway_fileshare_encryption_enabled", + "ecs_task_definitions_no_environment_secrets", + "directoryservice_radius_server_security_protocol", + "workspaces_volume_encryption_enabled", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "sqs_queues_server_side_encryption_enabled", + "cloudtrail_kms_encryption_enabled", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_in_transit_encryption_enabled", + "autoscaling_find_secrets_ec2_launch_configuration", + "elbv2_insecure_ssl_ciphers", + "elbv2_ssl_listeners", + "backup_vaults_exist", + "backup_vaults_encrypted", + "cloudformation_stack_outputs_find_secrets", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "rds_instance_storage_encrypted", + "rds_snapshots_encrypted", + "rds_instance_transport_encrypted", + "apigateway_restapi_client_certificate_enabled", + "efs_encryption_at_rest_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_notebook_instance_encryption_enabled", + "acm_certificates_with_secure_key_algorithms", + "athena_workgroup_enforce_configuration", + "athena_workgroup_encryption", + "ec2_instance_secrets_user_data", + "ec2_ebs_default_encryption", + "ec2_ebs_snapshots_encrypted", + "ec2_launch_template_no_secrets", + "ec2_ebs_volume_encryption" + ], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.7. Application of Encryption", + "Section": "2.7.1 Application of Encryption Policy", + "AuditChecklist": [ + "Has an encryption policy been established that includes encryption targets, encryption strength, and encryption usage in consideration of legal requirements for the protection of personal and important information?", + "Is encryption applied to personal and important information during storage, transmission, and transfer according to the encryption policy?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 24-2 (Restrictions on Processing of Resident Registration Numbers), Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 7 (Encryption of Personal Information)" + ], + "AuditEvidence": [ + "Encryption control policy (targets, methods, algorithms, etc.)", + "Encryption application status (during storage and transmission)", + "Risk analysis results (if encryption is not applied to unique identifiers other than resident registration numbers in the internal network)", + "Encryption solution management screen" + ], + "NonComplianceCases": [ + "Case 1: Internal policies and guidelines do not properly specify encryption targets, encryption strength, encryption methods during storage and transmission, or the roles and responsibilities of those responsible for encryption, considering legal requirements.", + "Case 2: The company applied incorrect regulations during the creation of its encryption policy, leading to non-compliance with legal encryption requirements (e.g., storing user account numbers without encryption).", + "Case 3: Although one-way encryption was applied to the passwords of both personal information handlers and data subjects, an insecure MD5 algorithm was used.", + "Case 4: Although a security server was applied to an internet shopping mall in accordance with relevant laws and internal regulations, encryption was missing in some sections where users' personal information is transmitted (e.g., viewing or modifying member information, password retrieval, password changes).", + "Case 5: Passwords for accessing information systems, authentication keys, and other values were stored in plaintext in system configuration files and source code." + ] + } + ] + }, + { + "Id": "2.7.2", + "Name": "Cryptographic Key Management", + "Description": "Establish and implement management procedures for the secure generation, use, storage, distribution, and destruction of cryptographic keys, and prepare recovery methods if necessary.", + "Checks": [ + "secretsmanager_automatic_rotation_enabled", + "kms_cmk_are_used", + "kms_key_not_publicly_accessible", + "kms_cmk_rotation_enabled", + "kms_cmk_not_deleted_unintentionally", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "directoryservice_ldap_certificate_expiration", + "rds_instance_certificate_expiration", + "acm_certificates_transparency_logs_enabled" + ], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.7. Application of Encryption", + "Section": "2.7.2 Cryptographic Key Management", + "AuditChecklist": [ + "Are procedures for the generation, use, storage, distribution, modification, recovery, and destruction of cryptographic keys established and implemented?", + "Are cryptographic keys securely stored in a separate location to ensure they can be recovered if necessary, and is access to the use of cryptographic keys minimized?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 7 (Encryption of Personal Information)" + ], + "AuditEvidence": [ + "Cryptographic Key Management Policy", + "Cryptographic Key Management Log and System Screens" + ], + "NonComplianceCases": [ + "Case 1: If encryption policies do not specify procedures and methods for managing cryptographic keys, leading to varying levels and methods of cryptographic key management among personnel, resulting in vulnerabilities.", + "Case 2: Internal regulations require the generation of encryption keys under the approval of a responsible person when encrypting important information, and to maintain a key management log, but some keys are either missing or outdated in the log.", + "Case 3: The encryption key applied in the development system is the same as the one applied in the production system, making it easy to decrypt actual data through the development system." + ] + } + ] + }, + { + "Id": "2.8.1", + "Name": "Definition of Security Requirements", + "Description": "When introducing, developing, or modifying information systems, security requirements such as legal requirements related to information protection and personal information protection, the latest security vulnerabilities, and secure coding methods must be defined and applied.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "codebuild_project_user_controlled_buildspec", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "macie_is_enabled", + "inspector2_is_enabled", + "config_recorder_all_regions_enabled", + "fms_policy_compliant", + "wafv2_webacl_logging_enabled", + "accessanalyzer_enabled", + "wellarchitected_workload_no_high_or_medium_risks", + "cloudtrail_cloudwatch_logging_enabled", + "networkfirewall_in_all_vpc", + "vpc_flow_logs_enabled", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "securityhub_enabled" + ], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.8. Security for Information System Introduction and Development", + "Section": "2.8.1 Definition of Security Requirements", + "AuditChecklist": [ + "When introducing, developing, or modifying an information system, are procedures for reviewing the validity of information protection and personal information protection aspects and for acquisition established and implemented?", + "When introducing, developing, or modifying an information system, are security requirements, including legal requirements and the latest vulnerabilities, clearly defined and reflected from the design stage?", + "Are coding standards for secure implementation of the information system established and applied?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information System Acquisition Standards and Procedures", + "RFP (Request for Proposal) and Purchase Contracts for Information System Introduction", + "Development Outputs (Project Execution Plans, Requirements Definition, Screen Design, Security Architecture Design, Test Plans, etc.)", + "Secure Coding Standards" + ], + "NonComplianceCases": [ + "Case 1: Lack of established security verification standards and procedures prior to acquiring an information system.", + "Case 2: Internal regulations require the review of the security impact and the operating environment when introducing a new system, but recent acquisitions of some information systems lacked detailed standards and plans, and therefore, no security review was conducted during the acquisition.", + "Case 3: Internal development guidelines do not define key security requirements related to development (authentication and encryption, security logging, etc.).", + "Case 4: In the 'Development Standards Definition Document', user passwords are to be encrypted using insecure algorithms (MD5, SHA1), resulting in failure to comply with relevant legal requirements." + ] + } + ] + }, + { + "Id": "2.8.2", + "Name": "Review and Testing of Security Requirements", + "Description": "To verify that an information system has been introduced or implemented according to predefined security requirements, review standards and procedures must be established and implemented to check compliance with legal requirements, the latest security vulnerabilities, secure coding implementation, and personal information impact assessment, and corrective measures must be taken for any identified issues.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "codebuild_project_user_controlled_buildspec", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "macie_is_enabled", + "inspector2_is_enabled", + "inspector2_active_findings_exist", + "config_recorder_all_regions_enabled", + "fms_policy_compliant", + "wafv2_webacl_logging_enabled", + "accessanalyzer_enabled_without_findings", + "accessanalyzer_enabled", + "wellarchitected_workload_no_high_or_medium_risks", + "cloudtrail_cloudwatch_logging_enabled", + "networkfirewall_in_all_vpc", + "vpc_flow_logs_enabled", + "guardduty_no_high_severity_findings", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "securityhub_enabled" + ], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.8. Security for Information System Introduction and Development", + "Section": "2.8.2 Review and Testing of Security Requirements", + "AuditChecklist": [ + "When introducing, developing, or modifying an information system, are tests conducted to verify whether the security requirements defined during the analysis and design stages have been effectively applied?", + "Are vulnerability assessments conducted to confirm that the information system has been securely developed according to secure coding standards?", + "Are procedures established and implemented to ensure that issues identified during testing and vulnerability assessments are promptly addressed through corrective action plans and follow-up checks?", + "For public institutions, are impact assessments conducted during the analysis and design stages when developing or modifying personal information processing systems, as required by relevant laws, and are the results reflected during development and modification?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 33 (Personal Information Impact Assessment)", + "Notification on Personal Information Impact Assessment" + ], + "AuditEvidence": [ + "Information System Acceptance Test Results", + "Requirements Traceability Matrix", + "Test Plans, Test Results", + "Vulnerability Assessment Results", + "Personal Information Impact Assessment Report", + "Confirmation of Implementation of Corrective Actions for Personal Information Impact Assessment" + ], + "NonComplianceCases": [ + "Case 1: Failure to test security requirements defined in internal guidelines and documents after implementing an information system.", + "Case 2: In the application program test scenario and technical vulnerability checklist, important validation items such as input validation checks were omitted.", + "Case 3: Failure to assess whether known technical vulnerabilities exist during implementation or testing, or failure to address identified vulnerabilities without valid reasons or approval.", + "Case 4: A public institution failed to conduct an impact assessment when developing a personal information file or personal information processing system subject to an impact assessment requirement, such as processing unique identifiers of more than 50,000 data subjects.", + "Case 5: A public institution failed to submit the impact assessment report to the Personal Information Protection Commission within two months after receiving the report from the impact assessment agency.", + "Case 6: Internal guidelines require reviewing the security and impact on the operating environment when introducing a new system (e.g., vulnerability assessments), but recent acquisitions of some information systems lacked security reviews during the acceptance process." + ] + } + ] + }, + { + "Id": "2.8.3", + "Name": "Separation of Test and Production Environments", + "Description": "Development and test systems must, in principle, be separated from production systems to reduce the risk of unauthorized access and changes to the production system.", + "Checks": [ + "codebuild_project_user_controlled_buildspec" + ], + "Attributes": [ + { + "Domain": "2. Security Requirements for Protection Measures", + "Subdomain": "2.8. Security for Information System Introduction and Development", + "Section": "2.8.3 Separation of Test and Production Environments", + "AuditChecklist": [ + "Are development and test systems separated from the production system?", + "If separation of development and production environments is difficult due to unavoidable reasons, have security measures such as mutual review, monitoring by supervisors, approval for changes, and ensuring accountability been implemented?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Network diagrams (including test environment configuration)", + "Current application of access control between the production environment and the development/test environment" + ], + "NonComplianceCases": [ + "Case 1: Source code changes are being made directly in the production environment without a separate development environment or proper approval.", + "Case 2: Although it is unavoidable to operate the development and production systems without separation, records of mutual review or monitoring are missing.", + "Case 3: Although a separate development system is in place, access from the development environment to the production environment is not controlled, allowing developers unnecessary access to the production system through the development system." + ] + } + ] + }, + { + "Id": "2.8.4", + "Name": "Test Data Security", + "Description": "In order to prevent the leakage of operational data during system testing, procedures for the creation, use, management, disposal, and technical protection measures of test data must be established and implemented.", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.8. Security in Information System Introduction and Development", + "Section": "2.8.4 Test Data Security", + "AuditChecklist": [ + "Is the use of actual operational data restricted during the development and testing of information systems?", + "If it is inevitable to use operational data in a test environment, are control procedures such as approval by the responsible person, monitoring of access and leakage, and deletion of data after testing established and implemented?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Test data status", + "Test data generation rules", + "If operational data was used in a test environment, the approval history" + ], + "NonComplianceCases": [ + "Case 1: There are no specific standards and procedures established for generating test data for use on the development server.", + "Case 2: Operational data is being used as test data without proper processing and without approval from the responsible person for a valid reason.", + "Case 3: Although operational data was approved in advance for use as test data for unavoidable reasons, the same level of access control as the operational database is not applied to the test database.", + "Case 4: After using operational data for testing purposes, the data was not deleted from the test database even though the testing was completed." + ] + } + ] + }, + { + "Id": "2.8.5", + "Name": "Source Program Management", + "Description": "Source programs must be managed so that only authorized users can access them, and it is a principle that they should not be stored in the operational environment.", + "Checks": [ + "ecr_repositories_not_publicly_accessible", + "codeartifact_packages_external_public_publishing_disabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.8. Security in Information System Introduction and Development", + "Section": "2.8.5 Source Program Management", + "AuditChecklist": [ + "Have procedures been established and implemented to control access to source programs by unauthorized persons?", + "Is the source program stored safely in a non-operational environment for emergencies such as system failures?", + "Is the history of changes to the source program being managed?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Status of configuration management systems such as SVN (e.g., list of authorized personnel)", + "History of changes to the source program" + ], + "NonComplianceCases": [ + "Case 1: There is no separate backup or configuration management system for source programs, and previous versions of the source code are stored on the operational server or developer's PC without approval or history management.", + "Case 2: A configuration management system has been established, but access control, access and change history for the system or the source code stored in the system are not properly managed.", + "Case 3: The internal regulations require version control of source programs through a configuration management system, but the latest version of the source program is only stored on the developer's PC, and no separate backup is performed." + ] + } + ] + }, + { + "Id": "2.8.6", + "Name": "Transition to Operational Environment", + "Description": "When transitioning newly introduced, developed, or modified systems to the operational environment, the process must be controlled, and the executable code must be run according to test and user acceptance procedures.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.8. Security in Information System Introduction and Development", + "Section": "2.8.6 Transition to Operational Environment", + "AuditChecklist": [ + "Have control procedures been established and implemented to safely transition newly introduced, developed, or modified systems to the operational environment?", + "Are contingency plans in place to address issues that may arise during the transition to the operational environment?", + "Are only the files necessary for service execution installed in the operational environment?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Transition procedures", + "Transition records (requests, approvals, tests, transitions, etc.)" + ], + "NonComplianceCases": [ + "Case 1: There are no procedures in place to review and approve the transition of developed or modified source programs to the operational environment.", + "Case 2: Unnecessary files (source code, distribution modules, backups, development-related documents, manuals, etc.) exist in the operational server.", + "Case 3: The internal guidelines require the preparation of change request and result documents for safe transition and recovery during transitions to the operational environment, but such documents are not available.", + "Case 4: The internal guidelines require internal review and approval before distributing mobile apps to the app market, but developers are bypassing these procedures and distributing the apps directly." + ] + } + ] + }, + { + "Id": "2.9.1", + "Name": "Change Management", + "Description": "Procedures must be established and implemented to manage all changes to assets related to information systems, and the impact on system performance and security must be analyzed before changes are made.", + "Checks": [ + "codebuild_project_older_90_days", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "config_recorder_all_regions_enabled", + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.9. System and Service Operations Management", + "Section": "2.9.1 Change Management", + "AuditChecklist": [ + "Have procedures been established and implemented for changes to assets related to information systems (hardware, operating systems, commercial software packages, etc.)?", + "Are the performance and security impacts analyzed before making changes to information system-related assets?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Change management procedures", + "Change management records (requests, approvals, change details, etc.)", + "Impact analysis results of changes" + ], + "NonComplianceCases": [ + "Case 1: A recent change to the DMZ section for redundancy was made, but there is no evidence of performing and approving the security risk and performance evaluation that may occur after the change.", + "Case 2: A recent network change was made, but the review and notification were not sufficiently carried out, so the changes were not properly reflected in the network diagram or some access control systems (e.g., firewalls, database access control systems) ACLs.", + "Case 3: Although a change management system was established to analyze and discuss the impact on performance and security when information systems are introduced or changed, changes can still be made outside the system, and related changes are not properly reviewed." + ] + } + ] + }, + { + "Id": "2.9.2", + "Name": "Performance and Fault Management", + "Description": "To ensure the availability of information systems, performance and capacity requirements must be defined, and the status must be continuously monitored. Procedures for detecting, recording, analyzing, recovering, and reporting in response to faults must be established and managed effectively.", + "Checks": [ + "kms_cmk_not_deleted_unintentionally", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "s3_bucket_no_mfa_delete", + "s3_bucket_cross_region_replication", + "documentdb_cluster_cloudwatch_log_export", + "documentdb_cluster_deletion_protection", + "config_recorder_all_regions_enabled", + "cognito_user_pool_deletion_protection_enabled", + "neptune_cluster_multi_az", + "neptune_cluster_deletion_protection", + "directoryservice_directory_monitor_notifications", + "directoryservice_ldap_certificate_expiration", + "elb_is_in_multiple_az", + "elb_cross_zone_load_balancing_enabled", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_multi_region_enabled", + "iam_no_expired_server_certificates_stored", + "networkfirewall_deletion_protection", + "kafka_cluster_enhanced_monitoring_enabled", + "vpc_subnet_different_az", + "trustedadvisor_premium_support_plan_subscribed", + "trustedadvisor_errors_and_warnings", + "dms_instance_multi_az_enabled", + "autoscaling_group_multiple_az", + "elbv2_is_in_multiple_az", + "elbv2_deletion_protection", + "cloudformation_stacks_termination_protection_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "rds_instance_multi_az", + "rds_cluster_backtrack_enabled", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_deletion_protection", + "rds_instance_certificate_expiration", + "rds_cluster_deletion_protection", + "rds_cluster_multi_az", + "acm_certificates_expiration_check", + "route53_domains_transferlock_enabled", + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.9. System and Service Operations Management", + "Section": "2.9.2 Performance and Fault Management", + "AuditChecklist": [ + "Have procedures been established and implemented to continuously monitor performance and capacity to ensure the availability of information systems?", + "Are response procedures in place and implemented to address cases where the performance and capacity requirements (thresholds) of the information system are exceeded?", + "Have procedures been established and implemented to immediately recognize and respond to information system faults?", + "Are procedures in place to record and manage actions taken in response to faults through fault response reports?", + "For serious faults, are measures being taken to prevent recurrence through cause analysis?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Procedures for performance and capacity monitoring", + "Evidence of performance and capacity monitoring (e.g., internal reporting results)", + "Fault response procedures", + "Fault response report" + ], + "NonComplianceCases": [ + "Case 1: Failure to define requirements (e.g., thresholds) for managing performance and capacity for each target, or the absence of records in regular inspection reports, making it difficult to assess the current status.", + "Case 2: Performance or capacity standards were exceeded, but no related reviews or follow-up measures were taken or implemented.", + "Case 3: Fault response procedures for IT equipment have been established, but internal and external environmental changes such as network configuration or vendor changes are not adequately reflected.", + "Case 4: Inconsistencies exist between fault handling procedures and fault type-specific response methods, or there is a lack of rationale for estimating response times, making swift, accurate, and systematic responses difficult." + ] + } + ] + }, + { + "Id": "2.9.3", + "Name": "Backup and Recovery Management", + "Description": "To maintain the availability and data integrity of the information system, procedures must be established and implemented regarding the backup targets, frequency, methods, storage locations, retention periods, and disaster recovery. Additionally, management must ensure timely recovery in case of incidents.", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "s3_access_point_public_access_block", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_versioning", + "s3_bucket_kms_encryption", + "s3_bucket_public_write_acl", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_cross_region_replication", + "s3_bucket_default_encryption", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_public_snapshot", + "lightsail_instance_automated_snapshots", + "neptune_cluster_backup_enabled", + "neptune_cluster_public_snapshot", + "ecr_repositories_lifecycle_policy_enabled", + "dynamodb_tables_pitr_enabled", + "directoryservice_directory_snapshots_limit", + "redshift_cluster_automated_snapshot", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "backup_reportplans_exist", + "backup_vaults_exist", + "backup_vaults_encrypted", + "backup_plans_exist", + "elasticache_redis_cluster_backup_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_instance_copy_tags_to_snapshots", + "rds_cluster_backtrack_enabled", + "rds_snapshots_public_access", + "rds_instance_backup_enabled", + "efs_have_backup_enabled", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_ebs_public_snapshot", + "ec2_ebs_volume_snapshots_exists", + "ec2_ebs_snapshots_encrypted", + "ec2_ami_public" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.9. System and Service Operation Management", + "Section": "2.9.3 Backup and Recovery Management", + "AuditChecklist": [ + "Have backup and recovery procedures been established and implemented, including targets, frequency, methods, and procedures?", + "Is regular recovery testing conducted to verify the completeness and accuracy of the backed-up information and the adequacy of the recovery procedures?", + "For backup media containing critical information, is the media stored in physically separate locations to address disaster recovery?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 11 (Safety Measures for Disaster Recovery)" + ], + "AuditEvidence": [ + "Backup and recovery procedures", + "Recovery test results", + "Disaster recovery backup status" + ], + "NonComplianceCases": [ + "Case 1: Backup and recovery procedures, including targets, frequency, methods, and procedures, have not been established.", + "Case 2: Although a backup policy is in place, information required to be stored for a long period (6 months, 3 years, 5 years, etc.) according to legal requirements is not being stored according to the backup policy.", + "Case 3: Some systems (e.g., security system policies and logs) that are required to be separately backed up according to higher-level or internal guidelines are not being backed up.", + "Case 4: Although higher-level or internal guidelines stipulate that recovery tests for backup media should be conducted periodically, recovery tests have not been performed for an extended period." + ] + } + ] + }, + { + "Id": "2.9.4", + "Name": "Log and Access Record Management", + "Description": "The organization must define the types of logs, retention periods, and retention methods for user access records, system logs, and privilege grant records for information systems such as servers, applications, security systems, and network systems, and must securely retain and manage them to prevent tampering, theft, or loss.", + "Checks": [ + "eventbridge_bus_exposed", + "eventbridge_bus_cross_account_access", + "eventbridge_schema_registry_cross_account_access", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "s3_access_point_public_access_block", + "s3_bucket_server_access_logging_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_public_write_acl", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_default_encryption", + "s3_account_level_public_access_blocks", + "s3_bucket_level_public_access_block", + "documentdb_cluster_cloudwatch_log_export", + "macie_is_enabled", + "inspector2_is_enabled", + "config_recorder_all_regions_enabled", + "cloudfront_distributions_logging_enabled", + "wafv2_webacl_logging_enabled", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "elb_logging_enabled", + "redshift_cluster_audit_logging", + "cloudtrail_insights_exist", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_multi_region_enabled", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_securityaudit_role_created", + "eks_control_plane_logging_all_types_enabled", + "apigatewayv2_api_access_logging_enabled", + "kafka_cluster_enhanced_monitoring_enabled", + "vpc_flow_logs_enabled", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "trustedadvisor_premium_support_plan_subscribed", + "elbv2_logging_enabled", + "securityhub_enabled", + "rds_instance_enhanced_monitoring_enabled", + "rds_snapshots_public_access", + "rds_snapshots_encrypted", + "rds_instance_integration_cloudwatch_logs", + "apigateway_restapi_logging_enabled", + "efs_not_publicly_accessible", + "acm_certificates_transparency_logs_enabled", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_instance_managed_by_ssm", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshots_encrypted", + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.9. System and Service Operation Management", + "Section": "2.9.4 Log and Access Record Management", + "AuditChecklist": [ + "Has the organization established log management procedures for information systems such as servers, applications, security systems, and network systems, and is it generating and storing the necessary logs accordingly?", + "Are log records of information systems securely stored to prevent tampering, theft, or loss, and is access to the log records minimized?", + "Are access records for personal information processing systems securely stored for a specified period in accordance with legal requirements, including all necessary items?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 8 (Retention and Inspection of Access Records)" + ], + "AuditEvidence": [ + "Log management procedures", + "Log record details", + "Access control records for log storage devices", + "Access records of personal information" + ], + "NonComplianceCases": [ + "Case 1: The detailed criteria and procedures for log recording, retention periods, review frequency, and responsible personnel have not been established.", + "Case 2: The maximum size for critical logs such as security event logs, application, and service logs (for Windows Server 2008 or later) is not sufficiently configured, resulting in logs not being recorded and retained for the period specified by internal standards.", + "Case 3: The log records of important Linux/UNIX servers are not separately backed up or adequately protected, allowing users to arbitrarily delete command execution histories and access logs.", + "Case 4: Upon reviewing access records for the personal information processing system, while the account, access time, and IP address of the user were logged, details about the data subject information handled and the tasks performed (e.g., view, modify, delete, download) were not recorded.", + "Case 5: The capacity of the log server is insufficient, leaving only two months of access records for the personal information processing system.", + "Case 6: A personal information processing system handling personal information of 100,000 data subjects is only retaining access logs for one year." + ] + } + ] + }, + { + "Id": "2.9.5", + "Name": "Log and Access Record Inspection", + "Description": "To ensure normal use of the information system and prevent misuse (unauthorized access, excessive queries, etc.) by users, log review criteria for access and usage must be established and inspected periodically, and post-event actions must be taken promptly if issues arise.", + "Checks": [ + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "inspector2_active_findings_exist", + "cognito_user_pool_client_prevent_user_existence_errors", + "accessanalyzer_enabled_without_findings", + "cloudtrail_insights_exist", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_privilege_escalation", + "guardduty_no_high_severity_findings", + "trustedadvisor_errors_and_warnings" + ], + "Attributes": [ + { + "Domain": "2. Protection Control Requirements", + "Subdomain": "2.9. System and Service Operation Management", + "Section": "2.9.5 Log and Access Record Inspection", + "AuditChecklist": [ + "Are there established log review and monitoring procedures, including the frequency, targets, and methods for detecting errors, misuse (unauthorized access, excessive queries, etc.), fraud, and other anomalies in the information system?", + "Are the results of log reviews and monitoring reported to the responsible person, and are responses taken following procedures when anomalies are detected?", + "Are access records of the personal information processing system regularly inspected according to the periods specified in relevant laws?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 8 (Retention and Inspection of Access Records)" + ], + "AuditEvidence": [ + "Log review and monitoring procedures", + "Log review and monitoring results (review details, reports, etc.)", + "Access record inspection details for personal information", + "Criteria and results for verifying reasons for personal information downloads", + "Evidence of responses to detected anomalies" + ], + "NonComplianceCases": [ + "Case 1: Monitoring and alert policies (criteria) for abnormal access (e.g., early morning access on holidays, access via bypass routes) or abnormal behaviors (e.g., large-scale data queries or continuous small data queries) on information systems processing important information have not been established.", + "Case 2: Although periodic inspection/monitoring criteria for access and usage are established in internal guidelines or systems, there is no record of actual review of abnormal access or behavior.", + "Case 3: The personal information processor sets the inspection frequency of access records for personal information processing systems to once per quarter.", + "Case 4: The internal management plan for the personal information processor sets criteria for verifying reasons when more than 1,000 items of personal information are downloaded, but the reasons are not verified when such downloads occur." + ] + } + ] + }, + { + "Id": "2.9.6", + "Name": "Time Synchronization", + "Description": "To ensure the accuracy of logs and access records and provide reliable log analysis, the system time must be synchronized with a standard time and regularly maintained.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Control Requirements", + "Subdomain": "2.9. System and Service Operation Management", + "Section": "2.9.6 Time Synchronization", + "AuditChecklist": [ + "Is the system time synchronized with the standard time?", + "Is regular inspection conducted to ensure that time synchronization is functioning properly?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Time synchronization settings", + "Evidence of time synchronization for key systems" + ], + "NonComplianceCases": [ + "Case 1: The time of some critical systems (e.g., security systems, CCTV, etc.) is not synchronized with the standard time, and regular inspections for synchronization are not being conducted.", + "Case 2: Although internal NTP servers are configured for time synchronization, some systems are not synchronized, and there has been no cause analysis or response." + ] + } + ] + }, + { + "Id": "2.9.7", + "Name": "Reuse and Disposal of Information Assets", + "Description": "To prevent the recovery or regeneration of personal and critical information during the reuse and disposal process, secure reuse and disposal procedures for information assets must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Control Requirements", + "Subdomain": "2.9. System and Service Operation Management", + "Section": "2.9.7 Reuse and Disposal of Information Assets", + "AuditChecklist": [ + "Are secure reuse and disposal procedures for information assets established and implemented?", + "When reusing or disposing of information assets and storage media, are personal and critical information processed to be irrecoverable?", + "If information assets and storage media are disposed of internally, are the disposal records maintained in a management ledger along with evidence of disposal?", + "If disposal is outsourced to an external company, are disposal procedures specified in the contract and is the complete disposal confirmed?", + "Are measures in place to protect data on storage media during maintenance, repairs, or replacements of systems and PCs?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 21 (Destruction of Personal Information)", + "Standards for Ensuring the Safety of Personal Information, Article 13 (Destruction of Personal Information)" + ], + "AuditEvidence": [ + "Procedures for the disposal and reuse of information assets", + "Storage media management ledger", + "Evidence of the disposal of information assets and storage media", + "Disposal-related outsourcing contracts for information assets and storage media" + ], + "NonComplianceCases": [ + "Case 1: Although the policy and procedure require the complete deletion of data using a data deletion program when reusing PCs used by personal information handlers, in practice, PCs are reused without complete deletion or are only formatted before reuse, indicating that procedures are not being followed.", + "Case 2: Although storage media are disposed of through an external company, the contract lacks details on secure disposal procedures and protective measures, and there is no verification or supervision of the disposal process or evidence of compliance.", + "Case 3: Instead of recording the serial numbers of disposed HDDs, the system names are recorded, or the disposal ledger is not maintained, making it impossible to verify the disposal history and traceability.", + "Case 4: Discarded hard disks are left unsecured in an area without locks, and the data has not been fully deleted." + ] + } + ] + }, + { + "Id": "2.10.1", + "Name": "Security System Operation", + "Description": "For each type of security system, an administrator must be designated, and operational procedures such as updating to the latest policies, modifying rule sets, and monitoring events must be established and implemented. The status of policy application for each security system must be managed.", + "Checks": [ + "organizations_delegated_administrators", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_internet_facing_load_balancers", + "ssm_managed_compliant_patching", + "secretsmanager_automatic_rotation_enabled", + "kms_cmk_are_used", + "kms_key_not_publicly_accessible", + "kms_cmk_rotation_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "macie_is_enabled", + "inspector2_is_enabled", + "inspector2_active_findings_exist", + "config_recorder_all_regions_enabled", + "cognito_user_pool_waf_acl_attached", + "fms_policy_compliant", + "ssmincidents_enabled_with_plans", + "cloudfront_distributions_using_waf", + "wafv2_webacl_logging_enabled", + "guardduty_no_high_severity_findings", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "trustedadvisor_errors_and_warnings", + "elbv2_waf_acl_attached", + "securityhub_enabled", + "apigateway_restapi_waf_acl_attached", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_networkacl_allow_ingress_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.1 Security System Operation", + "AuditChecklist": [ + "Has the organization established and implemented operational procedures for the security systems in use?", + "Is access to the security system administrators limited to a minimum, and is unauthorized access strictly controlled?", + "Has the organization established and implemented formal procedures for registering, modifying, and deleting policies for each security system?", + "Are exception policies for the security system managed according to procedures, and are users of exception policies managed with the minimum privileges?", + "Is the validity of the policies set on the security system periodically reviewed?", + "Has the organization installed and operated security systems that perform functions specified by law to prevent illegal access and data leakage in personal information processing systems?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Security system configuration", + "Network configuration", + "Security system operational procedures", + "Firewall policies", + "Firewall policy setup/modification request forms", + "Exception list for the security system", + "Management screens for each security system (firewall, IPS, server access control, DLP, DRM, etc.)", + "Security system policy review history" + ], + "NonComplianceCases": [ + "Case 1: Regular reviews of the security policies for the intrusion prevention system were not conducted, resulting in unnecessary or excessively permissive policies.", + "Case 2: There are no procedures or criteria for applying, modifying, or deleting security policies, or such procedures exist but are not followed.", + "Case 3: The assignment and supervision of administrators for the security system were not properly implemented.", + "Case 4: Although internal guidelines stipulate that the information security officer must record and maintain the history of security policy changes for the security system, the policy management ledger was not periodically maintained, or the policies recorded in the ledger did not match those actually applied in the operating system." + ] + } + ] + }, + { + "Id": "2.10.2", + "Name": "Cloud Security", + "Description": "When using cloud services, protection measures must be established and implemented for administrator access and security settings to prevent unauthorized access and configuration errors that could lead to the leakage or exposure of critical information and personal data, depending on the service type (SaaS, PaaS, IaaS, etc.).", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protective Measure Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.2 Cloud Security", + "AuditChecklist": [ + "Is the responsibility and role for information protection and personal information protection clearly defined with the cloud service provider, and is it reflected in contracts (such as SLA)?", + "Are security risks based on the service type evaluated when using cloud services, and are security control policies established and implemented, including security configurations and setting standards, security setting changes and approval procedures, secure connection methods, and authority systems to prevent unauthorized access and configuration errors?", + "Are administrator privileges for cloud services granted minimally according to roles, and are enhanced protection measures such as strengthened authentication, encryption, access control, and audit logs applied to prevent unauthorized access and abuse of privileges?", + "Is the monitoring of cloud service security setting changes and operation status conducted, and is the appropriateness of these settings reviewed regularly?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Cloud service-related contracts and SLA", + "Cloud service risk analysis results", + "Cloud service security control policies", + "Cloud service administrator privilege assignment status", + "Cloud service architecture diagram", + "Cloud service security setting status", + "Cloud service security setting appropriateness review history" + ], + "NonComplianceCases": [ + "Case 1: The cloud service contract does not include responsibilities and roles related to security.", + "Case 2: Employees without a business need have been excessively granted permissions to change the security settings of the cloud service.", + "Case 3: Internal guidelines require security officer approval when changing access control rules in the private network of the cloud, but many access control rules were registered or changed without following the approval procedure.", + "Case 4: Due to security setting errors in the cloud service, internal log files were exposed to the internet." + ] + } + ] + }, + { + "Id": "2.10.3", + "Name": "Public Server Security", + "Description": "For servers exposed to external networks, protective measures must be established and implemented, including separating them from internal networks, conducting vulnerability assessments, access control, authentication, and establishing procedures for information collection, storage, and disclosure.", + "Checks": [ + "ssm_document_secrets", + "ssm_managed_compliant_patching", + "inspector2_active_findings_exist", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudfront_distributions_using_waf", + "lightsail_instance_public", + "lightsail_database_public", + "lightsail_static_ip_unused", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "awslambda_function_url_public", + "awslambda_function_url_cors_policy", + "awslambda_function_inside_vpc", + "awslambda_function_not_publicly_accessible", + "networkfirewall_in_all_vpc", + "apigatewayv2_api_authorizers_enabled", + "kafka_cluster_mutual_tls_authentication_enabled", + "vpc_subnet_separate_private_public", + "autoscaling_find_secrets_ec2_launch_configuration", + "elbv2_waf_acl_attached", + "elbv2_desync_mitigation_mode", + "elbv2_insecure_ssl_ciphers", + "elbv2_ssl_listeners", + "apigateway_restapi_public", + "apigateway_restapi_waf_acl_attached", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_public_with_authorizer", + "acm_certificates_expiration_check", + "route53_domains_privacy_protection_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_secrets_user_data", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_networkacl_allow_ingress_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_launch_template_no_secrets", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_instance_imdsv2_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. Protective Measure Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.3 Public Server Security", + "AuditChecklist": [ + "Are protective measures established and implemented for the operation of public servers?", + "Are public servers installed in a DMZ separated from internal networks and protected by security systems such as firewalls?", + "When posting or storing personal or sensitive information on public servers, are approval and posting procedures, including obtaining approval from the responsible person, established and followed?", + "Does the organization regularly check whether sensitive information is being exposed through websites and web servers, and if exposure is detected, are measures taken immediately to block it?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Network diagram", + "Website information disclosure procedures and history (e.g., requests, approvals, posting history)", + "Inspection history of personal and sensitive information exposure" + ], + "NonComplianceCases": [ + "Case 1: Due to vulnerabilities in publicly exposed websites, unauthorized individuals were able to access others' personal information through Google search.", + "Case 2: Although internal regulations require approval procedures before posting personal information on websites, there were multiple cases where personal information was posted without following these procedures.", + "Case 3: In web applications such as bulletin boards, it was possible to arbitrarily modify or delete posts made by others, or view password-protected posts." + ] + } + ] + }, + { + "Id": "2.10.4", + "Name": "Security for Electronic Transactions and FinTech", + "Description": "When providing electronic transaction and FinTech services, protection measures such as authentication and encryption must be established to prevent data leakage, data tampering, or fraud. The security of external systems, such as payment systems, must be checked when integrated.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.4 Security for Electronic Transactions and FinTech", + "AuditChecklist": [ + "Are protection measures established and implemented to ensure the safety and reliability of transactions when providing electronic transaction and FinTech services?", + "Are protection measures established and implemented to protect transmitted information when integrating with external systems, such as payment systems, and is the security of the integration checked?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Protection measures for electronic transaction and FinTech services", + "Security review results for payment system integration" + ], + "NonComplianceCases": [ + "Case 1: While a contract was made with a payment service provider and integration was established, all payment-related information was transmitted in plain text through a specific URL without appropriate authentication or access restrictions.", + "Case 2: Although the external payment system was connected via a dedicated network, internal business systems were not properly controlled by firewalls or other security measures.", + "Case 3: Although internal guidelines required a security review by the information protection team before integrating external FinTech services, the review was skipped due to scheduling reasons when integrating a new FinTech service." + ] + } + ] + }, + { + "Id": "2.10.5", + "Name": "Secure Information Transmission", + "Description": "When transmitting personal or critical information to other organizations, a secure transmission policy must be established, and agreements must be made between organizations regarding management responsibilities, transmission methods, and technical protection measures for personal and critical information.", + "Checks": [ + "glue_database_connections_ssl_enabled", + "s3_bucket_secure_transport_policy", + "sns_subscription_not_using_http_endpoints", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_node_to_node_encryption_enabled", + "directoryservice_radius_server_security_protocol", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_in_transit_encryption_enabled", + "elbv2_insecure_ssl_ciphers", + "elbv2_ssl_listeners", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "rds_instance_transport_encrypted", + "apigateway_restapi_client_certificate_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.5 Secure Information Transmission", + "AuditChecklist": [ + "Has a secure transmission policy been established when transmitting personal and critical information to external organizations?", + "When exchanging personal and critical information between organizations for business purposes, are agreements and protection measures for secure transmission established and implemented?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Information transmission agreement or contract", + "Technical standards for information transmission", + "System diagrams and interface definitions related to information transmission" + ], + "NonComplianceCases": [ + "Case 1: Although a dedicated network or VPN is applied when integrating with external organizations, there is inadequate management of the timing, method, responsible person, transmitted information, and legal basis for each integration.", + "Case 2: There is a lack of implementation of security reviews, security standards, and action plans for using weak encryption algorithms (e.g., DES, 3DES) or decrypting during intermediate transmission stages." + ] + } + ] + }, + { + "Id": "2.10.6", + "Name": "Security for Business Devices", + "Description": "When connecting devices such as PCs and mobile devices to the network for business purposes, access control measures such as device authentication, approval, access scope, and security settings must be established and periodically checked.", + "Checks": [ + "workspaces_vpc_2private_1public_subnets_nat", + "workspaces_volume_encryption_enabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout" + ], + "Attributes": [ + { + "Domain": "2. Protection Measure Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.6 Security for Business Devices", + "AuditChecklist": [ + "Are security control policies, such as device authentication, approval, access scope, and security settings, established and implemented for devices used for business purposes, such as PCs, laptops, virtual PCs, and tablets?", + "Are policies established and implemented to prevent the leakage of personal and critical information through business devices by prohibiting the use of file-sharing programs, limiting shared settings, and controlling wireless network usage?", + "Are security measures applied to prevent the leakage of personal and critical information in case of loss or theft of business mobile devices?", + "Is the appropriateness of access control measures for business devices periodically reviewed?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Security control guidelines and procedures for business devices", + "Registration status of business devices", + "Security settings for business devices", + "Authentication and approval history for business devices", + "Security check status for business devices" + ], + "NonComplianceCases": [ + "Case 1: Although laptops and tablet PCs are used for business purposes, there are no policies established for device approval, usage scope, approval procedures, or authentication methods.", + "Case 2: The security management guidelines for mobile devices prohibit the use of mobile devices for business purposes unless specifically approved, but unapproved mobile devices are still being used to access internal information systems.", + "Case 3: Personal and critical information is handled on mobile devices, but security measures such as password protection are not applied to prevent leaks due to loss or theft.", + "Case 4: Although internal regulations prohibit the use of shared folders on business devices, periodic checks are not conducted, resulting in excessive use of shared folders on many business devices." + ] + } + ] + }, + { + "Id": "2.10.7", + "Name": "Management of Removable Media", + "Description": "Procedures must be established and implemented to prevent the leakage of personal or important information or infection by malware through removable media. Removable media containing personal or important information must be stored in a secure location.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.7 Management of Removable Media", + "AuditChecklist": [ + "Are policies and procedures established and implemented for handling (use), storage, disposal, and reuse of removable media such as external hard drives, USB memory, and CDs?", + "Is the status of ownership, use, and management of removable media periodically checked?", + "Is the use of removable media restricted in controlled areas, such as key information systems or important restricted areas?", + "Are measures in place to prevent the infection of malware and the leakage of important information through removable media?", + "Are removable media containing personal or important information stored in a secure location with locking mechanisms?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 10 (Physical Safety Measures)" + ], + "AuditEvidence": [ + "Policy on blocking removable media (USB, CD, etc.)", + "Removable media management log", + "Inspection records of removable media status" + ], + "NonComplianceCases": [ + "Case 1: Although there is a policy restricting the use of removable media in controlled areas like server rooms, several cases were found where removable media was used without following the exception approval process, and periodic inspections of the removable media management status were not conducted, resulting in inadequate updates to the management log.", + "Case 2: Removable media containing personal information was not stored in a secure location with locking mechanisms and was left unattended in office drawers.", + "Case 3: Although a solution to control removable media was implemented, some users were granted write access without appropriate approval procedures.", + "Case 4: Some common PCs and IT equipment in the server room allowed writing to standard USB memory devices, but controls such as media import and usage restrictions, usage history records, and reviews were not applied." + ] + } + ] + }, + { + "Id": "2.10.8", + "Name": "Patch Management", + "Description": "To prevent security incidents due to vulnerabilities in software, operating systems, or security systems, the latest patches must be applied. However, if the application of the latest patches is difficult due to service impact considerations, alternative measures must be implemented.", + "Checks": [ + "ssm_managed_compliant_patching", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "opensearch_service_domains_updated_to_the_latest_service_software_version", + "redshift_cluster_automatic_upgrades", + "awslambda_function_using_supported_runtimes", + "eks_cluster_uses_a_supported_version", + "kafka_cluster_uses_latest_version", + "dms_instance_minor_version_upgrade_enabled", + "elasticache_redis_cluster_auto_minor_version_upgrades", + "rds_instance_deprecated_engine_version", + "rds_cluster_minor_version_upgrade_enabled", + "rds_instance_minor_version_upgrade_enabled", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_older_than_specific_days" + ], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.8 Patch Management", + "AuditChecklist": [ + "Are patch management policies and procedures for operating systems (OS) and software established and implemented according to the characteristics and importance of each asset, such as servers, network systems, security systems, and PCs?", + "Are the patch status of installed OS and software on key servers, network systems, and security systems periodically managed?", + "If applying the latest patches to address vulnerabilities is difficult due to service impact, are alternative measures implemented?", + "Is the application of patches via public internet access restricted for key servers, network systems, and security systems?", + "When using a patch management system, are sufficient protection measures, such as access control, established?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 9 (Prevention of Malware, etc.)" + ], + "AuditEvidence": [ + "Patch management policies and procedures", + "Patch status of each system", + "Impact analysis results related to patch application" + ], + "NonComplianceCases": [ + "Case 1: In some systems, OS patches were not applied for a long period without valid reasons or approval from the responsible personnel.", + "Case 2: Some systems were using OS versions that were no longer supported (EOS), but no response plans or alternative measures were in place.", + "Case 3: Although the latest patches were applied to commercial software and OS, there were no procedures or personnel assigned to confirm and apply the latest patches for open-source programs (e.g., OpenSSL, OpenSSH, Apache), resulting in the lack of application of the latest security patches." + ] + } + ] + }, + { + "Id": "2.10.9", + "Name": "Malware Control", + "Description": "To protect personal and important information, information systems, and business terminals from malware such as viruses, worms, Trojans, and ransomware, prevention, detection, and response measures must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Security Control Requirements", + "Subdomain": "2.10. System and Service Security Management", + "Section": "2.10.9 Malware Control", + "AuditChecklist": [ + "Are protection measures established and implemented to protect information systems and business terminals from malware such as viruses, worms, Trojans, and ransomware?", + "Are prevention and detection activities for the latest malware continuously performed using security programs such as antivirus software?", + "Are security programs such as antivirus software kept up to date, and are emergency security updates performed when necessary?", + "Are procedures for response, such as minimizing the spread of malware and mitigating damage, established and implemented when malware infections are discovered?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 9 (Prevention of Malware, etc.)" + ], + "AuditEvidence": [ + "Guidelines, procedures, and manuals for malware response", + "Antivirus program installation status", + "Antivirus program configuration screens", + "Malware response history (e.g., response reports)" + ], + "NonComplianceCases": [ + "Case 1: Some PCs and servers do not have antivirus software installed, or the antivirus engine has not been updated to the latest version for a long time.", + "Case 2: Although users can change the antivirus program settings (e.g., real-time scanning, scheduled scanning, update settings) at their discretion, no additional protection measures were established to address this.", + "Case 3: Insufficient protection measures, such as access control, were in place for the central antivirus management system, leading to the possibility of security incidents through the central management system, or no integrity verification of the antivirus pattern was performed, making it possible for malware to spread through malicious users.", + "Case 4: Although multiple malware infections were confirmed on some internal network PCs and servers, there was no confirmation of the infection status, infection routes, cause analysis, or resulting actions." + ] + } + ] + }, + { + "Id": "2.11.1", + "Name": "Establishment of Incident Prevention and Response System", + "Description": "To prevent incidents such as security breaches and personal information leaks, and to respond quickly and effectively in the event of an incident, the organization must establish procedures for detecting, responding to, analyzing, and sharing internal and external intrusion attempts. In addition, the organization must establish a cooperative system with relevant external institutions and experts.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.11. Incident Prevention and Response", + "Section": "2.11.1 Establishment of Incident Prevention and Response System", + "AuditChecklist": [ + "Has the organization established procedures and systems to prevent security breaches and personal information leaks and to respond quickly and effectively when incidents occur?", + "If the organization is operating an incident response system through an external institution, such as a security monitoring service, are the details of the incident response procedures reflected in the contract?", + "Has the organization established a cooperative system with external experts, specialized companies, or institutions for monitoring, responding to, and handling security incidents?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 34 (Notification and Reporting of Personal Information Leaks, etc.)", + "Information and Communications Network Act, Article 48-3 (Reporting of Security Incidents), Article 48-4 (Analysis of Causes of Security Incidents, etc.)" + ], + "AuditEvidence": [ + "Incident response guidelines/procedures/manual", + "Incident response organization chart and emergency contact list", + "Security monitoring service contract (SLA, etc.)" + ], + "NonComplianceCases": [ + "Case 1: Failure to clearly define the incident response organization and procedures for responding to security breaches.", + "Case 2: Although internal guidelines and procedures specify incident response steps for different phases (before, during, after detection, recovery, reporting, etc.), some or all of the response and recovery procedures for specific incident types and severity levels are not established.", + "Case 3: Failure to keep the incident response organization chart and emergency contact list up to date, or the roles and responsibilities of each team member are not clearly defined.", + "Case 4: Errors or outdated information in the contact details for external agencies responsible for incident reporting, notification, and cooperation, or failure to keep some agency details current.", + "Case 5: When outsourcing incident detection and response to an external security monitoring company or related institution, failure to clearly define the roles and responsibilities for both parties in the contract or SLA.", + "Case 6: Although incident response procedures are in place, they do not meet the legal requirements for reporting and notifying personal data breaches, such as criteria and timing." + ] + } + ] + }, + { + "Id": "2.11.2", + "Name": "Vulnerability Inspection and Remediation", + "Description": "Regular vulnerability inspections must be conducted to verify whether information systems have exposed vulnerabilities, and any identified vulnerabilities must be promptly addressed. In addition, the organization must continuously monitor for new security vulnerabilities, assess their impact on the information systems, and take necessary actions.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "ssm_document_secrets", + "cloudwatch_log_group_no_secrets_in_logs", + "inspector2_is_enabled", + "inspector2_active_findings_exist", + "ecr_registry_scan_images_on_push_enabled", + "ecr_repositories_scan_images_on_push_enabled", + "ecr_repositories_scan_vulnerabilities_in_latest_image", + "ecs_task_definitions_no_environment_secrets", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "autoscaling_find_secrets_ec2_launch_configuration", + "guardduty_no_high_severity_findings", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "trustedadvisor_premium_support_plan_subscribed", + "trustedadvisor_errors_and_warnings", + "securityhub_enabled", + "cloudformation_stack_outputs_find_secrets", + "ec2_instance_secrets_user_data", + "ec2_launch_template_no_secrets", + "ec2_instance_imdsv2_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protective Measures Requirements", + "Subdomain": "2.11. Incident Prevention and Response", + "Section": "2.11.2 Vulnerability Inspection and Remediation", + "AuditChecklist": [ + "Has the organization established and implemented procedures for conducting regular vulnerability inspections of information systems?", + "Are actions taken to address identified vulnerabilities, and are the results reported to the responsible authorities?", + "Does the organization continuously monitor for new security vulnerabilities and assess their impact on the information systems, taking appropriate actions?", + "Is a record of vulnerability inspections maintained, and are protective measures implemented to address recurring vulnerabilities identified in previous years?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 4 (Establishment, Implementation, and Inspection of Internal Management Plans), Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Vulnerability inspection plan", + "Vulnerability inspection report (for web, mobile apps, servers, network systems, security systems, DBMS, etc.)", + "Vulnerability inspection records", + "Vulnerability remediation plan", + "Vulnerability remediation completion report", + "Penetration testing plan/results report" + ], + "NonComplianceCases": [ + "Case 1: Although internal regulations require annual technical vulnerability inspections for major systems, some major systems were excluded from the inspection.", + "Case 2: Failure to implement corrective actions for identified vulnerabilities, or failure to provide justification and approval records for vulnerabilities that cannot be addressed promptly." + ] + } + ] + }, + { + "Id": "2.11.3", + "Name": "Abnormal Behavior Analysis and Monitoring", + "Description": "To quickly detect and respond to intrusion attempts, personal information leakage attempts, and fraudulent activities from internal or external sources, the organization must collect and analyze network and data flows. Post-monitoring and inspection actions must be timely.", + "Checks": [ + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cognito_user_pool_client_prevent_user_existence_errors", + "fms_policy_compliant", + "cloudtrail_insights_exist", + "cloudtrail_threat_detection_enumeration", + "networkfirewall_in_all_vpc", + "vpc_flow_logs_enabled", + "guardduty_no_high_severity_findings", + "trustedadvisor_errors_and_warnings", + "securityhub_enabled" + ], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.11. Incident Prevention and Response", + "Section": "2.11.3 Abnormal Behavior Analysis and Monitoring", + "AuditChecklist": [ + "Is the organization collecting, analyzing, and monitoring network traffic, data flows, and event logs from major information systems, applications, networks, and security systems to detect abnormal behaviors such as intrusion attempts, personal information leakage attempts, or fraudulent activities?", + "Has the organization defined criteria and thresholds to determine abnormal behaviors, and is follow-up action, such as the determination and investigation of abnormal activities, taken in a timely manner?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 6 (Access Control)" + ], + "AuditEvidence": [ + "Status of abnormal behavior analysis and monitoring", + "Evidence of responses taken when abnormal behaviors were detected" + ], + "NonComplianceCases": [ + "Case 1: Failure to establish a real-time or regular monitoring system and procedures to detect intrusion attempts on servers, networks, databases, and security systems from external sources.", + "Case 2: Although the organization has outsourced monitoring tasks to an external security monitoring agency, there is no record of reviewing the reports provided by the agency, and the organization does not have its own monitoring system for systems excluded from the outsourced service.", + "Case 3: Although abnormal traffic exceeding internally defined thresholds has been continuously detected, no response measures have been taken." + ] + } + ] + }, + { + "Id": "2.11.4", + "Name": "Incident Response Training and Improvement", + "Description": "The organization must conduct at least one simulation training per year based on scenarios to ensure that employees and stakeholders are familiar with the procedures for responding to security incidents and personal information leakage incidents. The response system must be improved based on the training results.", + "Checks": [ + "ssmincidents_enabled_with_plans" + ], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.11. Incident Prevention and Response", + "Section": "2.11.4 Incident Response Training and Improvement", + "AuditChecklist": [ + "Has the organization established a simulation training plan for responding to security incidents and personal information leakage incidents, and are such training exercises conducted at least once a year?", + "Is the organization reflecting the results of security incident and personal information leakage incident training to improve its response system?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "Simulation training plan for responding to security and personal information leakage incidents", + "Simulation training result reports for responding to security and personal information leakage incidents", + "Incident response procedures" + ], + "NonComplianceCases": [ + "Case 1: Failure to conduct simulation training or provide related training plans and result reports.", + "Case 2: Although an annual simulation training plan for security incidents was established, it was not conducted within the planned period without valid reason or approval.", + "Case 3: Simulation training was conducted, but it was not performed according to the procedures and forms defined in the internal guidelines." + ] + } + ] + }, + { + "Id": "2.11.5", + "Name": "Incident Response and Recovery", + "Description": "When signs of or actual incidents of security breaches or personal information leakage are detected, the organization must comply with legal notification and reporting obligations, respond and recover promptly according to established procedures, and analyze the incident to establish preventive measures to reflect in the response system.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. Protection Measures Requirements", + "Subdomain": "2.11. Incident Prevention and Response", + "Section": "2.11.5 Incident Response and Recovery", + "AuditChecklist": [ + "When signs of or actual incidents of security breaches or personal information leakage are detected, is the organization responding and reporting promptly according to the defined incident response procedures?", + "Is the organization notifying data subjects and reporting to relevant authorities as required by law in case of a personal information breach?", + "After the incident is resolved, is the organization analyzing the cause, reporting the results, and sharing them with relevant departments and personnel?", + "Is the organization utilizing the information obtained from incident analysis to establish preventive measures to prevent similar incidents from recurring, and if necessary, modifying its incident response procedures?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 34 (Notification and Reporting of Personal Information Leakage)", + "Information and Communications Network Act, Article 48-3 (Reporting of Security Incidents), Article 48-4 (Analysis of Causes of Security Incidents)" + ], + "AuditEvidence": [ + "Incident response procedures", + "Incident response reports", + "Incident management logs", + "Personal information leakage reports", + "Emergency contact list" + ], + "NonComplianceCases": [ + "Case 1: Although internal incident response guidelines require that security incidents be reported to the internal information protection committee and relevant departments, the department in charge responded to the incident independently without reporting to the information protection committee or relevant departments.", + "Case 2: Although a service outage suspected to be caused by a DDoS attack occurred recently, the organization did not analyze the cause or establish preventive measures.", + "Case 3: Although a personal information leakage incident occurred due to external hacking, notification and reporting were not made within 72 hours, citing the small number of affected personal information records as the reason.", + "Case 4: Although personal information of more than 1,000 individuals was leaked due to an employee's mistake on the company website, the affected data subjects were not notified." + ] + } + ] + }, + { + "Id": "2.12.1", + "Name": "Safety Measures for Disaster Preparedness", + "Description": "Identify types of disasters that could threaten the operational continuity of the organization's core services and systems, such as natural disasters, communication or power failures, and hacking. Analyze the expected scale of damage and impact for each type, define the recovery time objective (RTO) and recovery point objective (RPO), and establish a disaster recovery system including recovery strategies, emergency recovery teams, emergency contact networks, and recovery procedures.", + "Checks": [ + "kms_cmk_not_deleted_unintentionally", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_versioning", + "s3_bucket_cross_region_replication", + "s3_bucket_object_lock", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "lightsail_instance_automated_snapshots", + "neptune_cluster_multi_az", + "neptune_cluster_deletion_protection", + "dynamodb_tables_pitr_enabled", + "elb_is_in_multiple_az", + "elb_cross_zone_load_balancing_enabled", + "redshift_cluster_automated_snapshot", + "drs_job_exist", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "vpc_subnet_different_az", + "vpc_different_regions", + "dms_instance_multi_az_enabled", + "autoscaling_group_multiple_az", + "elbv2_is_in_multiple_az", + "elbv2_deletion_protection", + "backup_reportplans_exist", + "backup_plans_exist", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "rds_instance_multi_az", + "rds_instance_deletion_protection", + "rds_cluster_deletion_protection", + "rds_cluster_multi_az", + "rds_instance_backup_enabled", + "efs_have_backup_enabled", + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Domain": "2. Protective Measure Requirements", + "Subdomain": "2.12. Disaster Recovery", + "Section": "2.12.1 Safety Measures for Disaster Preparedness", + "AuditChecklist": [ + "Has the organization identified IT disaster types that could threaten the continuity of core services (businesses) and analyzed the expected scale of damage and impact on operations to identify core IT services (businesses) and systems?", + "Has the organization defined recovery time objectives (RTO) and recovery point objectives (RPO) based on the importance and characteristics of core IT services and systems?", + "Has the organization established and implemented disaster recovery plans, including recovery strategies, emergency recovery teams, emergency contact networks, and recovery procedures, to ensure the continuity of core services and systems during disasters?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 29 (Obligation to Take Safety Measures)", + "Standards for Ensuring the Safety of Personal Information, Article 11 (Safety Measures for Disaster Preparedness)" + ], + "AuditEvidence": [ + "IT disaster recovery guidelines/procedures", + "IT disaster recovery plans (including RTO and RPO definitions)", + "Emergency contact list", + "Crisis response manual for personal information processing systems" + ], + "NonComplianceCases": [ + "Case 1: The IT disaster recovery procedures lack critical details such as the definition of IT disaster recovery teams and roles, emergency contact systems, and recovery procedures and methods.", + "Case 2: Although a backup center has been established to ensure the continuity of information systems and minimize damage during emergencies, the relevant policies do not include disaster recovery procedures using the backup center, making disaster recovery tests and actual recovery efforts ineffective.", + "Case 3: Recovery time objectives for some critical systems related to service operations have not been defined, and appropriate recovery strategies are not in place.", + "Case 4: The disaster recovery guidelines do not define the recovery priorities, RTO, or RPO for IT services or systems.", + "Case 5: Unrealistic recovery objectives have been set, either too high or too low, and the RPO and backup policies (e.g., targets, frequency) are not appropriately linked, making it difficult to ensure the effectiveness of recovery." + ] + } + ] + }, + { + "Id": "2.12.2", + "Name": "Disaster Recovery Testing and Improvement", + "Description": "Regularly test the adequacy of the disaster recovery strategies and plans, and supplement the recovery strategies and plans based on test results, changes in the information system environment, and legal requirements.", + "Checks": [ + "kms_cmk_not_deleted_unintentionally", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_versioning", + "s3_bucket_cross_region_replication", + "s3_bucket_object_lock", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "lightsail_instance_automated_snapshots", + "neptune_cluster_multi_az", + "neptune_cluster_deletion_protection", + "dynamodb_tables_pitr_enabled", + "elb_is_in_multiple_az", + "elb_cross_zone_load_balancing_enabled", + "redshift_cluster_automated_snapshot", + "drs_job_exist", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "vpc_subnet_different_az", + "vpc_different_regions", + "dms_instance_multi_az_enabled", + "autoscaling_group_multiple_az", + "elbv2_is_in_multiple_az", + "elbv2_deletion_protection", + "backup_reportplans_exist", + "backup_plans_exist", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "rds_instance_multi_az", + "rds_instance_deletion_protection", + "rds_cluster_deletion_protection", + "rds_cluster_multi_az", + "rds_instance_backup_enabled", + "efs_have_backup_enabled", + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Domain": "2. Protective Measure Requirements", + "Subdomain": "2.12. Disaster Recovery", + "Section": "2.12.2 Disaster Recovery Testing and Improvement", + "AuditChecklist": [ + "Has the organization established and implemented disaster recovery test plans to evaluate the effectiveness of the established IT disaster recovery system?", + "Are the disaster recovery strategies and plans regularly reviewed and supplemented to reflect test results, changes in the information system environment, and legal requirements?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "IT disaster recovery procedures", + "IT disaster recovery test plans", + "IT disaster recovery test results" + ], + "NonComplianceCases": [ + "Case 1: Disaster recovery drills were not planned or conducted, and the related plans and result reports are not available.", + "Case 2: Although a disaster recovery drill plan was established, it was not conducted as planned or approved, and the related result reports are missing.", + "Case 3: Disaster recovery drills were conducted, but they did not follow the procedures and forms outlined in the internal guidelines, making it difficult to evaluate the adequacy and effectiveness of the disaster recovery procedures." + ] + } + ] + }, + { + "Id": "3.1.1", + "Name": "Collection and Use of Personal Information", + "Description": "Personal information must be collected and used lawfully and fairly. When collecting personal information based on the consent of the data subject, such consent must be obtained through legal means. Additionally, when collecting personal information from children under the age of 14, consent must be obtained from their legal representative, and it must be verified that such consent was given by the legal representative.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.1. Protection Measures during Personal Information Collection", + "Section": "3.1.1 Collection and Use of Personal Information", + "AuditChecklist": [ + "When collecting personal information, is it collected in accordance with lawful requirements such as obtaining the data subjectโ€™s consent, complying with legal obligations, or concluding and fulfilling contracts?", + "When obtaining consent from the data subject for the collection of personal information, are the method and timing of obtaining consent appropriate?", + "When obtaining consent from the data subject for the collection of personal information, are the relevant details clearly communicated, and are significant points required by law highlighted in a way that is easy to understand?", + "When collecting, using, or providing personal information from children under the age of 14, are necessary details notified to their legal representatives, and is consent obtained?", + "When obtaining the consent of a legal representative, is only the minimum necessary personal information collected, and are procedures and methods in place to verify the qualifications of the legal representative?", + "When notifying children under the age of 14 about matters related to the processing of their personal information, are the notifications presented in a format and language that is clear and easy to understand?", + "Are records of consent obtained from data subjects and legal representatives being retained?", + "For personal information that can be processed without the consent of the data subject, are the relevant items and legal basis for processing disclosed in the privacy policy or communicated to the data subject separately from the personal information processed with consent?", + "When personal information is used for additional purposes without the consent of the data subject, are criteria established and implemented to assess the relevance to the original purpose, predictability, impact on the data subject, and safety measures? If additional usage continues to occur, are these criteria disclosed in the privacy policy and regularly reviewed?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 15 (Collection and Use of Personal Information), Article 22 (Methods for Obtaining Consent), Article 22-2 (Protection of Personal Information of Children)", + "Notice on the Processing of Personal Information" + ], + "AuditEvidence": [ + "Online personal information collection forms (e.g., website sign-up screens, mobile app registration screens, event participation forms)", + "Offline personal information collection forms (e.g., membership application forms)", + "Records of personal information collection consent (e.g., member databases)", + "Records of legal guardian consent", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: A personal information processor subject to the Personal Information Protection Act failed to include the 'right to refuse consent and the consequences of refusal' in the notifications when obtaining consent to collect personal information.", + "Case 2: During the process of obtaining consent for the collection of personal information, the items of personal information to be collected were not specified in detail, and were instead described in general terms like 'etc.'", + "Case 3: On a shopping mall website, personal information necessary for membership registration was collected alongside payment and delivery information required for future purchases, even though such information was not necessary at the time of registration.", + "Case 4: Personal information (e.g., name, email, phone number) was collected through Q&A boards without obtaining the data subject's consent.", + "Case 5: Personal information of children under the age of 14 was collected without obtaining the consent of their legal guardians.", + "Case 6: Although the service was not intended for children under 14, some members were under 14 because the website did not check birthdates during registration, allowing them to register without legal guardian consent.", + "Case 7: The procedure for verifying the authenticity of the legal representative was insufficient, allowing individuals who were not legal guardians to provide consent.", + "Case 8: Personal information (e.g., name, phone number) of legal guardians was collected for the purpose of obtaining their consent to collect personal information from children under the age of 14, but the consent of the legal guardian was not confirmed for an extended period, and the information was retained without being destroyed.", + "Case 9: Personal information of children under 14 was collected based on the consent of their legal guardians, but records of this consent were not maintained, making it impossible to verify the details related to legal guardian consent (e.g., legal guardianโ€™s name, time of consent)." + ] + } + ] + }, + { + "Id": "3.1.2", + "Name": "Restrictions on the Collection of Personal Information", + "Description": "When collecting personal information, only the minimum amount of personal information necessary for the intended purpose may be collected, and the data subject must not be denied the provision of goods or services for refusing to consent to optional matters.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.1. Protection Measures during Personal Information Collection", + "Section": "3.1.2 Restrictions on the Collection of Personal Information", + "AuditChecklist": [ + "When collecting personal information, is only the minimum amount of information necessary for the intended purpose being collected?", + "When collecting personal information based on the data subjectโ€™s consent, is the data subject clearly informed that they can refuse to consent to the collection of additional personal information beyond the minimum required?", + "Is the data subject not denied goods or services for refusing to consent to the collection of additional personal information beyond the minimum necessary for the intended purpose?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 16 (Restrictions on the Collection of Personal Information), Article 22 (Methods for Obtaining Consent)" + ], + "AuditEvidence": [ + "Online personal information collection forms (e.g., website sign-up screens, event participation forms)", + "Offline personal information collection forms (e.g., membership application forms)", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: Although personal information was being collected based on the fulfillment of a contract, excessive personal information not essential to the fulfillment of the contract was being collected.", + "Case 2: During the process of obtaining consent from the data subject for optional information, the data subject was not explicitly informed that they could refuse to provide such information.", + "Case 3: Although the sign-up form distinguished between required and optional information, the data subject was not clearly informed that they could complete registration without providing optional information (e.g., there was no indication on the personal information entry form of which fields were required and which were optional).", + "Case 4: On the website registration page, the data subject was unable to proceed or complete registration if they refused to provide optional information or consent to optional matters.", + "Case 5: During the hiring process, excessive personal information unrelated to the job position (e.g., family details) was collected." + ] + } + ] + }, + { + "Id": "3.1.3", + "Name": "Restrictions on the Processing of Resident Registration Numbers", + "Description": "Resident registration numbers may not be collected, used, or processed unless there is a legal basis for doing so. Even when the processing of resident registration numbers is permitted, alternative methods must be provided, such as through an internet website.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.1. Protection Measures during Personal Information Collection", + "Section": "3.1.3 Restrictions on the Processing of Resident Registration Numbers", + "AuditChecklist": [ + "Are resident registration numbers only processed when there is a clear legal basis?", + "Is the legal provision that forms the basis for the collection of resident registration numbers clearly identified?", + "When processing resident registration numbers under a legal basis, does the organization provide a method for data subjects to register without using their resident registration number during the membership registration process on an internet website?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 24-2 (Restrictions on the Processing of Resident Registration Numbers)", + "Information and Communications Network Act, Article 23-2 (Restrictions on the Use of Resident Registration Numbers)" + ], + "AuditEvidence": [ + "Personal information collection forms (e.g., website sign-up screens, event participation forms, membership application forms)", + "Online personal information collection forms (alternative registration methods for identity verification)", + "Evidence of legal grounds for processing resident registration numbers", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: Resident registration numbers were collected for simple membership management purposes, such as identity verification, during website sign-up based on the data subject's consent.", + "Case 2: Resident registration numbers were collected based on provisions in enforcement rules or local ordinances.", + "Case 3: The last 6 digits of the resident registration number were collected for identity verification, such as during password recovery, without any legal basis.", + "Case 4: Resident registration numbers were collected from job applicants during the hiring process without a legal basis.", + "Case 5: Resident registration numbers were collected during customer service inquiries at a call center for identity verification purposes.", + "Case 6: Even when there was a legal basis for the collection of resident registration numbers, alternative registration methods were not provided during the membership registration process on the website, and resident registration numbers were required for identity verification and membership registration." + ] + } + ] + }, + { + "Id": "3.1.4", + "Name": "Restriction on Processing of Sensitive and Unique Identifying Information", + "Description": "In order to process sensitive information and unique identifying information (excluding resident registration numbers), separate consent from the data subject must be obtained unless the processing is specifically required or permitted by law.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Personal Information Processing Requirements", + "Subdomain": "3.1. Protection Measures for Personal Information Collection", + "Section": "3.1.4 Restriction on Processing of Sensitive and Unique Identifying Information", + "AuditChecklist": [ + "Is sensitive information processed only with the separate consent of the data subject or when legally required?", + "Is unique identifying information (excluding resident registration numbers) processed only with the separate consent of the data subject or when there is a specific legal basis?", + "If there is a risk of invasion of privacy due to the disclosure of sensitive information during the provision of goods or services, is the data subject clearly informed of the possibility of such disclosure and how to opt for non-disclosure before the provision of goods or services?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 23 (Restrictions on Processing of Sensitive Information), Article 24 (Restrictions on Processing of Unique Identifying Information)" + ], + "AuditEvidence": [ + "Online personal information collection forms (e.g., membership sign-up pages, event participation forms)", + "Offline personal information collection forms (e.g., membership application forms)", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: Collecting sensitive information such as disability status for discounts or benefits for disabled individuals, and obtaining blanket consent for all personal information items.", + "Case 2: Collecting foreign registration numbers only from foreigners during membership registration, and obtaining blanket consent for all personal information items.", + "Case 3: When obtaining separate consent for the collection of sensitive or unique identifying information, failing to inform or incorrectly informing the data subject about the four key points that must be disclosed (e.g., the right to refuse consent and the consequences of refusal)." + ] + } + ] + }, + { + "Id": "3.1.5", + "Name": "Indirect Collection of Personal Information", + "Description": "When collecting personal information from sources other than the data subject or when receiving personal information from a third party, only the minimum amount of personal information necessary for the task should be collected or received. If there is a legal basis or at the request of the data subject, the source of the personal information, the purpose of processing, and the right to request a suspension of processing must be disclosed.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Personal Information Processing Requirements", + "Subdomain": "3.1. Protection Measures for Personal Information Collection", + "Section": "3.1.5 Indirect Collection of Personal Information", + "AuditChecklist": [ + "When receiving personal information from a third party, is it clearly stated in the contract that the responsibility for obtaining consent for the collection of personal information lies with the party providing the information?", + "When collecting personal information from public media or places, is the collection limited to the scope recognized as having the data subject's consent, based on common societal standards?", + "Even for personal information collected or generated through automated collection devices during the process of providing services, is the principle of minimum collection applied?", + "When personal information is collected from a source other than the data subject and the data subject requests it, is the required information immediately provided to the data subject?", + "When personal information collected from a source other than the data subject meets legal requirements in terms of type or scale, is the required information provided to the data subject?", + "Is there a record of informing the data subject about the source of personal information, and is this record maintained until the personal information is destroyed?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 16 (Restrictions on the Collection of Personal Information), Article 19 (Restrictions on Use and Provision of Personal Information Provided by a Third Party), Article 20 (Notification of the Source, Purpose, etc. of Indirectly Collected Personal Information)" + ], + "AuditEvidence": [ + "Contracts related to the provision of personal information (agreements with providers)", + "Records of notifications to data subjects about the source of personal information", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: In the case of collecting personal information published on websites or social media, there is no procedure for handling requests from data subjects about the source of the information.", + "Case 2: Personal information provided by another business entity was received based on consent for the provision of personal information under Article 17(1)(1) of the Personal Information Protection Act, but the data subjects were not notified within three months (note: this applies to cases where the recipient handles the personal information of more than 50,000 data subjects, sensitive information, or unique identifying information, or processes personal information of over 1 million data subjects).", + "Case 3: The data subject was informed about the source of the personal information as required by law, but some mandatory notification items were omitted, such as the purpose of processing or the right to withdraw consent.", + "Case 4: The data subject was informed about the source of the personal information, but the record of this notification was not maintained until the personal information was destroyed, in violation of legal obligations." + ] + } + ] + }, + { + "Id": "3.1.6", + "Name": "Installation and Operation of Video Information Processing Devices", + "Description": "When installing and operating fixed video information processing devices in public places or operating mobile video information processing devices in public places for business purposes, legal requirements must be followed according to the purpose and location of the installation, and appropriate protection measures must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Personal Information Processing Requirements", + "Subdomain": "3.1. Protection Measures for Personal Information Collection", + "Section": "3.1.6 Installation and Operation of Video Information Processing Devices", + "AuditChecklist": [ + "When installing and operating fixed video information processing devices in public places, is it reviewed whether the installation meets legal requirements?", + "If public institutions install and operate fixed video information processing devices in public places, are public hearings or explanation sessions held to gather opinions from relevant experts and stakeholders, as required by law?", + "When installing and operating fixed video information processing devices, are necessary measures taken, such as installing signs to ensure the data subject can easily recognize the presence of the devices?", + "When operating mobile video information processing devices in public places for business purposes, is it reviewed whether the operation meets legal requirements?", + "When operating mobile video information processing devices in public places for business purposes, is the fact that the video is being recorded indicated and informed to the public through lights, sounds, or signs?", + "Is there an operation and management policy in place for the safe management of video information processing devices and the video information they record, and is it being implemented?", + "Is the retention period for video information set, and is the information destroyed without delay after the retention period expires?", + "When outsourcing the operation of video information processing devices, are the related procedures and requirements reflected in the contract?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 25 (Restrictions on the Installation and Operation of Fixed Video Information Processing Devices), Article 25-2 (Restrictions on the Operation of Mobile Video Information Processing Devices)" + ], + "AuditEvidence": [ + "Status of video information processing device operation", + "Signs for video information processing devices", + "Video information processing device operation and management policies", + "Management screens for video information processing devices (e.g., account/permission details, video retention periods)", + "Contracts with operators of video information processing devices and inspection records" + ], + "NonComplianceCases": [ + "Case 1: The wording on the signs for video information processing devices is incomplete, or there is no established and implemented policy for the operation and management of video information processing devices.", + "Case 2: Although there is a policy for the operation and management of video information processing devices, the policy is not followed, such as failing to comply with the retention period or failing to implement access control and logging as described in the policy.", + "Case 3: The operation of video information processing devices is outsourced, but the legal requirements, such as inspection of the video information management status and provisions regarding liability for damages, are not reflected in the contract.", + "Case 4: The operation of video information processing devices is outsourced, but the signs for the devices do not include the name and contact information of the contractor." + ] + } + ] + }, + { + "Id": "3.1.7", + "Name": "Collection and Use of Personal Information for Marketing Purposes", + "Description": "When collecting and using personal information for marketing purposes, such as promoting goods or services, sales recommendations, or sending advertising information, the purpose must be clearly communicated to the data subject, and their consent must be obtained.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.1. Protection Measures When Collecting Personal Information", + "Section": "3.1.7 Collection and Use of Personal Information for Marketing Purposes", + "AuditChecklist": [ + "When obtaining consent from data subjects to process personal information for the purpose of promoting or recommending goods or services, is the data subject clearly informed, and is separate consent obtained?", + "When sending advertising information for profit using electronic transmission media, is the recipient's explicit prior consent obtained, and is the consent reconfirmed every two years?", + "When a recipient indicates refusal or withdraws prior consent for receiving advertising information for profit, is the transmission of such advertising information stopped?", + "When sending advertising information for profit, is the sender's name, method for opting out, etc., clearly stated, and are such messages not sent during nighttime hours?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 22 (Method of Obtaining Consent)", + "Information and Communications Network Act, Article 50 (Restrictions on Transmission of Advertising Information)" + ], + "AuditEvidence": [ + "Online personal information collection forms (e.g., website membership sign-up, mobile app sign-up, event participation)", + "Offline personal information collection forms (e.g., membership application forms)", + "Marketing consent records", + "Records of consent for receiving advertising information and confirmation of consent", + "Administrator screen for advertising information transmission systems (e.g., email, SMS, app push notifications)", + "Advertising information transmission content", + "Personal information processing policy" + ], + "NonComplianceCases": [ + "Case 1: When collecting personal information for 'promotion and marketing' purposes, the purpose is vaguely explained (e.g., 'providing additional services', 'providing partner services') or blanket consent is obtained without distinguishing between different purposes.", + "Case 2: Even after a user has expressed refusal to receive advertising push notifications via a mobile app, such notifications are sent due to a program error.", + "Case 3: The option to receive advertising information via text messages or email is pre-selected by default on the online sign-up page.", + "Case 4: The recipient's consent for receiving advertising information is not reconfirmed every two years.", + "Case 5: When sending advertising information for profit via email, the subject line does not begin with '(Advertisement)'." + ] + } + ] + }, + { + "Id": "3.2.1", + "Name": "Management of Personal Information Status", + "Description": "The items, volume, purpose and method of processing, and retention period of collected and retained personal information must be regularly managed. In the case of public institutions, such information must be registered with the head of the relevant agency as stipulated by law.", + "Checks": [ + "s3_bucket_lifecycle_enabled", + "macie_is_enabled" + ], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.2. Protection Measures When Retaining and Using Personal Information", + "Section": "3.2.1 Management of Personal Information Status", + "AuditChecklist": [ + "Is the status of collected and retained personal information, including the items, volume, purpose and method of processing, and retention period, regularly managed?", + "When a public institution operates or modifies personal information files, are the relevant matters registered with the head of the relevant agency as required by law?", + "Does the public institution disclose the status of personal information files in the personal information processing policy?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 32 (Registration and Disclosure of Personal Information Files)" + ], + "AuditEvidence": [ + "Personal information status table", + "Personal information flowchart", + "Registration status of personal information files", + "Personal information file management ledger", + "Personal information processing policy-related personal information files", + "Personal information files related to investigations under the Punishment of Tax Offenses Act and the Customs Act", + "Personal information files for one-time operations deemed to have a low need for continuous management as determined by Presidential Decree", + "Personal information files for simple tasks such as attending meetings, sending documents or materials, and financial settlements, which have a low need for continuous management", + "Personal information files processed temporarily for public health or public safety emergencies", + "Other personal information files collected for one-time tasks that are not stored or recorded", + "Personal information files classified as confidential under other laws", + "Personal information files collected or requested for analysis related to national security", + "Personal video information files processed via video information processing devices", + "Personal information files retained by financial institutions for handling financial transactions under the Real Name Financial Transactions and Guarantee of Secrecy Act" + ], + "NonComplianceCases": [ + "Case 1: Although personal information files are managed through the website's personal information file registration menu, some personal information files related to website services are missing from the personal information processing policy.", + "Case 2: Although two months have passed since a new personal information file was created, it has not been registered with the Personal Information Protection Commission.", + "Case 3: The content of personal information files registered and disclosed with the Personal Information Protection Commission (e.g., items of personal information collected) does not match the actual status of personal information files being processed.", + "Case 4: A public institution has not registered personal information files with the Personal Information Protection Commission, even though the files do not qualify for exceptions such as employee personal information files or personal information files collected under the Statistics Act." + ] + } + ] + }, + { + "Id": "3.2.2", + "Name": "Personal Information Quality Assurance", + "Description": "Collected personal information must be managed to ensure its accuracy, completeness, and up-to-dateness within the scope necessary for the processing purpose, and procedures must be provided to data subjects to manage their information.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.2. Protection Measures for Retention and Use of Personal Information", + "Section": "3.2.2 Personal Information Quality Assurance", + "AuditChecklist": [ + "Are procedures and methods in place to maintain personal information in an accurate and up-to-date state?", + "Is there a method provided for data subjects to ensure the accuracy, completeness, and up-to-dateness of their personal information?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 3 (Principles of Personal Information Protection)" + ], + "AuditEvidence": [ + "Form for data subjects to modify/update their personal information (online, offline)", + "Procedures to maintain the up-to-date status of personal information" + ], + "NonComplianceCases": [ + "Case 1: Although an identity verification process is implemented when changing member information through the website, the identity verification process is insufficient when changing member information via customer service, making unauthorized changes possible.", + "Case 2: While an online method is provided for online members to change their personal information, no such method is provided for offline members." + ] + } + ] + }, + { + "Id": "3.2.3", + "Name": "Protection of User Device Access", + "Description": "When accessing information stored on the user's mobile device or functions installed on the mobile device, it is necessary to notify the user clearly and obtain their consent.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.2. Protection Measures for Retention and Use of Personal Information", + "Section": "3.2.3 Protection of User Device Access", + "AuditChecklist": [ + "When accessing information stored on the user's mobile device or functions installed on the device, are users clearly informed and their consent obtained?", + "Is it ensured that services are not denied if users do not consent to access rights that are not essential for the service?", + "Are methods provided for users to consent to or withdraw access rights on their mobile devices?" + ], + "RelatedRegulations": [ + "Information and Communications Network Act, Article 22-2 (Consent for Access Rights)" + ], + "AuditEvidence": [ + "App access rights consent screen", + "App access rights settings" + ], + "NonComplianceCases": [ + "Case 1: A smartphone app requests excessive access to personal information areas such as contacts, photos, and messages, even though such access is unnecessary for the service.", + "Case 2: A service provider's smartphone app accesses information stored on the smartphone and installed functions without notifying the user and obtaining their consent.", + "Case 3: Consent is obtained for app access rights by informing users that optional permissions are required as essential permissions.", + "Case 4: A smartphone app supports Android versions below 6.0, where individual consent for access rights is not possible, making it impossible for users to reject optional access rights." + ] + } + ] + }, + { + "Id": "3.2.4", + "Name": "Use and Provision of Personal Information Beyond Purpose", + "Description": "Personal information must only be used or provided within the scope notified and consented to by the data subject at the time of collection or as permitted by law. If personal information is to be used or provided beyond this scope, additional consent must be obtained from the data subject or the legality must be verified, and appropriate protective measures must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.2. Protection Measures for Retention and Use of Personal Information", + "Section": "3.2.4 Use and Provision of Personal Information Beyond Purpose", + "AuditChecklist": [ + "Is personal information used or provided only within the scope of the purpose consented to by the data subject at the time of collection or as permitted by law?", + "When receiving personal information from a personal information processor, is the information used or provided only within the scope of the purpose for which it was provided?", + "If personal information is used or provided beyond the scope of the purpose of collection or the purpose for which it was received from a personal information processor, is additional consent obtained from the data subject or limited to cases with a legal basis?", + "When providing personal information to a third party for purposes beyond the original purpose, is the recipient required to take necessary actions to restrict the use of personal information and ensure safety?", + "When public institutions use or provide personal information beyond the original purpose, are the legal basis, purpose, and scope published in the official gazette or on the internet?", + "When public institutions use or provide personal information beyond the original purpose, is there a record of such use or provision and are procedures in place for managing it?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 18 (Restriction on the Use and Provision of Personal Information Beyond the Original Purpose), Article 19 (Restriction on Use and Provision by Recipients of Personal Information)" + ], + "AuditEvidence": [ + "Records of personal information use and provision beyond the original purpose (including related evidence such as requests)", + "Log of personal information use and provision beyond the original purpose (for public institutions)", + "Records of publication in the official gazette or on the website (for public institutions)", + "Guidelines for handling information provision requests", + "Official documents requesting information provision and records of personal information provision" + ], + "NonComplianceCases": [ + "Case 1: Personal information collected for product delivery is used for telemarketing of other company products without prior consent.", + "Case 2: Personal information collected for customer satisfaction surveys or sweepstakes entries is used for advertising other promotional events without consent.", + "Case 3: A public institution provides personal information to another institution for purposes outside the scope of the original purpose based on legal grounds but does not publish the information in the official gazette or on the internet.", + "Case 4: A public institution provides personal information to a police department for criminal investigation purposes but fails to record the details in the log of personal information use and provision beyond the original purpose." + ] + } + ] + }, + { + "Id": "3.2.5", + "Name": "Processing of Pseudonymized Information", + "Description": "When processing pseudonymized information, legal requirements such as purpose limitation, combination restrictions, safety measures, and prohibition obligations must be met, and procedures must be established and implemented to ensure an appropriate level of pseudonymization.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.2. Protection Measures for Retention and Use of Personal Information", + "Section": "3.2.5 Processing of Pseudonymized Information", + "AuditChecklist": [ + "When processing pseudonymized information, are procedures established for purpose limitation, pseudonymization methods and standards, adequacy review, prohibition of re-identification, and actions in case of re-identification?", + "When using or providing pseudonymized personal information, is the information pseudonymized to a level where individuals cannot be identified without using or combining additional information?", + "When combining pseudonymized information with that of other personal information processors, is the combination conducted through a specialized agency or data professional organization?", + "When processing pseudonymized information, are technical, administrative, and physical measures taken to ensure safety, such as deleting or separately storing additional information and keeping records?", + "Is the processing period for pseudonymized information set to an appropriate period considering the processing purpose, and is the information destroyed without delay when that period expires?", + "When anonymizing personal information, is the information anonymized to a level where individuals cannot be identified even with the use of additional information, considering the time, cost, and technology available?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 2 (Definitions), Article 28-2 (Processing of Pseudonymized Information), Article 28-3 (Restrictions on Combining Pseudonymized Information), Article 28-4 (Obligations for the Safe Processing of Pseudonymized Information), Article 28-5 (Prohibition of Re-identification in Processing Pseudonymized Information), Article 28-7 (Scope of Application), Article 58-2 (Exemptions)" + ], + "AuditEvidence": [ + "Procedures and results of the adequacy review of pseudonymization/anonymization", + "Records of pseudonymized information processing", + "Privacy policy (regarding the use and provision of pseudonymized information)" + ], + "NonComplianceCases": [ + "Case 1: When processing pseudonymized information for statistical purposes or scientific research without obtaining consent from data subjects, records of the pseudonymization process were not kept, or the privacy policy was not updated to include relevant information.", + "Case 2: Additional information was not stored separately from pseudonymized information in the same database, or access rights to both sets of information were not appropriately segregated.", + "Case 3: Although pseudonymized personal information was used, the pseudonymization process was not sufficient, making it possible to identify individuals by combining the information with other data without using additional information.", + "Case 4: Personal information was anonymized for generating test data or for public release, but due to outliers or other factors, it was still possible to identify individuals, indicating that the anonymization process was not sufficient." + ] + } + ] + }, + { + "Id": "3.3.1", + "Name": "Provision of Personal Information to Third Parties", + "Description": "When providing personal information to third parties, there must be a legal basis or consent from the data subject, and protection measures must be established and implemented to securely protect personal information during the process of providing access to third parties.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.3. Protective Measures When Providing Personal Information", + "Section": "3.3.1 Provision of Personal Information to Third Parties", + "AuditChecklist": [ + "When providing personal information to third parties, are legal requirements such as consent from the data subject or compliance with legal obligations clearly identified and followed?", + "When obtaining consent from the data subject for the provision of personal information to third parties, are the related matters clearly communicated, and is consent legally obtained by distinguishing it from other consents?", + "When obtaining consent from the data subject for the provision of personal information to third parties, are important matters clearly indicated and made easily understandable as required by law?", + "When providing personal information to third parties, is the information limited to the minimum necessary for the intended purpose?", + "When providing personal information to third parties, is it done through secure procedures and methods, and is the provision recorded and stored?", + "When allowing third parties to access personal information, is control implemented in accordance with protection procedures to securely protect the personal information?", + "When providing additional personal information without the data subject's consent, are criteria for determining the relevance to the original purpose of collection, predictability, potential harm, and safety measures established and followed? If such provisions continue, are these criteria disclosed in the privacy policy and periodically reviewed?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 17 (Provision of Personal Information), Article 22 (Methods of Obtaining Consent)", + "Notification on the Methods of Processing Personal Information" + ], + "AuditEvidence": [ + "Forms related to the provision of personal information to third parties online (e.g., membership registration page, consent for third-party provision on websites)", + "Forms related to the provision of personal information to third parties offline (e.g., membership application forms, consent forms for third-party provision)", + "Records of third-party provisions", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: When obtaining consent from the data subject for the provision of personal information to third parties, some necessary information (e.g., the right to refuse consent, the items provided) was omitted.", + "Case 2: In the process of providing personal information to third parties, personal information from data subjects who did not consent was provided due to improper verification of consent.", + "Case 3: When obtaining consent for the provision of personal information, the recipient was not specifically identified and was vaguely referred to as สป~ etc.สผ in the consent.", + "Case 4: Although third-party provision consent was optional during the membership registration process, if the data subject did not agree to third-party provision, the registration process could not be completed.", + "Case 5: An excessive amount of personal information was provided beyond what was necessary for the recipient's purpose of use." + ] + } + ] + }, + { + "Id": "3.3.2", + "Name": "Outsourcing of Personal Information Processing", + "Description": "When outsourcing personal information processing tasks to third parties, the details of the outsourced tasks and the trustee must be disclosed. Additionally, if the task involves promoting or selling goods or services, the details of the outsourced task and the trustee must be notified to the data subject.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.3. Protective Measures When Providing Personal Information", + "Section": "3.3.2 Outsourcing of Personal Information Processing", + "AuditChecklist": [ + "When outsourcing personal information processing tasks (including sub-outsourcing) to third parties, are the details of the outsourced tasks and the trustees regularly updated and disclosed on the website?", + "When outsourcing tasks related to promoting or selling goods or services, is the data subject notified of the details of the outsourced tasks and the trustees through methods such as written notice, email, or text messages?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 26 (Restrictions on the Processing of Personal Information by Outsourcing)" + ], + "AuditEvidence": [ + "Privacy policy (disclosing details related to the outsourcing of personal information processing)", + "Personal information collection forms", + "Contracts for outsourcing personal information processing", + "Records of notifications to data subjects regarding outsourced tasks related to promoting or selling goods or services" + ], + "NonComplianceCases": [ + "Case 1: Although the details of the outsourcing of personal information processing tasks were disclosed on the website's privacy policy, some trustees and the details of the outsourced tasks were missing.", + "Case 2: When outsourcing tasks related to promoting or selling goods or services, the details of the outsourced tasks and trustees were not notified to the data subject through written methods, and instead, the information was disclosed only in the privacy policy.", + "Case 3: After terminating a contract with an existing trustee for personal information processing, the new trustee was not promptly reflected in the privacy policy.", + "Case 4: Although the trustee sub-outsourced the personal information processing tasks to a third party, the sub-outsourcing details were not disclosed on the website." + ] + } + ] + }, + { + "Id": "3.3.3", + "Name": "Transfer of Personal Information Due to Business Transfers", + "Description": "When transferring or receiving personal information due to business transfers or mergers, appropriate protection measures such as notifying the data subjects must be established and implemented.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.3. Protective Measures When Providing Personal Information", + "Section": "3.3.3 Transfer of Personal Information Due to Business Transfers", + "AuditChecklist": [ + "When transferring personal information to another party due to the transfer or merger of all or part of the business, are the necessary matters communicated to the data subjects in advance?", + "When receiving personal information, does the recipient notify the data subjects without delay regarding the fact that personal information has been received and other necessary matters, if legally required?", + "Does the recipient of the personal information use the information only for its original purpose at the time of transfer, or provide it to third parties in compliance with the original purpose?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 27 (Restrictions on the Transfer of Personal Information Due to Business Transfers)" + ], + "AuditEvidence": [ + "Records of notifications to data subjects regarding the transfer of personal information (during business transfers)", + "Privacy policy" + ], + "NonComplianceCases": [ + "Case 1: When receiving personal information through business acquisition, the data subjects were not notified of the transfer of personal information, even though the data provider failed to notify them of the transfer.", + "Case 2: When receiving personal information through business acquisition or merger, no procedures or methods were provided to allow data subjects to opt-out of the transfer, nor were such options communicated to the data subjects." + ] + } + ] + }, + { + "Id": "3.3.4", + "Name": "Transfer of Personal Information Abroad", + "Description": "When transferring personal information abroad, appropriate protective measures such as obtaining consent and disclosing relevant details about the transfer must be established and implemented.", + "Checks": [ + "s3_bucket_cross_region_replication" + ], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.3. Protection Measures When Providing Personal Information", + "Section": "3.3.4 Transfer of Personal Information Abroad", + "AuditChecklist": [ + "When transferring personal information abroad, has the data subject been fully informed of all notification requirements and obtained separate consent, or complied with certification or recognition, as required by law?", + "When informing the data subject about the outsourcing or storage of personal information abroad for the purpose of contract execution, are all necessary details included and communicated appropriately?", + "Has a contract for the transfer of personal information abroad been established, including compliance with personal information protection laws?", + "Are necessary measures being taken to protect personal information when transferring it abroad?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Articles 28-8 (Transfer of Personal Information Abroad), 28-9 (Order to Suspend Transfer of Personal Information Abroad), 28-10 (Reciprocity), 28-11 (Applicable Provisions)", + "Regulations on the Operation of Personal Information Transfer Abroad" + ], + "AuditEvidence": [ + "Consent form for personal information transfer abroad", + "Contract related to personal information transfer abroad", + "Privacy policy", + "Notification or disclosure records regarding outsourcing or storage of personal information abroad" + ], + "NonComplianceCases": [ + "Case 1: Personal information was provided to a foreign company during processing, but separate consent for the transfer of personal information abroad was not obtained, even though the conditions for consent exemption (such as certification or recognition by the recipient country) were not met.", + "Case 2: While using foreign cloud services (foreign regions) for outsourcing and storing personal information, the relevant details, such as the destination country and transfer method, were not disclosed in the privacy policy or communicated to the data subject.", + "Case 3: While obtaining consent for the transfer of personal information abroad, only the name of the recipient (company name) was disclosed, and the destination country was not properly notified." + ] + } + ] + }, + { + "Id": "3.4.1", + "Name": "Destruction of Personal Information", + "Description": "The organization must establish an internal policy regarding retention periods and destruction of personal information. When the retention period has expired or the purpose of processing has been achieved, personal information must be destroyed without delay using methods that ensure safety and completeness.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.4. Protection Measures When Destroying Personal Information", + "Section": "3.4.1 Destruction of Personal Information", + "AuditChecklist": [ + "Has an internal policy been established regarding the retention period and destruction of personal information?", + "Is personal information being destroyed without delay when the processing purpose is achieved or the retention period has expired?", + "Is personal information destroyed using safe methods that prevent recovery or reconstruction?", + "Are records kept of the destruction of personal information and managed properly?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 21 (Destruction of Personal Information)", + "Standards for Ensuring the Safety of Personal Information, Article 13 (Destruction of Personal Information)" + ], + "AuditEvidence": [ + "Regulations regarding the retention period and destruction of personal information", + "Destruction results (e.g., from member databases)", + "Personal information destruction management records" + ], + "NonComplianceCases": [ + "Case 1: When a member withdraws or the purpose of retention is achieved, personal information was destroyed from the member database, but not from associated systems (CRM, DW) where duplicate personal information was stored.", + "Case 2: Personal information collected during a specific event was not destroyed or no destruction policy was established, even after the event ended.", + "Case 3: Personal information collected through a call center (such as call logs, recordings) is retained for three years under the Electronic Commerce Act, but the information was not destroyed even after three years had passed.", + "Case 4: Due to technical limitations, such as using blockchain, it was not possible to completely destroy personal information, so it was anonymized instead. However, the anonymization process was not done properly, allowing partial re-identification of personal information." + ] + } + ] + }, + { + "Id": "3.4.2", + "Name": "Measures When Retaining Personal Information After Purpose Is Achieved", + "Description": "If personal information is retained beyond the retention period or after the purpose of processing has been achieved, as permitted by relevant laws, it must be limited to the minimum necessary items and stored separately from other personal information.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.4. Protection Measures When Destroying Personal Information", + "Section": "3.4.2 Measures When Retaining Personal Information After Purpose Is Achieved", + "AuditChecklist": [ + "When personal information is retained beyond the retention period or after the processing purpose has been achieved, in accordance with relevant laws, is it limited to the minimum necessary period and only the minimum necessary information?", + "When personal information is retained beyond the retention period or after the processing purpose has been achieved, is it stored separately from other personal information?", + "Is personal information that is stored separately processed only within the scope allowed by law?", + "Is access to separately stored personal information limited to the minimum number of personnel?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 21 (Destruction of Personal Information)" + ], + "AuditEvidence": [ + "Regulations regarding the retention period and destruction of personal information", + "Current status of separated databases (table structure, etc.)", + "Access permissions for separated databases" + ], + "NonComplianceCases": [ + "Case 1: Information from withdrawn members was not destroyed but kept for a certain period under the Electronic Commerce Act, with only the flag value changed, and stored in the same table as other member information.", + "Case 2: Records related to consumer complaints and disputes were kept for five years instead of the required three years, due to misinterpretation of legal requirements.", + "Case 3: Although a separate database was set up, access permissions were not appropriately configured, allowing personnel who did not require access to view the separated database.", + "Case 4: Information from withdrawn members was stored separately in accordance with the Electronic Commerce Act, but excessive optional information was also stored, even though there was no legal obligation to do so." + ] + } + ] + }, + { + "Id": "3.5.1", + "Name": "Disclosure of Privacy Policy", + "Description": "A privacy policy must be established to include all necessary information, such as the purpose of personal information processing, in a way that is easy for data subjects to understand. The policy must be disclosed through appropriate methods so that data subjects can easily access it at any time, and it must be continuously updated.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.5. Protection of Data Subject's Rights", + "Section": "3.5.1 Disclosure of Privacy Policy", + "AuditChecklist": [ + "Is the privacy policy written in clear and easy-to-understand language, covering all the contents required by law?", + "Is the privacy policy continuously updated and made easily accessible to data subjects via the internet or other means?", + "When the privacy policy is updated, are the reasons for the changes and the contents of the changes promptly notified, and can the data subjects easily recognize the changes at any time?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 30 (Establishment and Disclosure of Privacy Policy), Article 30-2 (Evaluation and Improvement Recommendations for Privacy Policy)" + ], + "AuditEvidence": [ + "Privacy policy", + "Records of privacy policy amendments (e.g., board notices)" + ], + "NonComplianceCases": [ + "Case 1: The privacy policy discloses information about the collection and provision of personal information, but the actual details differ from what is being collected and provided.", + "Case 2: Changes such as the replacement of the privacy officer or changes in subcontractors have occurred, but these changes have not been reflected in the privacy policy.", + "Case 3: The privacy policy is disclosed, but it is labeled 'Privacy Protection Policy' instead of 'Privacy Policy,' and its visibility is not enhanced with larger font sizes or color to make it easy for data subjects to find.", + "Case 4: Several amendments have been made to the privacy policy, but older versions of the policy are not made available for review.", + "Case 5: Although personal information is retained in compliance with laws such as the Electronic Commerce Act and the Commercial Act, the legal grounds for retention and the retained personal information items are not disclosed in the privacy policy." + ] + } + ] + }, + { + "Id": "3.5.2", + "Name": "Guaranteeing Data Subject's Rights", + "Description": "Procedures must be established and implemented to ensure that data subjects can easily exercise their rights, such as requesting access, rectification, deletion, suspension of processing, objection, or withdrawal of consent, through simpler processes than those used for collecting their information. When a request is received, it must be processed without delay, and records must be kept. Measures such as deletion requests and temporary actions must be taken to prevent the distribution of information that infringes on the rights of others, such as invasion of privacy or defamation.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.5. Protection of Data Subject's Rights", + "Section": "3.5.2 Guaranteeing Data Subject's Rights", + "AuditChecklist": [ + "Are procedures in place to ensure that data subjects or their representatives can exercise their rights (hereinafter referred to as 'Requests for Access, etc.') to access, rectify, delete, or suspend the processing of their personal information in a way that is not more difficult than the process used for collecting it?", + "When data subjects or their representatives submit Requests for Access, etc., are the necessary measures taken within the required time frame?", + "When data subjects withdraw their consent to the collection, use, or provision of their personal information, are the collected personal information and associated data promptly deleted or otherwise handled appropriately?", + "Are appropriate procedures in place to allow data subjects to object to the actions taken regarding their Requests for Access, etc., and are they informed of these procedures?", + "Are records kept of data subjects' Requests for Access, etc., and the resulting actions?", + "When the rights of others, such as privacy or honor, are violated on information networks, does the organization have procedures for the affected individuals to request the deletion of the information from service providers, and are these procedures being implemented?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 34-2 (Deletion or Blocking of Exposed Personal Information), Article 35 (Access to Personal Information), Article 35-2 (Right to Data Portability), Article 36 (Rectification or Deletion of Personal Information), Article 37 (Suspension of Processing, etc.), Article 37-2 (Right of Data Subjects to Contest Automated Decisions), Article 38 (Methods and Procedures for Exercising Rights)", + "Information and Communications Network Act, Article 44 (Protection of Rights in Information Networks), Article 44-2 (Request for Deletion of Information, etc.), Article 44-3 (Temporary Measures)" + ], + "AuditEvidence": [ + "Privacy policy", + "Procedures and forms for handling Requests for Access, etc.", + "Records of actions taken in response to Requests for Access, etc.", + "Procedures for member withdrawal and consent withdrawal" + ], + "NonComplianceCases": [ + "Case 1: The method for requesting access, rectification, deletion, or suspension of personal information is not disclosed in a way that data subjects can easily find.", + "Case 2: There has been no response to access requests for personal information within 10 days, without any valid reason.", + "Case 3: Records of actions taken in response to personal information access requests are not maintained.", + "Case 4: Access notifications are being sent without verifying whether the requester is the data subject or their legitimate representative.", + "Case 5: There has been a failure to respond to rectification or deletion requests within 10 days.", + "Case 6: It was easy to sign up online as a member, but to withdraw membership, additional documents such as ID must be submitted, or in-person visits are required." + ] + } + ] + }, + { + "Id": "3.5.3", + "Name": "Notification to Data Subjects", + "Description": "The organization must identify matters that must be notified to data subjects, such as the use and provision of personal information, and periodically inform the data subjects of these matters.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. Requirements for Each Stage of Personal Information Processing", + "Subdomain": "3.5. Protection of Data Subject's Rights", + "Section": "3.5.3 Notification to Data Subjects", + "AuditChecklist": [ + "If the organization is legally obligated to do so, does it periodically notify data subjects of the use and provision of their personal information, or provide them with access to an information system where they can review such details?", + "Do the notification items regarding the use and provision of personal information include all legally required elements?" + ], + "RelatedRegulations": [ + "Personal Information Protection Act, Article 20-2 (Notification of Use and Provision of Personal Information)" + ], + "AuditEvidence": [ + "Records of notifications regarding the use and provision of personal information", + "Forms and wording used for notifications regarding the use and provision of personal information" + ], + "NonComplianceCases": [ + "Case 1: Although the organization is required to notify data subjects of the use and provision of their personal information, no notifications have been sent during the year despite being obligated due to handling personal information of more than 1 million people on a daily average for the past three months at the end of the previous year.", + "Case 2: Instead of directly notifying individual data subjects, notifications about the use and provision of personal information were made through simple pop-ups or general announcements on the website." + ] + } + ] + } + ] +} diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json new file mode 100644 index 0000000000..5e4897a0fa --- /dev/null +++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json @@ -0,0 +1,4335 @@ +{ + "Framework": "KISA-ISMS-P", + "Version": "2023-korean", + "Provider": "AWS", + "Description": "ISMS-P ์ธ์ฆ์€ ํ•œ๊ตญ์ธํ„ฐ๋„ท์ง„ํฅ์›(KISA)์ด ์ œ์ •ํ•œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„๋ฅผ ๊ธฐ๋ฐ˜์œผ๋กœ, ๋…๋ฆฝ์ ์ธ ์‹ฌ์‚ฌ๊ธฐ๊ด€์ด ๊ธฐ์—…์ด๋‚˜ ์กฐ์ง์˜ ๋ณด์•ˆ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ํ™œ๋™์ด ์ธ์ฆ ๊ธฐ์ค€์„ ์ถฉ์กฑํ•˜๋Š”์ง€ ํ‰๊ฐ€ํ•œ ํ›„ ์ธ์ฆ์„ ๋ถ€์—ฌํ•˜๋Š” ์ œ๋„์ž…๋‹ˆ๋‹ค. ์ด๋ฅผ ํ†ตํ•ด ๊ธฐ์—…๊ณผ ๊ธฐ๊ด€์€ ์ œ๊ณตํ•˜๋Š” ์„œ๋น„์Šค์— ๋Œ€ํ•œ ๋Œ€์ค‘์˜ ์‹ ๋ขฐ๋ฅผ ๋†’์ด๊ณ , ์ ์  ๋ณต์žกํ•ด์ง€๋Š” ์‚ฌ์ด๋ฒ„ ์œ„ํ˜‘์— ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๋˜ํ•œ, ISMS-P๋Š” ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์ฒด๊ณ„์ ์œผ๋กœ ์ˆ˜๋ฆฝํ•˜๊ณ  ์šด์˜ํ•  ์ˆ˜ ์žˆ๋Š” ํฌ๊ด„์ ์ธ ์ง€์นจ์„ ์ œ๊ณตํ•ฉ๋‹ˆ๋‹ค.", + "Requirements": [ + { + "Id": "1.1.1", + "Name": "๊ฒฝ์˜์ง„์˜ ์ฐธ์—ฌ", + "Description": "์ตœ๊ณ ๊ฒฝ์˜์ž๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„์˜ ์ˆ˜๋ฆฝ๊ณผ ์šด์˜ํ™œ๋™ ์ „๋ฐ˜์— ๊ฒฝ์˜์ง„์˜ ์ฐธ์—ฌ๊ฐ€ ์ด๋ฃจ์–ด์งˆ ์ˆ˜ ์žˆ๋„๋ก ๋ณด๊ณ  ๋ฐ ์˜์‚ฌ๊ฒฐ์ • ์ฒด๊ณ„๋ฅผ ์ˆ˜๋ฆฝํ•˜์—ฌ ์šด์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Section": "1.1.1 ๊ฒฝ์˜์ง„์˜ ์ฐธ์—ฌ", + "AuditChecklist": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„์˜ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜ํ™œ๋™ ์ „๋ฐ˜์— ๊ฒฝ์˜์ง„์˜ ์ฐธ์—ฌ๊ฐ€ ์ด๋ฃจ์–ด์งˆ ์ˆ˜ ์žˆ๋„๋ก ๋ณด๊ณ  ๋ฐ ์˜์‚ฌ๊ฒฐ์ • ๋“ฑ์˜ ์ฑ…์ž„๊ณผ ์—ญํ• ์„ ๋ฌธ์„œํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฒฝ์˜์ง„์ด ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์— ๊ด€ํ•œ ์˜์‚ฌ๊ฒฐ์ •์— ์ ๊ทน์ ์œผ๋กœ ์ฐธ์—ฌํ•  ์ˆ˜ ์žˆ๋Š” ๋ณด๊ณ , ๊ฒ€ํ†  ๋ฐ ์Šน์ธ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ณด๊ณ  ์ฒด๊ณ„(์˜์‚ฌ์†Œํ†ต๊ณ„ํš ๋“ฑ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ ํšŒ์˜๋ก", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจ(๊ฒฝ์˜์ง„ ์Šน์ธ๋‚ด์—ญ ํฌํ•จ)", + "์ •๋ณด๋ณดํ˜ธ๊ณ„ํš ๋ฐ ๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš(๊ฒฝ์˜์ง„ ์Šน์ธ๋‚ด์—ญ ํฌํ•จ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง๋„" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…์„œ์— ๋ถ„๊ธฐ๋ณ„๋กœ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ˜„ํ™ฉ์„ ๊ฒฝ์˜์ง„์—๊ฒŒ ๋ณด๊ณ ํ•˜๋„๋ก ๋ช…์‹œํ•˜์˜€์œผ๋‚˜, ์žฅ๊ธฐ๊ฐ„ ๊ด€๋ จ ๋ณด๊ณ ๋ฅผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ค‘์š” ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™(์œ„ํ—˜ํ‰๊ฐ€, ์œ„ํ—˜์ˆ˜์šฉ์ˆ˜์ค€ ๊ฒฐ์ •, ์ •๋ณด๋ณดํ˜ธ๋Œ€์ฑ… ๋ฐ ์ดํ–‰๊ณ„ํš ๊ฒ€ํ† , ์ •๋ณด๋ณดํ˜ธ๋Œ€์ฑ… ์ดํ–‰๊ฒฐ๊ณผ ๊ฒ€ํ† , ๋ณด์•ˆ๊ฐ์‚ฌ ๋“ฑ)์„ ์ˆ˜ํ–‰ํ•˜๋ฉด์„œ ๊ด€๋ จ ํ™œ๋™๊ด€๋ จ ๋ณด๊ณ , ์Šน์ธ ๋“ฑ ์˜์‚ฌ๊ฒฐ์ •์— ๊ฒฝ์˜์ง„ ๋˜๋Š” ๊ฒฝ์˜์ง„์˜ ๊ถŒํ•œ์„ ์œ„์ž„๋ฐ›์€ ์ž๊ฐ€ ์ฐธ์—ฌํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜ ๊ด€๋ จ ์ฆ๊ฑฐ์ž๋ฃŒ๊ฐ€ ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.1.2", + "Name": "์ตœ๊ณ ์ฑ…์ž„์ž์˜ ์ง€์ •", + "Description": "์ตœ๊ณ ๊ฒฝ์˜์ž๋Š” ์ •๋ณด๋ณดํ˜ธ ์—…๋ฌด๋ฅผ ์ด๊ด„ํ•˜๋Š” ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์—…๋ฌด๋ฅผ ์ด๊ด„ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฑ…์ž„์ž๋ฅผ ์˜ˆ์‚ฐยท์ธ๋ ฅ ๋“ฑ ์ž์›์„ ํ• ๋‹นํ•  ์ˆ˜ ์žˆ๋Š” ์ž„์›๊ธ‰์œผ๋กœ ์ง€์ •ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Section": "1.1.2 ์ตœ๊ณ ์ฑ…์ž„์ž์˜ ์ง€์ •", + "AuditChecklist": [ + "์ตœ๊ณ ๊ฒฝ์˜์ž๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฒ˜๋ฆฌ์— ๊ด€ํ•œ ์—…๋ฌด๋ฅผ ์ด๊ด„ํ•˜์—ฌ ์ฑ…์ž„์งˆ ์ตœ๊ณ ์ฑ…์ž„์ž๋ฅผ ๊ณต์‹์ ์œผ๋กœ ์ง€์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž๋Š” ์˜ˆ์‚ฐ, ์ธ๋ ฅ ๋“ฑ ์ž์›์„ ํ• ๋‹นํ•  ์ˆ˜ ์žˆ๋Š” ์ž„์›๊ธ‰์œผ๋กœ ์ง€์ •ํ•˜๊ณ  ์žˆ์œผ๋ฉฐ, ๊ด€๋ จ ๋ฒ•๋ น์— ๋”ฐ๋ฅธ ์ž๊ฒฉ์š”๊ฑด์„ ์ถฉ์กฑํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด), ์ œ31์กฐ(๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์ง€์ •)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ45์กฐ์˜3(์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž์˜ ์ง€์ • ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž ์ž„๋ช…๊ด€๋ จ ์ž๋ฃŒ(์ธ์‚ฌ๋ช…๋ น, ์ธ์‚ฌ์นด๋“œ ๋“ฑ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง๋„", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจ", + "์ง๋ฌด๊ธฐ์ˆ ์„œ(์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์—ญํ•  ๋ฐ ์ฑ…์ž„์— ๊ด€ํ•œ ์‚ฌํ•ญ)", + "์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ์‹ ๊ณ  ๋‚ด์—ญ", + "๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš(๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž ์ง€์ •์— ๊ด€ํ•œ ์‚ฌํ•ญ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณดํ†ต์‹ ๋ง๋ฒ•์— ๋”ฐ๋ฅธ ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ์ง€์ • ๋ฐ ์‹ ๊ณ  ์˜๋ฌด ๋Œ€์ƒ์ž์ž„์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž๋ฅผ ์ง€์ • ๋ฐ ์‹ ๊ณ ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์™€ ๊ด€๋ จ๋œ ์‹ค์งˆ์ ์ธ ๊ถŒํ•œ ๋ฐ ์ง€์œ„๋ฅผ ๋ณด์œ ํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ์ธ์›์„ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ์ฑ…์ž„์ž๋กœ ์ง€์ •ํ•˜๊ณ  ์žˆ์–ด, ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์— ๊ด€ํ•œ ์—…๋ฌด๋ฅผ ์ด๊ด„ํ•ด์„œ ์ฑ…์ž„์งˆ ์ˆ˜ ์žˆ๋‹ค๊ณ  ๋ณด๊ธฐ ์–ด๋ ค์šด ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์กฐ์ง๋„์ƒ์— ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž๋ฅผ ๋ช…์‹œํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ธ์‚ฌ๋ฐœ๋ น ๋“ฑ์˜ ๊ณต์‹์ ์ธ ์ง€์ •์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ISMS ์ธ์ฆ ์˜๋ฌด๋Œ€์ƒ์ž์ด๋ฉด์„œ ์ „๋…„๋„ ๋ง ๊ธฐ์ค€ ์ž์‚ฐ์ด์•ก์ด 5์ฒœ์–ต ์›์„ ์ดˆ๊ณผํ•œ ์ •๋ณดํ†ต์‹ ์„œ๋น„์Šค ์ œ๊ณต์ž์ด์ง€๋งŒ ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž๊ฐ€ CIO๋ฅผ ๊ฒธ์งํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.1.3", + "Name": "์กฐ์ง ๊ตฌ์„ฑ", + "Description": "์ตœ๊ณ ๊ฒฝ์˜์ž๋Š” ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์˜ ํšจ๊ณผ์  ๊ตฌํ˜„์„ ์œ„ํ•œ ์‹ค๋ฌด์กฐ์ง, ์กฐ์ง ์ „๋ฐ˜์˜ ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ฃผ์š” ์‚ฌํ•ญ์„ ๊ฒ€ํ†  ๋ฐ ์˜๊ฒฐํ•  ์ˆ˜ ์žˆ๋Š” ์œ„์›ํšŒ, ์ „์‚ฌ์  ๋ณดํ˜ธํ™œ๋™์„ ์œ„ํ•œ ๋ถ€์„œ๋ณ„ ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋‹ด๋‹น์ž๋กœ ๊ตฌ์„ฑ๋œ ํ˜‘์˜์ฒด๋ฅผ ๊ตฌ์„ฑํ•˜์—ฌ ์šด์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Section": "1.1.3 ์กฐ์ง ๊ตฌ์„ฑ", + "AuditChecklist": [ + "์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์—…๋ฌด๋ฅผ ์ง€์›ํ•˜๊ณ  ์กฐ์ง์˜ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์„ ์ฒด๊ณ„์ ์œผ๋กœ ์ดํ–‰ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ „๋ฌธ์„ฑ์„ ๊ฐ–์ถ˜ ์‹ค๋ฌด์กฐ์ง์„ ๊ตฌ์„ฑํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์กฐ์ง ์ „๋ฐ˜์— ๊ฑธ์นœ ์ค‘์š”ํ•œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ์‚ฌํ•ญ์— ๋Œ€ํ•˜์—ฌ ๊ฒ€ํ† , ์Šน์ธ ๋ฐ ์˜์‚ฌ๊ฒฐ์ •์„ ํ•  ์ˆ˜ ์žˆ๋Š” ์œ„์›ํšŒ๋ฅผ ๊ตฌ์„ฑํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ „์‚ฌ์  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์„ ์œ„ํ•˜์—ฌ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋‹ด๋‹น์ž ๋ฐ ๋ถ€์„œ๋ณ„ ๋‹ด๋‹น์ž๋กœ ๊ตฌ์„ฑ๋œ ์‹ค๋ฌด ํ˜‘์˜์ฒด๋ฅผ ๊ตฌ์„ฑํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ ๊ทœ์ •ยทํšŒ์˜๋ก", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์‹ค๋ฌด ํ˜‘์˜์ฒด ๊ทœ์ •ยทํšŒ์˜๋ก", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง๋„", + "๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš", + "์ง๋ฌด๊ธฐ์ˆ ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ๋ฅผ ๊ตฌ์„ฑํ•˜์˜€์œผ๋‚˜, ์ž„์› ๋“ฑ ๊ฒฝ์˜์ง„์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š๊ณ  ์‹ค๋ฌด ๋ถ€์„œ์˜ ์žฅ์œผ๋กœ ๊ตฌ์„ฑ๋˜์–ด ์žˆ์–ด ์กฐ์ง์˜ ์ค‘์š” ์ •๋ณด ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์— ๊ด€ํ•œ ์‚ฌํ•ญ์„ ๊ฒฐ์ •ํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ์ง€์นจ์— ๋”ฐ๋ผ ์ค‘์š” ์ •๋ณด์ฒ˜๋ฆฌ ๋ถ€์„œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ ๋ถ€์„œ์˜ ์žฅ(ํŒ€์žฅ๊ธ‰)์œผ๋กœ ๊ตฌ์„ฑ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์‹ค๋ฌด ํ˜‘์˜์ฒด๋ฅผ ๊ตฌ์„ฑํ•˜์˜€์œผ๋‚˜, ์žฅ๊ธฐ๊ฐ„ ์šด์˜ ์‹ค์ ์ด ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ๋ฅผ ๊ฐœ์ตœํ•˜์˜€์œผ๋‚˜, ์—ฐ๊ฐ„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ณ„ํš ๋ฐ ๊ต์œก ๊ณ„ํš, ์˜ˆ์‚ฐ ๋ฐ ์ธ๋ ฅ ๋“ฑ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์— ๊ด€ํ•œ ์ฃผ์š” ์‚ฌํ•ญ์ด ๊ฒ€ํ†  ๋ฐ ์˜์‚ฌ๊ฒฐ์ •์ด ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์‹ฌ์˜ยท์˜๊ฒฐ์„ ์œ„ํ•ด ์ •๋ณด๋ณดํ˜ธ์œ„์›ํšŒ๋ฅผ ๊ตฌ์„ฑํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์šด์˜ ๋ฐ IT๋ณด์•ˆ ๊ด€๋ จ ์กฐ์ง๋งŒ ์ฐธ์—ฌํ•˜๊ณ  ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์กฐ์ง์€ ์ฐธ์—ฌํ•˜์ง€ ์•Š๊ณ  ์žˆ์–ด ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์— ๊ด€ํ•œ ์‚ฌํ•ญ์„ ๊ฒฐ์ •ํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.1.4", + "Name": "๋ฒ”์œ„ ์„ค์ •", + "Description": "์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค์™€ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ํ˜„ํ™ฉ ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„๋ฅผ ์„ค์ •ํ•˜๊ณ , ๊ด€๋ จ๋œ ์„œ๋น„์Šค๋ฅผ ๋น„๋กฏํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ์—…๋ฌด์™€ ์กฐ์ง, ์ž์‚ฐ, ๋ฌผ๋ฆฌ์  ์œ„์น˜ ๋“ฑ์„ ๋ฌธ์„œํ™”ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Section": "1.1.4 ๋ฒ”์œ„ ์„ค์ •", + "AuditChecklist": [ + "์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์— ์˜ํ–ฅ์„ ์ค„ ์ˆ˜ ์žˆ๋Š” ํ•ต์‹ฌ์ž์‚ฐ์„ ํฌํ•จํ•˜๋„๋ก ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„๋ฅผ ์„ค์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •์˜๋œ ๋ฒ”์œ„ ๋‚ด์—์„œ ์˜ˆ์™ธ์‚ฌํ•ญ์ด ์žˆ์„ ๊ฒฝ์šฐ ๋ช…ํ™•ํ•œ ์‚ฌ์œ  ๋ฐ ๊ด€๋ จ์ž ํ˜‘์˜ยท์ฑ…์ž„์ž ์Šน์ธ ๋“ฑ ๊ด€๋ จ ๊ทผ๊ฑฐ๋ฅผ ๊ธฐ๋กยท๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„๋ฅผ ๋ช…ํ™•ํžˆ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ จ๋œ ๋‚ด์šฉ(์ฃผ์š” ์„œ๋น„์Šค ๋ฐ ์—…๋ฌด ํ˜„ํ™ฉ, ์ •๋ณด์‹œ์Šคํ…œ ๋ชฉ๋ก, ๋ฌธ์„œ๋ชฉ๋ก ๋“ฑ)์ด ํฌํ•จ๋œ ๋ฌธ์„œ๋ฅผ ์ž‘์„ฑํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ์ •์˜์„œ", + "์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ชฉ๋ก", + "๋ฌธ์„œ ๋ชฉ๋ก", + "์„œ๋น„์Šค ํ๋ฆ„๋„", + "๊ฐœ์ธ์ •๋ณด ํ๋ฆ„๋„", + "์ „์‚ฌ ์กฐ์ง๋„", + "์‹œ์Šคํ…œ ๋ฐ ๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๊ฐœ๋ฐœ์—…๋ฌด์— ๊ด€๋ จํ•œ ๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ์‹œ์Šคํ…œ, ์™ธ์ฃผ์—…์ฒด์ง์›, PC, ํ…Œ์ŠคํŠธ์šฉ ๋‹จ๋ง๊ธฐ ๋“ฑ์ด ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„์—์„œ ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„๋กœ ์„ค์ •๋œ ์„œ๋น„์Šค ๋˜๋Š” ์‚ฌ์—…์— ๋Œ€ํ•˜์—ฌ ์ค‘์š” ์˜์‚ฌ๊ฒฐ์ •์ž ์—ญํ• ์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š” ์ž„์ง์›, ์‚ฌ์—…๋ถ€์„œ ๋“ฑ์˜ ํ•ต์‹ฌ ์กฐ์ง(์ธ๋ ฅ)์„ ์ธ์ฆ๋ฒ”์œ„์— ํฌํ•จํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๊ฐœ๋ฐœ์—…๋ฌด์— ๊ด€๋ จํ•œ ๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ์‹œ์Šคํ…œ, ๊ฐœ๋ฐœ์ž PC, ํ…Œ์ŠคํŠธ์šฉ ๋‹จ๋ง๊ธฐ, ๊ฐœ๋ฐœ์กฐ์ง ๋“ฑ์ด ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„์—์„œ ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.1.5", + "Name": "์ •์ฑ… ์ˆ˜๋ฆฝ", + "Description": "์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ๋ฅผ ์ˆ˜๋ฆฝยท์ž‘์„ฑํ•˜๋ฉฐ, ์ด๋•Œ ์กฐ์ง์˜ ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ฐฉ์นจ ๋ฐ ๋ฐฉํ–ฅ์„ ๋ช…ํ™•ํ•˜๊ฒŒ ์ œ์‹œํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ์ •์ฑ…๊ณผ ์‹œํ–‰๋ฌธ์„œ๋Š” ๊ฒฝ์˜์ง„์˜ ์Šน์ธ์„ ๋ฐ›๊ณ , ์ž„์ง์› ๋ฐ ๊ด€๋ จ์ž์—๊ฒŒ ์ดํ•ดํ•˜๊ธฐ ์‰ฌ์šด ํ˜•ํƒœ๋กœ ์ „๋‹ฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Section": "1.1.5 ์ •์ฑ… ์ˆ˜๋ฆฝ", + "AuditChecklist": [ + "์กฐ์ง์ด ์ˆ˜ํ–‰ํ•˜๋Š” ๋ชจ๋“  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์˜ ๊ทผ๊ฑฐ๋ฅผ ํฌํ•จํ•˜๋Š” ์ตœ์ƒ์œ„ ์ˆ˜์ค€์˜ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…์˜ ์‹œํ–‰์„ ์œ„ํ•˜์—ฌ ํ•„์š”ํ•œ ์„ธ๋ถ€์ ์ธ ๋ฐฉ๋ฒ•, ์ ˆ์ฐจ, ์ฃผ๊ธฐ ๋“ฑ์„ ๊ทœ์ •ํ•œ ์ง€์นจ, ์ ˆ์ฐจ, ๋งค๋‰ด์–ผ ๋“ฑ์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์‹œํ–‰๋ฌธ์„œ์˜ ์ œยท๊ฐœ์ • ์‹œ ์ตœ๊ณ ๊ฒฝ์˜์ž ๋˜๋Š” ์ตœ๊ณ ๊ฒฝ์˜์ž๋กœ๋ถ€ํ„ฐ ๊ถŒํ•œ์„ ์œ„์ž„๋ฐ›์€ ์ž์˜ ์Šน์ธ์„ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์‹œํ–‰๋ฌธ์„œ์˜ ์ตœ์‹ ๋ณธ์„ ๊ด€๋ จ ์ž„์ง์›์—๊ฒŒ ์ดํ•ดํ•˜๊ธฐ ์‰ฌ์šด ํ˜•ํƒœ๋กœ ์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจยท์ ˆ์ฐจ์„œ(์ œยท๊ฐœ์ • ๋‚ด์—ญ ํฌํ•จ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจ์ ˆ์ฐจ์„œ ์ œยท๊ฐœ์ • ์‹œ ์ดํ•ด๊ด€๊ณ„์ž ๊ฒ€ํ†  ํšŒ์˜๋ก", + "๊ฐœ์ธ์ •๋ณด ๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจ ์ œยท๊ฐœ์ • ๊ณต์ง€๋‚ด์—ญ(๊ทธ๋ฃน์›จ์–ด, ์‚ฌ๋‚ด๊ฒŒ์‹œํŒ ๋“ฑ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ ํšŒ์˜๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ๊ทœ์ •์— ๋”ฐ๋ฅด๋ฉด ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…์„œ ์ œยท๊ฐœ์ • ์‹œ์—๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ์˜ ์˜๊ฒฐ์„ ๊ฑฐ์น˜๋„๋ก ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ตœ๊ทผ ์ •์ฑ…์„œ ๊ฐœ์ • ์‹œ ์œ„์›ํšŒ์— ์•ˆ๊ฑด์œผ๋กœ ์ƒ์ •ํ•˜์ง€ ์•Š๊ณ  ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์Šน์ธ์„ ๊ทผ๊ฑฐ๋กœ๋งŒ ๊ฐœ์ •ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ… ๋ฐ ์ง€์นจ์„œ๊ฐ€ ์ตœ๊ทผ์— ๊ฐœ์ •๋˜์—ˆ์œผ๋‚˜, ํ•ด๋‹น ์‚ฌํ•ญ์ด ๊ด€๋ จ ๋ถ€์„œ ๋ฐ ์ž„์ง์›์—๊ฒŒ ๊ณต์œ ยท์ „๋‹ฌ๋˜์ง€ ์•Š์•„ ์ผ๋ถ€ ๋ถ€์„œ์—์„œ๋Š” ๊ตฌ๋ฒ„์ „์˜ ์ง€์นจ์„œ๋ฅผ ๊ธฐ์ค€์œผ๋กœ ์—…๋ฌด๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ… ๋ฐ ์ง€์นจ์„œ๋ฅผ ๋ณด์•ˆ๋ถ€์„œ์—์„œ๋งŒ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๊ณ , ์ž„์ง์›์ด ์—ด๋žŒํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ฒŒ์‹œํŒ, ๋ฌธ์„œ ๋“ฑ์˜ ๋ฐฉ๋ฒ•์œผ๋กœ ์ œ๊ณตํ•˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.1.6", + "Name": "์ž์› ํ• ๋‹น", + "Description": "์ตœ๊ณ ๊ฒฝ์˜์ž๋Š” ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ถ„์•ผ๋ณ„ ์ „๋ฌธ์„ฑ์„ ๊ฐ–์ถ˜ ์ธ๋ ฅ์„ ํ™•๋ณดํ•˜๊ณ , ๊ด€๋ฆฌ์ฒด๊ณ„์˜ ํšจ๊ณผ์  ๊ตฌํ˜„๊ณผ ์ง€์†์  ์šด์˜์„ ์œ„ํ•œ ์˜ˆ์‚ฐ ๋ฐ ์ž์›์„ ํ• ๋‹นํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.1. ๊ด€๋ฆฌ์ฒด๊ณ„", + "Section": "1.1.6 ์ž์› ํ• ๋‹น", + "AuditChecklist": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ถ„์•ผ๋ณ„ ์ „๋ฌธ์„ฑ์„ ๊ฐ–์ถ˜ ์ธ๋ ฅ์„ ํ™•๋ณดํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„์˜ ํšจ๊ณผ์  ๊ตฌํ˜„๊ณผ ์ง€์†์  ์šด์˜์„ ์œ„ํ•˜์—ฌ ํ•„์š”ํ•œ ์ž์›์„ ํ‰๊ฐ€ํ•˜์—ฌ ํ•„์š”ํ•œ ์˜ˆ์‚ฐ๊ณผ ์ธ๋ ฅ์„ ์ง€์›ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—ฐ๋„๋ณ„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์—…๋ฌด ์„ธ๋ถ€์ถ”์ง„ ๊ณ„ํš์„ ์ˆ˜๋ฆฝยท์‹œํ–‰ํ•˜๊ณ , ๊ทธ ์ถ”์ง„๊ฒฐ๊ณผ์— ๋Œ€ํ•œ ์‹ฌ์‚ฌ๋ถ„์„ยทํ‰๊ฐ€๋ฅผ ์‹ค์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™ ์—ฐ๊ฐ„ ์ถ”์ง„๊ณ„ํš์„œ(์˜ˆ์‚ฐ ๋ฐ ์ธ๋ ฅ์šด์˜๊ณ„ํš)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™ ๊ฒฐ๊ณผ ๋ณด๊ณ ์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํˆฌ์ž ๋‚ด์—ญ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง๋„" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง์„ ๊ตฌ์„ฑํ•˜๋Š”๋ฐ, ๋ถ„์•ผ๋ณ„ ์ „๋ฌธ์„ฑ์„ ๊ฐ–์ถ˜ ์ธ๋ ฅ์ด ์•„๋‹Œ ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋˜๋Š” IT ๊ด€๋ จ ์ „๋ฌธ์„ฑ์ด ์—†๋Š” ์ธ์›์œผ๋กœ๋งŒ ๋ณด์•ˆ์ธ๋ ฅ์„ ๊ตฌ์„ฑํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ๊ธฐ์ˆ ์ ยท๊ด€๋ฆฌ์  ๋ณดํ˜ธ์กฐ์น˜์˜ ์š”๊ฑด์„ ๊ฐ–์ถ”๊ธฐ ์œ„ํ•œ ์ตœ์†Œํ•œ์˜ ๋ณด์•ˆ ์†”๋ฃจ์…˜ ๋„์ž…, ์•ˆ์ „์กฐ์น˜ ์ ์šฉ ๋“ฑ์„ ์œ„ํ•œ ๋น„์šฉ์„ ์ตœ๊ณ ๊ฒฝ์˜์ž๊ฐ€ ์ง€์›ํ•˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ธ์ฆ์„ ์ทจ๋“ํ•œ ์ดํ›„์— ์ธ๋ ฅ๊ณผ ์˜ˆ์‚ฐ ์ง€์›์„ ๋Œ€ํญ ์ค„์ด๊ณ  ๊ธฐ์กด ์ธ๋ ฅ์„ ๋‹ค๋ฅธ ๋ถ€์„œ๋กœ ๋ฐฐ์น˜ํ•˜๊ฑฐ๋‚˜ ์ผ๋ถ€ ์˜ˆ์‚ฐ์„ ๋‹ค๋ฅธ ์šฉ๋„๋กœ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.2.1", + "Name": "์ •๋ณด์ž์‚ฐ ์‹๋ณ„", + "Description": "์กฐ์ง์˜ ์—…๋ฌดํŠน์„ฑ์— ๋”ฐ๋ผ ์ •๋ณด์ž์‚ฐ ๋ถ„๋ฅ˜๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด ๋ชจ๋“  ์ •๋ณด์ž์‚ฐ์„ ์‹๋ณ„ยท๋ถ„๋ฅ˜ํ•˜๊ณ , ์ค‘์š”๋„๋ฅผ ์‚ฐ์ •ํ•œ ํ›„ ๊ทธ ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "organizations_tags_policies_enabled_and_attached", + "organizations_account_part_of_organizations", + "macie_is_enabled", + "config_recorder_all_regions_enabled", + "resourceexplorer2_indexes_found" + ], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Section": "1.2.1 ์ •๋ณด์ž์‚ฐ ์‹๋ณ„", + "AuditChecklist": [ + "์ •๋ณด์ž์‚ฐ์˜ ๋ถ„๋ฅ˜๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด์˜ ๋ชจ๋“  ์ž์‚ฐ์„ ์‹๋ณ„ํ•˜์—ฌ ๋ชฉ๋ก์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‹๋ณ„๋œ ์ •๋ณด์ž์‚ฐ์— ๋Œ€ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ๋ฐ ์—…๋ฌด์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ์ค‘์š”๋„๋ฅผ ๊ฒฐ์ •ํ•˜๊ณ  ๋ณด์•ˆ๋“ฑ๊ธ‰์„ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๊ธฐ์ ์œผ๋กœ ์ •๋ณด์ž์‚ฐ ํ˜„ํ™ฉ์„ ์กฐ์‚ฌํ•˜์—ฌ ์ •๋ณด์ž์‚ฐ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ์œ ์ง€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ž์‚ฐ๋ถ„๋ฅ˜ ๊ธฐ์ค€", + "์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ž์‚ฐ๋ชฉ๋ก(์ž์‚ฐ๊ด€๋ฆฌ์‹œ์Šคํ…œ ํ™”๋ฉด)", + "์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณด์•ˆ๋“ฑ๊ธ‰", + "์ž์‚ฐ์‹ค์‚ฌ ๋‚ด์—ญ", + "์œ„ํ—˜๋ถ„์„ ๋ณด๊ณ ์„œ(์ž์‚ฐ์‹๋ณ„ ๋‚ด์—ญ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด์˜ ์ž์‚ฐ ๋ชฉ๋ก์—์„œ ์ค‘์š”์ •๋ณด ์ทจ๊ธ‰์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ทจ๊ธ‰์ž PC๋ฅผ ํ†ต์ œํ•˜๋Š” ๋ฐ ์‚ฌ์šฉ๋˜๋Š” ์ถœ๋ ฅ๋ฌผ ๋ณด์•ˆ, ๋ฌธ์„œ์•”ํ˜ธํ™”, USB๋งค์ฒด์ œ์–ด ๋“ฑ์˜ ๋‚ด๋ถ€์ •๋ณด ์œ ์ถœํ†ต์ œ ์‹œ์Šคํ…œ์ด ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด์—์„œ ์ œ3์ž๋กœ๋ถ€ํ„ฐ ์ œ๊ณต๋ฐ›์€ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ์žˆ์œผ๋‚˜, ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•œ ์ž์‚ฐ ์‹๋ณ„์ด ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ์ง€์นจ์— ๋ช…์‹œ๋œ ์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณด์•ˆ๋“ฑ๊ธ‰ ๋ถ„๋ฅ˜ ๊ธฐ์ค€๊ณผ ์ž์‚ฐ๊ด€๋ฆฌ ๋Œ€์žฅ์˜ ๋ถ„๋ฅ˜ ๊ธฐ์ค€์ด ์ผ์น˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์˜จํ”„๋ ˆ๋ฏธ์Šค ์ž์‚ฐ์— ๋Œ€ํ•ด์„œ๋Š” ์‹๋ณ„์ด ์ด๋ฃจ์–ด์กŒ์œผ๋‚˜, ์™ธ๋ถ€์— ์œ„ํƒํ•œ IT ์„œ๋น„์Šค(์›นํ˜ธ์ŠคํŒ…, ์„œ๋ฒ„ํ˜ธ์ŠคํŒ…, ํด๋ผ์šฐ๋“œ ๋“ฑ)์— ๋Œ€ํ•œ ์ž์‚ฐ ์‹๋ณ„์ด ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ(๋‹จ, ์ธ์ฆ๋ฒ”์œ„ ๋‚ด)", + "์‚ฌ๋ก€ 5 : ๊ณ ์œ ์‹๋ณ„์ •๋ณด ๋“ฑ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ €์žฅํ•˜๊ณ  ์žˆ๋Š” ๋ฐฑ์—…์„œ๋ฒ„์˜ ๊ธฐ๋ฐ€์„ฑ ๋“ฑ๊ธ‰์„ (ํ•˜)๋กœ ์‚ฐ์ •ํ•˜๋Š” ๋“ฑ ์ •๋ณด์ž์‚ฐ ์ค‘์š”๋„ ํ‰๊ฐ€์˜ ํ•ฉ๋ฆฌ์„ฑ ๋ฐ ์‹ ๋ขฐ์„ฑ์ด ๋ฏธํกํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.2.2", + "Name": "ํ˜„ํ™ฉ ๋ฐ ํ๋ฆ„๋ถ„์„", + "Description": "๊ด€๋ฆฌ์ฒด๊ณ„ ์ „ ์˜์—ญ์— ๋Œ€ํ•œ ์ •๋ณด์„œ๋น„์Šค ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ํ˜„ํ™ฉ์„ ๋ถ„์„ํ•˜๊ณ  ์—…๋ฌด ์ ˆ์ฐจ์™€ ํ๋ฆ„์„ ํŒŒ์•…ํ•˜์—ฌ ๋ฌธ์„œํ™”ํ•˜๋ฉฐ, ์ด๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ ์ตœ์‹ ์„ฑ์„ ์œ ์ง€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Section": "1.2.2 ํ˜„ํ™ฉ ๋ฐ ํ๋ฆ„๋ถ„์„", + "AuditChecklist": [ + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ „ ์˜์—ญ์— ๋Œ€ํ•œ ์ •๋ณด์„œ๋น„์Šค ํ˜„ํ™ฉ์„ ์‹๋ณ„ํ•˜๊ณ  ์—…๋ฌด ์ ˆ์ฐจ์™€ ํ๋ฆ„์„ ํŒŒ์•…ํ•˜์—ฌ ๋ฌธ์„œํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ํ˜„ํ™ฉ์„ ์‹๋ณ„ํ•˜๊ณ  ๊ฐœ์ธ์ •๋ณด์˜ ํ๋ฆ„์„ ํŒŒ์•…ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„๋„ ๋“ฑ์œผ๋กœ ๋ฌธ์„œํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์„œ๋น„์Šค ๋ฐ ์—…๋ฌด, ์ •๋ณด์ž์‚ฐ ๋“ฑ์˜ ๋ณ€ํ™”์— ๋”ฐ๋ฅธ ์—…๋ฌด์ ˆ์ฐจ ๋ฐ ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ ํ๋ฆ„๋„ ๋“ฑ ๊ด€๋ จ ๋ฌธ์„œ์˜ ์ตœ์‹ ์„ฑ์„ ์œ ์ง€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด์„œ๋น„์Šค ํ˜„ํ™ฉํ‘œ", + "์ •๋ณด์„œ๋น„์Šค ์—…๋ฌดํ๋ฆ„ํ‘œยท์—…๋ฌดํ๋ฆ„๋„", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ํ˜„ํ™ฉํ‘œ(ISMS-P ์ธ์ฆ์ธ ๊ฒฝ์šฐ)", + "๊ฐœ์ธ์ •๋ณด ํ๋ฆ„ํ‘œยทํ๋ฆ„๋„(ISMS-P ์ธ์ฆ์ธ ๊ฒฝ์šฐ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด ์ฃผ์š” ์„œ๋น„์Šค์˜ ์—…๋ฌด ์ ˆ์ฐจยทํ๋ฆ„ ๋ฐ ํ˜„ํ™ฉ์— ๋ฌธ์„œํ™”๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„๋„๋ฅผ ์ž‘์„ฑํ•˜์˜€์œผ๋‚˜, ์‹ค์ œ ๊ฐœ์ธ์ •๋ณด์˜ ํ๋ฆ„๊ณผ ์ƒ์ดํ•œ ๋ถ€๋ถ„์ด ๋‹ค์ˆ˜ ์กด์žฌํ•˜๊ฑฐ๋‚˜ ์ค‘์š”ํ•œ ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ตœ์ดˆ ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„๋„ ์ž‘์„ฑ ์ดํ›„์— ํ˜„ํ–‰ํ™”๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์•„ ๋ณ€ํ™”๋œ ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„์ด ํ๋ฆ„๋„์— ๋ฐ˜์˜๋˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.2.3", + "Name": "์œ„ํ—˜ ํ‰๊ฐ€", + "Description": "์กฐ์ง์˜ ๋Œ€๋‚ด์™ธ ํ™˜๊ฒฝ๋ถ„์„์„ ํ†ตํ•˜์—ฌ ์œ ํ˜•๋ณ„ ์œ„ํ˜‘์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๊ณ  ์กฐ์ง์— ์ ํ•ฉํ•œ ์œ„ํ—˜ ํ‰๊ฐ€ ๋ฐฉ๋ฒ•์„ ์„ ์ •ํ•˜์—ฌ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ „ ์˜์—ญ์— ๋Œ€ํ•˜์—ฌ ์—ฐ 1ํšŒ ์ด์ƒ ์œ„ํ—˜์„ ํ‰๊ฐ€ํ•˜๋ฉฐ, ์ˆ˜์šฉํ•  ์ˆ˜ ์žˆ๋Š” ์œ„ํ—˜์€ ๊ฒฝ์˜์ง„์˜ ์Šน์ธ์„ ๋ฐ›์•„ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Section": "1.2.3 ์œ„ํ—˜ ํ‰๊ฐ€", + "AuditChecklist": [ + "์กฐ์ง ๋˜๋Š” ์„œ๋น„์Šค์˜ ํŠน์„ฑ์— ๋”ฐ๋ผ ๋‹ค์–‘ํ•œ ์ธก๋ฉด์—์„œ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ๋Š” ์œ„ํ—˜์„ ์‹๋ณ„ํ•˜๊ณ  ํ‰๊ฐ€ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์œ„ํ—˜๊ด€๋ฆฌ ๋ฐฉ๋ฒ• ๋ฐ ์ ˆ์ฐจ(์ˆ˜ํ–‰์ธ๋ ฅ, ๊ธฐ๊ฐ„, ๋Œ€์ƒ, ๋ฐฉ๋ฒ•, ์˜ˆ์‚ฐ ๋“ฑ)๋ฅผ ๊ตฌ์ฒดํ™”ํ•œ ์œ„ํ—˜๊ด€๋ฆฌ๊ณ„ํš์„ ๋งค๋…„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์œ„ํ—˜๊ด€๋ฆฌ๊ณ„ํš์— ๋”ฐ๋ผ ์—ฐ 1ํšŒ ์ด์ƒ ์ •๊ธฐ์ ์œผ๋กœ ๋˜๋Š” ํ•„์š”ํ•œ ์‹œ์ ์— ์œ„ํ—˜ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์กฐ์ง์—์„œ ์ˆ˜์šฉ ๊ฐ€๋Šฅํ•œ ๋ชฉํ‘œ ์œ„ํ—˜์ˆ˜์ค€์„ ์ •ํ•˜๊ณ , ๊ทธ ์ˆ˜์ค€์„ ์ดˆ๊ณผํ•˜๋Š” ์œ„ํ—˜์„ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์œ„ํ—˜์‹๋ณ„ ๋ฐ ํ‰๊ฐ€ ๊ฒฐ๊ณผ๋ฅผ ๊ฒฝ์˜์ง„์—๊ฒŒ ๋ณด๊ณ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์œ„ํ—˜๊ด€๋ฆฌ ์ง€์นจ", + "์œ„ํ—˜๊ด€๋ฆฌ ๋งค๋‰ด์–ผยท๊ฐ€์ด๋“œ", + "์œ„ํ—˜๊ด€๋ฆฌ ๊ณ„ํš์„œ", + "์œ„ํ—˜ํ‰๊ฐ€ ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ ํšŒ์˜๋ก", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์‹ค๋ฌด ํ˜‘์˜ํšŒ ํšŒ์˜๋ก", + "์ •๋ณด์ž์‚ฐ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ž์‚ฐ ๋ชฉ๋ก", + "์ •๋ณด์„œ๋น„์Šค ๋ฐ ๊ฐœ์ธ์ •๋ณด ํ๋ฆ„ํ‘œยทํ๋ฆ„๋„" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ˆ˜๋ฆฝ๋œ ์œ„ํ—˜๊ด€๋ฆฌ๊ณ„ํš์„œ์— ์œ„ํ—˜ํ‰๊ฐ€ ๊ธฐ๊ฐ„ ๋ฐ ์œ„ํ—˜๊ด€๋ฆฌ ๋Œ€์ƒ๊ณผ ๋ฐฉ๋ฒ•์ด ์ •์˜๋˜์–ด ์žˆ์œผ๋‚˜, ์œ„ํ—˜๊ด€๋ฆฌ ์ˆ˜ํ–‰ ์ธ๋ ฅ๊ณผ ์†Œ์š” ์˜ˆ์‚ฐ ๋“ฑ ๊ตฌ์ฒด์ ์ธ ์‹คํ–‰๊ณ„ํš์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ „๋…„๋„์—๋Š” ์œ„ํ—˜ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜์˜€์œผ๋‚˜, ๊ธˆ๋…„๋„์—๋Š” ์ž์‚ฐ ๋ณ€๊ฒฝ์ด ์—†์—ˆ๋‹ค๋Š” ์‚ฌ์œ ๋กœ ์œ„ํ—˜ ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์œ„ํ—˜๊ด€๋ฆฌ ๊ณ„ํš์— ๋”ฐ๋ผ ์œ„ํ—˜ ์‹๋ณ„ ๋ฐ ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ฒ”์œ„ ๋‚ด ์ค‘์š” ์ •๋ณด์ž์‚ฐ์— ๋Œ€ํ•œ ์œ„ํ—˜ ์‹๋ณ„ ๋ฐ ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜, ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ ์‚ฌํ•ญ ์ค€์ˆ˜ ์—ฌ๋ถ€์— ๋”ฐ๋ฅธ ์œ„ํ—˜์„ ์‹๋ณ„ ๋ฐ ํ‰๊ฐ€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์œ„ํ—˜๊ด€๋ฆฌ ๊ณ„ํš์— ๋”ฐ๋ผ ์œ„ํ—˜ ์‹๋ณ„ ๋ฐ ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์ˆ˜์šฉ ๊ฐ€๋Šฅํ•œ ๋ชฉํ‘œ ์œ„ํ—˜์ˆ˜์ค€์„ ์„ค์ •ํ•˜์˜€์œผ๋‚˜, ๊ด€๋ จ ์‚ฌํ•ญ์„ ๊ฒฝ์˜์ง„(์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋“ฑ)์— ๋ณด๊ณ ํ•˜์—ฌ ์Šน์ธ๋ฐ›์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๋‚ด๋ถ€ ์ง€์นจ์— ์ •์˜ํ•œ ์œ„ํ—˜ ํ‰๊ฐ€ ๋ฐฉ๋ฒ•๊ณผ ์‹ค์ œ ์ˆ˜ํ–‰ํ•œ ์œ„ํ—˜ ํ‰๊ฐ€ ๋ฐฉ๋ฒ•์ด ์ƒ์ดํ•  ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„์™€ ๊ด€๋ จ๋œ ๊ด€๋ฆฌ์ ยท๋ฌผ๋ฆฌ์  ์˜์—ญ์˜ ์œ„ํ—˜ ์‹๋ณ„ ๋ฐ ํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š๊ณ , ๋‹จ์ˆœํžˆ ๊ธฐ์ˆ ์  ์ทจ์•ฝ์ ์ง„๋‹จ ๊ฒฐ๊ณผ๋ฅผ ์œ„ํ—˜ ํ‰๊ฐ€ ๊ฒฐ๊ณผ๋กœ ๊ฐˆ์Œํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 7 : ์ˆ˜์šฉ ๊ฐ€๋Šฅํ•œ ๋ชฉํ‘œ ์œ„ํ—˜์ˆ˜์ค€(DoA)์„ ํƒ€๋‹นํ•œ ์‚ฌ์œ  ์—†์ด ๊ณผ๋„ํ•˜๊ฒŒ ๋†’์ด๋Š” ๊ฒƒ์œผ๋กœ ๊ฒฐ์ •ํ•จ์— ๋”ฐ๋ผ, ์‹ค์งˆ์ ์œผ๋กœ ๋Œ€์‘์ด ํ•„์š”ํ•œ ์ฃผ์š” ์œ„ํ—˜๋“ค์ด ์กฐ์น˜๊ฐ€ ๋ถˆํ•„์š”ํ•œ ์œ„ํ—˜(์ˆ˜์šฉ ๊ฐ€๋Šฅํ•œ ์œ„ํ—˜)์œผ๋กœ ์ง€์ •๋œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.2.4", + "Name": "๋ณดํ˜ธ๋Œ€์ฑ… ์„ ์ •", + "Description": "์œ„ํ—˜ ํ‰๊ฐ€ ๊ฒฐ๊ณผ์— ๋”ฐ๋ผ ์‹๋ณ„๋œ ์œ„ํ—˜์„ ์ฒ˜๋ฆฌํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์กฐ์ง์— ์ ํ•ฉํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์„ ์ •ํ•˜๊ณ , ๋ณดํ˜ธ๋Œ€์ฑ…์˜ ์šฐ์„ ์ˆœ์œ„์™€ ์ผ์ •ยท๋‹ด๋‹น์žยท์˜ˆ์‚ฐ ๋“ฑ์„ ํฌํ•จํ•œ ์ดํ–‰๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ๊ฒฝ์˜์ง„์˜ ์Šน์ธ์„ ๋ฐ›์•„์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.2. ์œ„ํ—˜ ๊ด€๋ฆฌ", + "Section": "1.2.4 ๋ณดํ˜ธ๋Œ€์ฑ… ์„ ์ •", + "AuditChecklist": [ + "์‹๋ณ„๋œ ์œ„ํ—˜์— ๋Œ€ํ•œ ์ฒ˜๋ฆฌ ์ „๋žต(๊ฐ์†Œ, ํšŒํ”ผ, ์ „๊ฐ€, ์ˆ˜์šฉ ๋“ฑ)์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์œ„ํ—˜์ฒ˜๋ฆฌ๋ฅผ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์„ ์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณดํ˜ธ๋Œ€์ฑ…์˜ ์šฐ์„ ์ˆœ์œ„๋ฅผ ๊ณ ๋ คํ•˜์—ฌ ์ผ์ •, ๋‹ด๋‹น๋ถ€์„œ ๋ฐ ๋‹ด๋‹น์ž, ์˜ˆ์‚ฐ ๋“ฑ์˜ ํ•ญ๋ชฉ์„ ํฌํ•จํ•œ ๋ณดํ˜ธ๋Œ€์ฑ… ์ดํ–‰๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ๊ฒฝ์˜์ง„์— ๋ณด๊ณ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ดํ–‰๊ณ„ํš์„œยท์œ„ํ—˜๊ด€๋ฆฌ๊ณ„ํš์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋Œ€์ฑ…์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋งˆ์Šคํ„ฐํ”Œ๋žœ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ดํ–‰๊ณ„ํš ๊ฒฝ์˜์ง„ ๋ณด๊ณ  ๋ฐ ์Šน์ธ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋Œ€์ฑ…์— ๋Œ€ํ•œ ์ดํ–‰๊ณ„ํš์€ ์ˆ˜๋ฆฝํ•˜์˜€์œผ๋‚˜, ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์—๊ฒŒ ๋ณด๊ณ ๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์œ„ํ—˜๊ฐ์†Œ๊ฐ€ ์š”๊ตฌ๋˜๋Š” ์ผ๋ถ€ ์œ„ํ—˜์˜ ์กฐ์น˜ ์ดํ–‰๊ณ„ํš์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ฒ•์— ๋”ฐ๋ผ ์˜๋ฌด์ ์œผ๋กœ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•  ์‚ฌํ•ญ, ๋ณด์•ˆ ์ทจ์•ฝ์„ฑ์ด ๋†’์€ ์œ„ํ—˜ ๋“ฑ์„ ๋ณ„๋„์˜ ๋ณดํ˜ธ์กฐ์น˜ ๊ณ„ํš ์—†์ด ์œ„ํ—˜์ˆ˜์šฉ์œผ๋กœ ๊ฒฐ์ •ํ•˜์—ฌ ์กฐ์น˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์œ„ํ—˜์ˆ˜์šฉ์— ๋Œ€ํ•œ ๊ทผ๊ฑฐ์™€ ํƒ€๋‹น์„ฑ์ด ๋ฏธํกํ•˜๊ณ , ์‹œ๊ธ‰์„ฑ ๋ฐ ๊ตฌํ˜„ ์šฉ์ด์„ฑ ๋“ฑ์˜ ์ธก๋ฉด์—์„œ ์ฆ‰์‹œ ๋˜๋Š” ๋‹จ๊ธฐ ์กฐ์น˜๊ฐ€ ๊ฐ€๋Šฅํ•œ ์œ„ํ—˜์š”์ธ์— ๋Œ€ํ•ด์„œ๋„ ํŠน๋ณ„ํ•œ ์‚ฌ์œ  ์—†์ด ์žฅ๊ธฐ ์กฐ์น˜๊ณ„ํš์œผ๋กœ ๋ถ„๋ฅ˜ํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.3.1", + "Name": "๋ณดํ˜ธ๋Œ€์ฑ… ๊ตฌํ˜„", + "Description": "์„ ์ •ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์€ ์ดํ–‰๊ณ„ํš์— ๋”ฐ๋ผ ํšจ๊ณผ์ ์œผ๋กœ ๊ตฌํ˜„ํ•˜๊ณ , ๊ฒฝ์˜์ง„์€ ์ดํ–‰๊ฒฐ๊ณผ์˜ ์ •ํ™•์„ฑ๊ณผ ํšจ๊ณผ์„ฑ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.3. ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", + "Section": "1.3.1 ๋ณดํ˜ธ๋Œ€์ฑ… ๊ตฌํ˜„", + "AuditChecklist": [ + "์ดํ–‰๊ณ„ํš์— ๋”ฐ๋ผ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ํšจ๊ณผ์ ์œผ๋กœ ๊ตฌํ˜„ํ•˜๊ณ  ์ดํ–‰๊ฒฐ๊ณผ์˜ ์ •ํ™•์„ฑ ๋ฐ ํšจ๊ณผ์„ฑ ์—ฌ๋ถ€๋ฅผ ๊ฒฝ์˜์ง„์ด ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ณด๊ณ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ธ์ฆ๊ธฐ์ค€๋ณ„๋กœ ๋ณดํ˜ธ๋Œ€์ฑ… ๊ตฌํ˜„ ๋ฐ ์šด์˜ ํ˜„ํ™ฉ์„ ๊ธฐ๋กํ•œ ์šด์˜๋ช…์„ธ์„œ๋ฅผ ๊ตฌ์ฒด์ ์œผ๋กœ ์ž‘์„ฑํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ดํ–‰๊ณ„ํš์„œยท์œ„ํ—˜๊ด€๋ฆฌ๊ณ„ํš์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋Œ€์ฑ…์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ดํ–‰๊ณ„ํš ๊ฒฝ๊ณผ๋ณด๊ณ ์„œ(๊ฒฝ์˜์ง„ ๋ณด๊ณ  ํฌํ•จ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ดํ–‰ ์™„๋ฃŒ ๋ณด๊ณ ์„œ(๊ฒฝ์˜์ง„ ๋ณด๊ณ  ํฌํ•จ)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์šด์˜๋ช…์„ธ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋Œ€์ฑ…์— ๋Œ€ํ•œ ์ดํ–‰์™„๋ฃŒ ๊ฒฐ๊ณผ๋ฅผ ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์—๊ฒŒ ๋ณด๊ณ ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์œ„ํ—˜์กฐ์น˜ ์ดํ–‰๊ฒฐ๊ณผ๋ณด๊ณ ์„œ๋Š” สป์กฐ์น˜ ์™„๋ฃŒสผ๋กœ ๋ช…์‹œ๋˜์–ด ์žˆ์œผ๋‚˜, ๊ด€๋ จ๋œ ์œ„ํ—˜์ด ์—ฌ์ „ํžˆ ์กด์žฌํ•˜๊ฑฐ๋‚˜ ์ดํ–‰๊ฒฐ๊ณผ์˜ ์ •ํ™•์„ฑ ๋ฐ ํšจ๊ณผ์„ฑ์ด ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ „๋…„๋„ ์ •๋ณด๋ณดํ˜ธ๋Œ€์ฑ… ์ดํ–‰๊ณ„ํš์— ๋”ฐ๋ผ ์ค‘ยท์žฅ๊ธฐ๋กœ ๋ถ„๋ฅ˜๋œ ์œ„ํ—˜๋“ค์ด ํ•ด๋‹น์—ฐ๋„์— ๊ตฌํ˜„์ด ๋˜๊ณ  ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜ ์ดํ–‰๊ฒฐ๊ณผ๋ฅผ ๊ฒฝ์˜์ง„์ด ๊ฒ€ํ†  ๋ฐ ํ™•์ธํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์šด์˜๋ช…์„ธ์„œ์— ์ž‘์„ฑ๋œ ์šด์˜ ํ˜„ํ™ฉ์ด ์‹ค์ œ์™€ ์ผ์น˜ํ•˜์ง€ ์•Š๊ณ , ์šด๋ช…๋ช…์„ธ์„œ์— ๊ธฐ๋ก๋˜์–ด ์žˆ๋Š” ๊ด€๋ จ ๋ฌธ์„œ, ๊ฒฐ์žฌ ๋‚ด์šฉ, ํšŒ์˜๋ก ๋“ฑ์ด ์กด์žฌํ•˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ดํ–‰๊ณ„ํš ์‹œํ–‰์— ๋Œ€ํ•œ ๊ฒฐ๊ณผ๋ฅผ ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์—๊ฒŒ ๋ณด๊ณ ํ•˜์˜€์œผ๋‚˜, ์ผ๋ถ€ ๋ฏธ์ดํ–‰๋œ ๊ฑด์— ๋Œ€ํ•œ ์‚ฌ์œ  ๋ณด๊ณ  ๋ฐ ํ›„์† ์กฐ์น˜๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.3.2", + "Name": "๋ณดํ˜ธ๋Œ€์ฑ… ๊ณต์œ ", + "Description": "๋ณดํ˜ธ๋Œ€์ฑ…์˜ ์‹ค์ œ ์šด์˜ ๋˜๋Š” ์‹œํ–‰ํ•  ๋ถ€์„œ ๋ฐ ๋‹ด๋‹น์ž๋ฅผ ํŒŒ์•…ํ•˜์—ฌ ๊ด€๋ จ ๋‚ด์šฉ์„ ๊ณต์œ ํ•˜๊ณ  ๊ต์œกํ•˜์—ฌ ์ง€์†์ ์œผ๋กœ ์šด์˜๋˜๋„๋ก ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.3. ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", + "Section": "1.3.2 ๋ณดํ˜ธ๋Œ€์ฑ… ๊ณต์œ ", + "AuditChecklist": [ + "๊ตฌํ˜„๋œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์šด์˜ ๋˜๋Š” ์‹œํ–‰ํ•  ๋ถ€์„œ ๋ฐ ๋‹ด๋‹น์ž๋ฅผ ๋ช…ํ™•ํ•˜๊ฒŒ ํŒŒ์•…ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ตฌํ˜„๋œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์šด์˜ ๋˜๋Š” ์‹œํ–‰ํ•  ๋ถ€์„œ ๋ฐ ๋‹ด๋‹น์ž์—๊ฒŒ ๊ด€๋ จ ๋‚ด์šฉ์„ ๊ณต์œ  ๋˜๋Š” ๊ต์œกํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋Œ€์ฑ…๋ณ„ ์šด์˜๋ถ€์„œ ๋˜๋Š” ์‹œํ–‰๋ถ€์„œ ํ˜„ํ™ฉ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๊ด€๋ฆฌ๊ณ„ํš ๋‚ด๋ถ€๊ณต์œ  ์ฆ๊ฑฐ์ž๋ฃŒ(๊ณต์ง€ ๋‚ด์—ญ, ๊ต์œก์ž๋ฃŒ, ๊ณต์œ  ์ž๋ฃŒ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ ๊ตฌํ˜„ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ด€๋ จ ๋‚ด์šฉ์„ ์ถฉ๋ถ„ํžˆ ๊ณต์œ ยท๊ต์œกํ•˜์ง€ ์•Š์•„ ์‹ค์ œ ์šด์˜ ๋˜๋Š” ์ˆ˜ํ–‰ ๋ถ€์„œ ๋ฐ ๋‹ด๋‹น์ž๊ฐ€ ํ•ด๋‹น ๋‚ด์šฉ์„ ์ธ์ง€ํ•˜์ง€ ๋ชปํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.3.3", + "Name": "์šด์˜ํ˜„ํ™ฉ ๊ด€๋ฆฌ", + "Description": "์กฐ์ง์ด ์ˆ˜๋ฆฝํ•œ ๊ด€๋ฆฌ์ฒด๊ณ„์— ๋”ฐ๋ผ ์ƒ์‹œ์  ๋˜๋Š” ์ฃผ๊ธฐ์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•˜๋Š” ์šด์˜ํ™œ๋™ ๋ฐ ์ˆ˜ํ–‰ ๋‚ด์—ญ์€ ์‹๋ณ„ ๋ฐ ์ถ”์ ์ด ๊ฐ€๋Šฅํ•˜๋„๋ก ๊ธฐ๋กํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๊ณ , ๊ฒฝ์˜์ง„์€ ์ฃผ๊ธฐ์ ์œผ๋กœ ์šด์˜ํ™œ๋™์˜ ํšจ๊ณผ์„ฑ์„ ํ™•์ธํ•˜์—ฌ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.3. ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜", + "Section": "1.3.3 ์šด์˜ํ˜„ํ™ฉ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜์„ ์œ„ํ•˜์—ฌ ์ฃผ๊ธฐ์  ๋˜๋Š” ์ƒ์‹œ์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•˜๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์„ ๋ฌธ์„œํ™”ํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฒฝ์˜์ง„์€ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜ํ™œ๋™์˜ ํšจ๊ณผ์„ฑ์„ ํ™•์ธํ•˜๊ณ  ์ด๋ฅผ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ31์กฐ(๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์ง€์ •)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ45์กฐ์˜3(์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž์˜ ์ง€์ • ๋“ฑ)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์—ฐ๊ฐ„๊ณ„ํš์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์šด์˜ํ˜„ํ™ฉํ‘œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™ ์ˆ˜ํ–‰ ์—ฌ๋ถ€ ์ ๊ฒ€ ๊ฒฐ๊ณผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜ํ˜„ํ™ฉ ์ค‘ ์ฃผ๊ธฐ์  ๋˜๋Š” ์ƒ์‹œ์ ์ธ ํ™œ๋™์ด ์š”๊ตฌ๋˜๋Š” ํ™œ๋™ ํ˜„ํ™ฉ์„ ๋ฌธ์„œํ™”ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜ํ˜„ํ™ฉ์— ๋Œ€ํ•œ ๋ฌธ์„œํ™”๋Š” ์ด๋ฃจ์–ด์กŒ์œผ๋‚˜, ํ•ด๋‹น ์šด์˜ํ˜„ํ™ฉ์— ๋Œ€ํ•œ ์ฃผ๊ธฐ์ ์ธ ๊ฒ€ํ† ๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์•„ ์›”๋ณ„ ๋ฐ ๋ถ„๊ธฐ๋ณ„ ํ™œ๋™์ด ์š”๊ตฌ๋˜๋Š” ์ผ๋ถ€ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™์ด ๋ˆ„๋ฝ๋˜์—ˆ๊ณ  ์ผ๋ถ€๋Š” ์ดํ–‰ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.4.1", + "Name": "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜ ๊ฒ€ํ† ", + "Description": "์กฐ์ง์ด ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ํŒŒ์•…ํ•˜์—ฌ ๊ทœ์ •์— ๋ฐ˜์˜ํ•˜๊ณ , ์ค€์ˆ˜ ์—ฌ๋ถ€๋ฅผ ์ง€์†์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.4. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", + "Section": "1.4.1 ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜ ๊ฒ€ํ† ", + "AuditChecklist": [ + "์กฐ์ง์ด ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•˜๋Š” ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ํŒŒ์•…ํ•˜์—ฌ ์ตœ์‹ ์„ฑ์„ ์œ ์ง€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์˜ ์ค€์ˆ˜ ์—ฌ๋ถ€๋ฅผ ์—ฐ 1ํšŒ ์ด์ƒ ์ •๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "๋ฒ•์  ์ค€๊ฑฐ์„ฑ ๊ฒ€ํ†  ๋‚ด์—ญ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจ ๊ฒ€ํ†  ๋ฐ ๊ฐœ์ •์ด๋ ฅ", + "์ •์ฑ…ยท์ง€์นจ ์‹ ๊ตฌ๋Œ€์กฐํ‘œ", + "๋ฒ• ๊ฐœ์ •์‚ฌํ•ญ ๋‚ด๋ถ€๊ณต์œ  ์ž๋ฃŒ", + "๊ฐœ์ธ์ •๋ณด ์†ํ•ด๋ฐฐ์ƒ ์ฑ…์ž„๋ณด์žฅ ์ž…์ฆ ์ž๋ฃŒ(์‚ฌ์ด๋ฒ„๋ณดํ—˜ ์•ฝ์ •์„œ ๋“ฑ)", + "์ •๋ณด๋ณดํ˜ธ ๊ณต์‹œ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ•์ด ์ตœ๊ทผ ๊ฐœ์ •๋˜์—ˆ์œผ๋‚˜ ๊ฐœ์ •์‚ฌํ•ญ์ด ์กฐ์ง์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๊ฒ€ํ† ํ•˜์ง€ ์•Š์•˜์œผ๋ฉฐ, ์ •์ฑ…์„œยท์‹œํ–‰๋ฌธ์„œ ๋ฐ ๋ฒ•์ ์ค€๊ฑฐ์„ฑ ์ฒดํฌ๋ฆฌ์ŠคํŠธ ๋“ฑ์—๋„ ํ•ด๋‹น ๋‚ด์šฉ์„ ๋ฐ˜์˜ํ•˜์ง€ ์•Š์•„ ์ •์ฑ…์„œยท์‹œํ–‰๋ฌธ์„œ ๋ฐ ๋ฒ•์ ์ค€๊ฑฐ์„ฑ ์ฒดํฌ๋ฆฌ์ŠคํŠธ ๋“ฑ์˜ ๋‚ด์šฉ์ด ๋ฒ•๋ น ๋‚ด์šฉ๊ณผ ์ผ์น˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์กฐ์ง์—์„œ ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•  ๋ฒ•๋ฅ ์ด ๊ฐœ์ •๋˜์—ˆ์œผ๋‚˜, ํ•ด๋‹น ๋ฒ•๋ฅ  ์ค€๊ฑฐ์„ฑ ๊ฒ€ํ† ๋ฅผ ์žฅ๊ธฐ๊ฐ„ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ฒ•์  ์ค€๊ฑฐ์„ฑ ์ค€์ˆ˜ ์—ฌ๋ถ€์— ๋Œ€ํ•œ ๊ฒ€ํ† ๊ฐ€ ์ ์ ˆํžˆ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์•„ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ๋“ฑ ๋ฒ•๊ทœ ์œ„๋ฐ˜ ์‚ฌํ•ญ์ด ๋‹ค์ˆ˜ ๋ฐœ๊ฒฌ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ•์— ๋”ฐ๋ผ ๊ฐœ์ธ์ •๋ณด ์†ํ•ด๋ฐฐ์ƒ์ฑ…์ž„ ๋ณด์žฅ์ œ๋„ ์ ์šฉ ๋Œ€์ƒ์ด ๋˜์—ˆ์œผ๋‚˜, ์ด๋ฅผ ์ธ์ง€ํ•˜์ง€ ๋ชปํ•˜์—ฌ ๋ณดํ—˜ ๊ฐ€์ž…์ด๋‚˜ ์ค€๋น„๊ธˆ ์ ๋ฆฝ์„ ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ ๋˜๋Š” ๋ณดํ—˜ ๊ฐ€์ž…์„ ํ•˜์˜€์œผ๋‚˜ ์ด์šฉ์ž ์ˆ˜ ๋ฐ ๋งค์ถœ์•ก์— ๋”ฐ๋ฅธ ์ตœ์ €๊ฐ€์ž…๊ธˆ์•ก ๊ธฐ์ค€์„ ์ค€์ˆ˜ํ•˜์ง€ ๋ชปํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ •๋ณด๋ณดํ˜ธ ๊ณต์‹œ ์˜๋ฌด๋Œ€์ƒ ์‚ฌ์—…์ž์ด์ง€๋งŒ ๋ฒ•์— ์ •ํ•œ ์‹œ์  ๋‚ด์— ์ •๋ณด๋ณดํ˜ธ ๊ณต์‹œ๊ฐ€ ์‹œํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ๋ชจ๋ฐ”์ผ์•ฑ์„ ํ†ตํ•ด ์œ„์น˜์ •๋ณด์‚ฌ์—…์ž๋กœ๋ถ€ํ„ฐ ์ด์šฉ์ž์˜ ๊ฐœ์ธ์œ„์น˜์ •๋ณด๋ฅผ ์ „์†ก๋ฐ›์•„ ์„œ๋น„์Šค์— ์ด์šฉํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์œ„์น˜๊ธฐ๋ฐ˜์„œ๋น„์Šค์‚ฌ์—… ์‹ ๊ณ ๋ฅผ ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 7 : ๊ตญ๋‚ด์— ์ฃผ์†Œ ๋˜๋Š” ์˜์—…์†Œ๊ฐ€ ์—†๋Š” ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๋กœ์„œ ์ „๋…„๋„ ๋ง ๊ธฐ์ค€ ์ง์ „ 3๊ฐœ์›” ๊ฐ„ ๊ทธ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ์ €์žฅยท๊ด€๋ฆฌ๋˜๊ณ  ์žˆ๋Š” ๊ตญ๋‚ด ์ •๋ณด์ฃผ์ฒด์˜ ์ˆ˜๊ฐ€ ์ผ์ผํ‰๊ท  100๋งŒ๋ช… ์ด์ƒ์ธ ์ž์— ํ•ด๋‹น๋˜์–ด ๊ตญ๋‚ด๋Œ€๋ฆฌ์ธ ์ง€์ •์˜๋ฌด์— ํ•ด๋‹น๋จ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ , ๊ตญ๋‚ด๋Œ€๋ฆฌ์ธ์„ ๋ฌธ์„œ๋กœ ์ง€์ •ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.4.2", + "Name": "๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€", + "Description": "๊ด€๋ฆฌ์ฒด๊ณ„๊ฐ€ ๋‚ด๋ถ€ ์ •์ฑ… ๋ฐ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ํšจ๊ณผ์ ์œผ๋กœ ์šด์˜๋˜๊ณ  ์žˆ๋Š”์ง€ ๋…๋ฆฝ์„ฑ๊ณผ ์ „๋ฌธ์„ฑ์ด ํ™•๋ณด๋œ ์ธ๋ ฅ์„ ๊ตฌ์„ฑํ•˜์—ฌ ์—ฐ 1ํšŒ ์ด์ƒ ์ ๊ฒ€ํ•˜๊ณ , ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์„ ๊ฒฝ์˜์ง„์—๊ฒŒ ๋ณด๊ณ ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.4. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", + "Section": "1.4.2 ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€", + "AuditChecklist": [ + "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ๋ฐ ์ˆ˜๋ฆฝ๋œ ์ •์ฑ…์— ๋”ฐ๋ผ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„๊ฐ€ ํšจ๊ณผ์ ์œผ๋กœ ์šด์˜๋˜๋Š”์ง€๋ฅผ ์ ๊ฒ€ํ•˜๊ธฐ ์œ„ํ•œ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€๊ธฐ์ค€, ๋ฒ”์œ„, ์ฃผ๊ธฐ, ์ ๊ฒ€์ธ๋ ฅ ์ž๊ฒฉ์š”๊ฑด ๋“ฑ์„ ํฌํ•จํ•œ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๊ณ„ํš์— ๋”ฐ๋ผ ๋…๋ฆฝ์„ฑ, ๊ฐ๊ด€์„ฑ ๋ฐ ์ „๋ฌธ์„ฑ์ด ํ™•๋ณด๋œ ์ธ๋ ฅ์„ ๊ตฌ์„ฑํ•˜์—ฌ ์—ฐ 1ํšŒ ์ด์ƒ ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์„ ๊ฒฝ์˜์ง„์—๊ฒŒ ๋ณด๊ณ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๊ณ„ํš์„œ(๋‚ด๋ถ€์ ๊ฒ€ ๊ณ„ํš์„œ, ๋‚ด๋ถ€๊ฐ์‚ฌ ๊ณ„ํš์„œ)", + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์œ„์›ํšŒ ํšŒ์˜๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ์ธ๋ ฅ์— ์ ๊ฒ€ ๋Œ€์ƒ์œผ๋กœ ์‹๋ณ„๋œ ์ „์‚ฐํŒ€ ์ง์›์ด ํฌํ•จ๋˜์–ด ์ „์‚ฐํŒ€ ๊ด€๋ฆฌ ์˜์—ญ์— ๋Œ€ํ•œ ์ ๊ฒ€์— ๊ด€์—ฌํ•˜๊ณ  ์žˆ์–ด, ์ ๊ฒ€์˜ ๋…๋ฆฝ์„ฑ์ด ํ›ผ์†๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ธˆ๋…„๋„ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€์„ ์‹ค์‹œํ•˜์˜€์œผ๋‚˜, ์ ๊ฒ€๋ฒ”์œ„๊ฐ€ ์ผ๋ถ€ ์˜์—ญ์— ๊ตญํ•œ๋˜์–ด ์žˆ์–ด ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„๋ฅผ ์ถฉ์กฑํ•˜์ง€ ๋ชปํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ํŒ€์ด ์œ„ํ—˜ํ‰๊ฐ€ ๋˜๋Š” ์ทจ์•ฝ์  ์ ๊ฒ€ ๋“ฑ ๊ด€๋ฆฌ์ฒด๊ณ„ ๊ตฌ์ถ• ๊ณผ์ •์— ์ฐธ์—ฌํ•œ ๋‚ด๋ถ€ ์ง์› ๋ฐ ์™ธ๋ถ€ ์ปจ์„คํ„ดํŠธ๋กœ๋งŒ ๊ตฌ์„ฑ๋˜์–ด, ์ ๊ฒ€์˜ ๋…๋ฆฝ์„ฑ์ด ํ™•๋ณด๋˜์—ˆ๋‹ค๊ณ  ๋ณผ ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "1.4.3", + "Name": "๊ด€๋ฆฌ์ฒด๊ณ„ ๊ฐœ์„ ", + "Description": "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜๊ฒ€ํ†  ๋ฐ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€์„ ํ†ตํ•˜์—ฌ ์‹๋ณ„๋œ ๊ด€๋ฆฌ์ฒด๊ณ„์ƒ์˜ ๋ฌธ์ œ์ ์— ๋Œ€ํ•œ ์›์ธ์„ ๋ถ„์„ํ•˜๊ณ  ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ๊ฒฝ์˜์ง„์€ ๊ฐœ์„  ๊ฒฐ๊ณผ์˜ ์ •ํ™•์„ฑ๊ณผ ํšจ๊ณผ์„ฑ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "1. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ˆ˜๋ฆฝ ๋ฐ ์šด์˜", + "Subdomain": "1.4. ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๋ฐ ๊ฐœ์„ ", + "Section": "1.4.3 ๊ด€๋ฆฌ์ฒด๊ณ„ ๊ฐœ์„ ", + "AuditChecklist": [ + "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜๊ฒ€ํ†  ๋ฐ ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€์„ ํ†ตํ•˜์—ฌ ์‹๋ณ„๋œ ๊ด€๋ฆฌ์ฒด๊ณ„์ƒ์˜ ๋ฌธ์ œ์ ์— ๋Œ€ํ•œ ๊ทผ๋ณธ ์›์ธ์„ ๋ถ„์„ํ•˜์—ฌ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋ฐ ๊ฐœ์„  ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์žฌ๋ฐœ๋ฐฉ์ง€ ๋ฐ ๊ฐœ์„  ๊ฒฐ๊ณผ์˜ ์ •ํ™•์„ฑ ๋ฐ ํšจ๊ณผ์„ฑ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•œ ๊ธฐ์ค€๊ณผ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ", + "๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ์กฐ์น˜๊ณ„ํš์„œยท์ดํ–‰์กฐ์น˜๊ฒฐ๊ณผ์„œ", + "์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…", + "ํšจ๊ณผ์„ฑ ์ธก์ • ์ง€ํ‘œ ๋ฐ ์ธก์ • ๊ฒฐ๊ณผ(๊ฒฝ์˜์ง„ ๋ณด๊ณ  ํฌํ•จ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€์ ๊ฒ€์„ ํ†ตํ•˜์—ฌ ๋ฐœ๊ฒฌ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ฆฌ์ฒด๊ณ„ ์šด์˜์ƒ ๋ฌธ์ œ์ ์ด ๋งค๋ฒˆ ๋™์ผํ•˜๊ฒŒ ๋ฐ˜๋ณต๋˜์–ด ๋ฐœ์ƒ๋˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ๋‚ด๋ถ€์ ๊ฒ€ ์‹œ ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์— ๋Œ€ํ•ด์„œ๋Š” ๊ทผ๋ณธ์›์ธ์— ๋Œ€ํ•œ ๋ถ„์„ ๋ฐ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์ตœ๊ทผ์— ์ˆ˜ํ–‰๋œ ๋‚ด๋ถ€์ ๊ฒ€์—์„œ๋Š” ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์— ๋Œ€ํ•˜์—ฌ ๊ทผ๋ณธ์›์ธ ๋ถ„์„ ๋ฐ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์ด ์ˆ˜๋ฆฝ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ด€๋ฆฌ์ฒด๊ณ„์ƒ ๋ฌธ์ œ์ ์— ๋Œ€ํ•œ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ํ•ต์‹ฌ์„ฑ๊ณผ์ง€ํ‘œ๋ฅผ ๋งˆ๋ จํ•˜์—ฌ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ธก์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ทธ ๊ฒฐ๊ณผ์— ๋Œ€ํ•˜์—ฌ ๊ฒฝ์˜์ง„ ๋ณด๊ณ ๊ฐ€ ์žฅ๊ธฐ๊ฐ„ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ด€๋ฆฌ์ฒด๊ณ„ ์ ๊ฒ€ ์‹œ ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์— ๋Œ€ํ•˜์—ฌ ์กฐ์น˜๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜ ์กฐ์น˜ ์™„๋ฃŒ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.1.1", + "Name": "์ •์ฑ…์˜ ์œ ์ง€๊ด€๋ฆฌ", + "Description": "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ…๊ณผ ์‹œํ–‰๋ฌธ์„œ๋Š” ๋ฒ•๋ น ๋ฐ ๊ทœ์ œ, ์ƒ์œ„ ์กฐ์ง ๋ฐ ๊ด€๋ จ ๊ธฐ๊ด€ ์ •์ฑ…๊ณผ์˜ ์—ฐ๊ณ„์„ฑ, ์กฐ์ง์˜ ๋Œ€๋‚ด์™ธ ํ™˜๊ฒฝ๋ณ€ํ™” ๋“ฑ์— ๋”ฐ๋ผ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ ํ•„์š”ํ•œ ๊ฒฝ์šฐ ์ œยท๊ฐœ์ •ํ•˜๊ณ  ๊ทธ ๋‚ด์—ญ์„ ์ด๋ ฅ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.1. ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", + "Section": "2.1.1 ์ •์ฑ…์˜ ์œ ์ง€๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ์— ๋Œ€ํ•œ ์ •๊ธฐ์ ์ธ ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์กฐ์ง์˜ ๋Œ€๋‚ด์™ธ ํ™˜๊ฒฝ์— ์ค‘๋Œ€ํ•œ ๋ณ€ํ™” ๋ฐœ์ƒ ์‹œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๊ฒ€ํ† ํ•˜๊ณ  ํ•„์š”์‹œ ์ œยท๊ฐœ์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ์˜ ์ œยท๊ฐœ์ • ์‹œ ์ดํ•ด ๊ด€๊ณ„์ž์˜ ๊ฒ€ํ† ๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ์˜ ์ œยท๊ฐœ์ • ๋‚ด์—ญ์— ๋Œ€ํ•˜์—ฌ ์ด๋ ฅ๊ด€๋ฆฌ๋ฅผ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ(์ง€์นจ, ์ ˆ์ฐจ, ๊ฐ€์ด๋“œ, ๋งค๋‰ด์–ผ ๋“ฑ)", + "์ •์ฑ…ยท์ง€์นจ ์ •๊ธฐยท๋น„์ •๊ธฐ ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ๊ฒฐ๊ณผ", + "์ •์ฑ…ยท์ง€์นจ ๊ด€๋ จ ๋ถ€์„œ์™€์˜ ๊ฒ€ํ†  ํšŒ์˜๋ก, ํšŒ๋žŒ๋‚ด์šฉ", + "์ •์ฑ…ยท์ง€์นจ ์ œยท๊ฐœ์ • ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ง€์นจ์„œ์™€ ์ ˆ์ฐจ์„œ ๊ฐ„ ํŒจ์Šค์›Œ๋“œ ์„ค์ • ๊ทœ์น™์— ์ผ๊ด€์„ฑ์ด ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด๋ณดํ˜ธ ํ™œ๋™(์ •๋ณด๋ณดํ˜ธ ๊ต์œก, ์•”ํ˜ธํ™”, ๋ฐฑ์—… ๋“ฑ)์˜ ๋Œ€์ƒ, ์ฃผ๊ธฐ, ์ˆ˜์ค€, ๋ฐฉ๋ฒ• ๋“ฑ์ด ๊ด€๋ จ ๋‚ด๋ถ€ ๊ทœ์ •, ์ง€์นจ, ์ ˆ์ฐจ์— ์„œ๋กœ ๋‹ค๋ฅด๊ฒŒ ๋ช…์‹œ๋˜์–ด ์ผ๊ด€์„ฑ์ด ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ๋Œ€ํ•œ ์ ‘๊ทผ ๋ฐ ์ž‘์—…์ด๋ ฅ์„ ํšจ๊ณผ์ ์œผ๋กœ ๊ธฐ๋ก ๋ฐ ๊ด€๋ฆฌํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผํ†ต์ œ ์†”๋ฃจ์…˜์„ ์‹ ๊ทœ๋กœ ๋„์ž…ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋ณด์•ˆ ๊ด€๋ฆฌ์ง€์นจ ๋ฐ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋ณด์•ˆ ๊ด€๋ฆฌ์ง€์นจ ๋“ฑ ๋‚ด๋ถ€ ๋ณด์•ˆ์ง€์นจ์— ์ ‘๊ทผํ†ต์ œ, ์ž‘์—…์ด๋ ฅ, ๋กœ๊น…, ๊ฒ€ํ†  ๋“ฑ์— ๊ด€ํ•œ ์‚ฌํ•ญ์ด ๋ฐ˜์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…์ด ๊ฐœ์ •๋˜์—ˆ์œผ๋‚˜ ์ •์ฑ… ์‹œํ–‰ ๊ธฐ์ค€์ผ์ด ๋ช…์‹œ๋˜์–ด ์žˆ์ง€ ์•Š์œผ๋ฉฐ, ๊ด€๋ จ ์ •์ฑ…์˜ ์ž‘์„ฑ์ผ, ์ž‘์„ฑ์ž ๋ฐ ์Šน์ธ์ž ๋“ฑ์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•๋ น, ๊ณ ์‹œ ๋“ฑ์— ์ค‘๋Œ€ํ•œ ๋ณ€๊ฒฝ์‚ฌํ•ญ์ด ๋ฐœ์ƒํ•˜์˜€์œผ๋‚˜, ์ด๋Ÿฌํ•œ ๋ณ€๊ฒฝ์ด ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ… ๋ฐ ์‹œํ–‰๋ฌธ์„œ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๊ฒ€ํ† ํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜ ๋ณ€๊ฒฝ์‚ฌํ•ญ์„ ๋ฐ˜์˜ํ•˜์—ฌ ๊ฐœ์ •ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.1.2", + "Name": "์กฐ์ง์˜ ์œ ์ง€๊ด€๋ฆฌ", + "Description": "์กฐ์ง์˜ ๊ฐ ๊ตฌ์„ฑ์›์—๊ฒŒ ์ •๋ณด๋ณดํ˜ธ์™€ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์—ญํ•  ๋ฐ ์ฑ…์ž„์„ ํ• ๋‹นํ•˜๊ณ , ๊ทธ ํ™œ๋™์„ ํ‰๊ฐ€ํ•  ์ˆ˜ ์žˆ๋Š” ์ฒด๊ณ„์™€ ์กฐ์ง ๋ฐ ์กฐ์ง์˜ ๊ตฌ์„ฑ์› ๊ฐ„ ์ƒํ˜ธ ์˜์‚ฌ์†Œํ†ตํ•  ์ˆ˜ ์žˆ๋Š” ์ฒด๊ณ„๋ฅผ ์ˆ˜๋ฆฝํ•˜์—ฌ ์šด์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.1. ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", + "Section": "2.1.2 ์กฐ์ง์˜ ์œ ์ง€๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ฑ…์ž„์ž์™€ ๋‹ด๋‹น์ž์˜ ์—ญํ•  ๋ฐ ์ฑ…์ž„์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ฑ…์ž„์ž์™€ ๋‹ด๋‹น์ž์˜ ํ™œ๋™์„ ํ‰๊ฐ€ํ•  ์ˆ˜ ์žˆ๋Š” ์ฒด๊ณ„๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์กฐ์ง ๋ฐ ์กฐ์ง์˜ ๊ตฌ์„ฑ์› ๊ฐ„ ์ƒํ˜ธ ์˜์‚ฌ์†Œํ†ตํ•  ์ˆ˜ ์žˆ๋Š” ์ฒด๊ณ„ ๋ฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด), ์ œ31์กฐ(๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ์ง€์ •)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ45์กฐ์˜3(์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž์˜ ์ง€์ • ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง๋„", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง ์ง๋ฌด๊ธฐ์ˆ ์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์—…๋ฌด ๋ถ„์žฅํ‘œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ •์ฑ…ยท์ง€์นจ, ๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์˜์‚ฌ์†Œํ†ต ๊ด€๋ฆฌ๊ณ„ํš", + "์˜์‚ฌ์†Œํ†ต ์ˆ˜ํ–‰ ์ด๋ ฅ(์›”๊ฐ„๋ณด๊ณ , ์ฃผ๊ฐ„๋ณด๊ณ , ๋‚ด๋ถ€๊ณต์ง€ ๋“ฑ)", + "์˜์‚ฌ์†Œํ†ต ์ฑ„๋„(์ •๋ณด๋ณดํ˜ธํฌํ„ธ, ๊ฒŒ์‹œํŒ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ์ง€์นจ ๋ฐ ์ง๋ฌด๊ธฐ์ˆ ์„œ์— ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž, ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž ๋ฐ ๊ด€๋ จ ๋‹ด๋‹น์ž์˜ ์—ญํ• ๊ณผ ์ฑ…์ž„์„ ์ •์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์‹ค์ œ ์šด์˜ํ˜„ํ™ฉ๊ณผ ์ผ์น˜ํ•˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ด€๋ จ ๋‹ด๋‹น์ž์˜ ํ™œ๋™์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ‰๊ฐ€ํ•  ์ˆ˜ ์žˆ๋Š” ๋ชฉํ‘œ, ๊ธฐ์ค€, ์ง€ํ‘œ ๋“ฑ์˜ ์ฒด๊ณ„๊ฐ€ ๋งˆ๋ จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ๋ถ€์„œ๋ณ„ ์ •๋ณด๋ณดํ˜ธ ๋‹ด๋‹น์ž๋Š” ์ •๋ณด๋ณดํ˜ธ์™€ ๊ด€๋ จ๋œ KPI๋ฅผ ์„ค์ •ํ•˜์—ฌ ์ธ์‚ฌํ‰๊ฐ€ ์‹œ ๋ฐ˜์˜ํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ๋ถ€์„œ๋ณ„ ์ •๋ณด๋ณดํ˜ธ ๋‹ด๋‹น์ž์˜ KPI์— ์ •๋ณด๋ณดํ˜ธ์™€ ๊ด€๋ จ๋œ ์‚ฌํ•ญ์ด ์ „ํ˜€ ๋ฐ˜์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ •๋ณด๋ณดํ˜ธ ์ตœ๊ณ ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž๊ฐ€ ์ง€์ •๋˜์–ด ์žˆ์œผ๋‚˜, ๊ด€๋ จ ๋ฒ•๋ น์—์„œ ์š”๊ตฌํ•˜๋Š” ์—ญํ•  ๋ฐ ์ฑ…์ž„์ด ๋‚ด๋ถ€ ์ง€์นจ์ด๋‚˜ ์ง๋ฌด๊ธฐ์ˆ ์„œ ๋“ฑ์— ๊ตฌ์ฒด์ ์œผ๋กœ ๋ช…์‹œ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.1.3", + "Name": "์ •๋ณด์ž์‚ฐ ๊ด€๋ฆฌ", + "Description": "์ •๋ณด์ž์‚ฐ์˜ ์šฉ๋„์™€ ์ค‘์š”๋„์— ๋”ฐ๋ฅธ ์ทจ๊ธ‰ ์ ˆ์ฐจ ๋ฐ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ์ž์‚ฐ๋ณ„ ์ฑ…์ž„์†Œ์žฌ๋ฅผ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜์—ฌ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "organizations_tags_policies_enabled_and_attached", + "organizations_account_part_of_organizations", + "macie_is_enabled", + "config_recorder_all_regions_enabled", + "resourceexplorer2_indexes_found", + "account_maintain_current_contact_details", + "account_maintain_different_contact_details_to_security_billing_and_operations", + "account_security_questions_are_registered_in_the_aws_account", + "account_security_contact_information_is_registered" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.1. ์ •์ฑ…, ์กฐ์ง, ์ž์‚ฐ ๊ด€๋ฆฌ", + "Section": "2.1.3 ์ •๋ณด์ž์‚ฐ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด์ž์‚ฐ์˜ ๋ณด์•ˆ๋“ฑ๊ธ‰์— ๋”ฐ๋ฅธ ์ทจ๊ธ‰์ ˆ์ฐจ(์ƒ์„ฑยท๋„์ž…, ์ €์žฅ, ์ด์šฉ, ํŒŒ๊ธฐ) ๋ฐ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ •์˜ํ•˜๊ณ  ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‹๋ณ„๋œ ์ •๋ณด์ž์‚ฐ์— ๋Œ€ํ•˜์—ฌ ์ฑ…์ž„์ž ๋ฐ ๊ด€๋ฆฌ์ž๋ฅผ ์ง€์ •ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด์ž์‚ฐ ๋ชฉ๋ก(์ฑ…์ž„์ž, ๋‹ด๋‹น์ž ์ง€์ •)", + "์ •๋ณด์ž์‚ฐ ์ทจ๊ธ‰ ์ ˆ์ฐจ(๋ฌธ์„œ, ์ •๋ณด์‹œ์Šคํ…œ ๋“ฑ)", + "์ •๋ณด์ž์‚ฐ ๊ด€๋ฆฌ ์‹œ์Šคํ…œ ํ™”๋ฉด", + "์ •๋ณด์ž์‚ฐ ๋ณด์•ˆ๋“ฑ๊ธ‰ ํ‘œ์‹œ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ์ง€์นจ์— ๋”ฐ๋ผ ๋ฌธ์„œ์— ๋ณด์•ˆ๋“ฑ๊ธ‰์„ ํ‘œ๊ธฐํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์ด๋ฅผ ํ‘œ์‹œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด์ž์‚ฐ๋ณ„ ๋‹ด๋‹น์ž ๋ฐ ์ฑ…์ž„์ž๋ฅผ ์‹๋ณ„ํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜, ์ž์‚ฐ๋ชฉ๋ก ํ˜„ํ–‰ํ™”๊ฐ€ ๋ฏธํกํ•˜์—ฌ ํ‡ด์ง, ์ „๋ณด ๋“ฑ ์ธ์‚ฌ์ด๋™์ด ๋ฐœ์ƒํ•˜์—ฌ ์ฃผ์š” ์ •๋ณด์ž์‚ฐ์˜ ๋‹ด๋‹น์ž ๋ฐ ์ฑ…์ž„์ž๊ฐ€ ๋ณ€๊ฒฝ๋˜์—ˆ์Œ์—๋„ ์ด๋ฅผ ์‹๋ณ„ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์‹๋ณ„๋œ ์ •๋ณด์ž์‚ฐ์— ๋Œ€ํ•œ ์ค‘์š”๋„ ํ‰๊ฐ€๋ฅผ ์‹ค์‹œํ•˜์—ฌ ๋ณด์•ˆ๋“ฑ๊ธ‰์„ ๋ถ€์—ฌํ•˜๊ณ  ์ •๋ณด ์ž์‚ฐ๋ชฉ๋ก์— ๊ธฐ๋กํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ณด์•ˆ๋“ฑ๊ธ‰์— ๋”ฐ๋ฅธ ์ทจ๊ธ‰์ ˆ์ฐจ๋ฅผ ์ •์˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.2.1", + "Name": "์ฃผ์š” ์ง๋ฌด์ž ์ง€์ • ๋ฐ ๊ด€๋ฆฌ", + "Description": "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ์ทจ๊ธ‰์ด๋‚˜ ์ฃผ์š” ์‹œ์Šคํ…œ ์ ‘๊ทผ ๋“ฑ ์ฃผ์š” ์ง๋ฌด์˜ ๊ธฐ์ค€๊ณผ ๊ด€๋ฆฌ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝํ•˜๊ณ , ์ฃผ์š” ์ง๋ฌด์ž๋ฅผ ์ตœ์†Œํ•œ์œผ๋กœ ์ง€์ •ํ•˜์—ฌ ๊ทธ ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "organizations_delegated_administrators", + "account_security_contact_information_is_registered", + "iam_support_role_created" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Section": "2.2.1 ์ฃผ์š” ์ง๋ฌด์ž ์ง€์ • ๋ฐ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ์ทจ๊ธ‰, ์ฃผ์š” ์‹œ์Šคํ…œ ์ ‘๊ทผ ๋“ฑ ์ฃผ์š” ์ง๋ฌด์˜ ๊ธฐ์ค€์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ์š” ์ง๋ฌด๋ฅผ ์ˆ˜ํ–‰ํ•˜๋Š” ์ž„์ง์› ๋ฐ ์™ธ๋ถ€์ž๋ฅผ ์ฃผ์š” ์ง๋ฌด์ž๋กœ ์ง€์ •ํ•˜๊ณ  ๊ทธ ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด์ƒ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ทจ๊ธ‰ํ•˜๋Š” ์ž๋ฅผ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๋กœ ์ง€์ •ํ•˜๊ณ  ๋ชฉ๋ก์„ ์ตœ์‹ ์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด ํ•„์š”์„ฑ์— ๋”ฐ๋ผ ์ฃผ์š” ์ง๋ฌด์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ์ง€์ •์„ ์ตœ์†Œํ™”ํ•˜๋Š” ๋“ฑ ๊ด€๋ฆฌ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ28์กฐ(๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž์— ๋Œ€ํ•œ ๊ฐ๋…), ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ฃผ์š” ์ง๋ฌด ๊ธฐ์ค€", + "์ฃผ์š”์ง๋ฌด์ž ๋ชฉ๋ก", + "๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋ชฉ๋ก", + "์ค‘์š” ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ๊ด€๋ฆฌ ๋Œ€์žฅ", + "์ฃผ์š” ์ง๋ฌด์ž์— ๋Œ€ํ•œ ๊ด€๋ฆฌ ํ˜„ํ™ฉ(๊ต์œก ๊ฒฐ๊ณผ, ๋ณด์•ˆ์„œ์•ฝ์„œ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ฃผ์š” ์ง๋ฌด์ž ๋ช…๋‹จ(๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋ช…๋‹จ, ๋น„๋ฐ€์ •๋ณด๊ด€๋ฆฌ์ž ๋ช…๋‹จ ๋“ฑ)์„ ์ž‘์„ฑํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋Œ€๋Ÿ‰์˜ ๊ฐœ์ธ์ •๋ณด ๋“ฑ ์ค‘์š”์ •๋ณด๋ฅผ ์ทจ๊ธ‰ํ•˜๋Š” ์ผ๋ถ€ ์ž„์ง์›(DBA, DLP ๊ด€๋ฆฌ์ž ๋“ฑ)์„ ๋ช…๋‹จ์— ๋ˆ„๋ฝํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ฃผ์š” ์ง๋ฌด์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋ชฉ๋ก์„ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ์œผ๋‚˜, ํ‡ด์‚ฌํ•œ ์ž„์ง์›์ด ํฌํ•จ๋˜์–ด ์žˆ๊ณ  ์ตœ๊ทผ ์‹ ๊ทœ ์ž…์‚ฌํ•œ ์ธ๋ ฅ์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š๋Š” ๋“ฑ ํ˜„ํ–‰ํ™” ๊ด€๋ฆฌ๊ฐ€ ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ถ€์„œ ๋‹จ์œ„๋กœ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๊ถŒํ•œ์„ ์ผ๊ด„ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ์–ด ์‹ค์ œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ทจ๊ธ‰ํ•  ํ•„์š”๊ฐ€ ์—†๋Š” ์ธ์›๊นŒ์ง€ ๊ณผ๋‹คํ•˜๊ฒŒ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๋กœ ์ง€์ •๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ์ฃผ์š” ์ง๋ฌด์ž ๊ถŒํ•œ ๋ถ€์—ฌ ์‹œ์—๋Š” ๋ณด์•ˆํŒ€์˜ ์Šน์ธ์„ ๋ฐ›๊ณ  ์ฃผ์š” ์ง๋ฌด์— ๋”ฐ๋ฅธ ๋ณด์•ˆ์„œ์•ฝ์„œ๋ฅผ ์ž‘์„ฑํ•˜๋„๋ก ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ณด์•ˆํŒ€ ์Šน์ธ ๋ฐ ๋ณด์•ˆ์„œ์•ฝ์„œ ์ž‘์„ฑ ์—†์ด ๋“ฑ๋ก๋œ ์ฃผ์š” ์ง๋ฌด์ž๊ฐ€ ๋‹ค์ˆ˜ ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.2.2", + "Name": "์ง๋ฌด ๋ถ„๋ฆฌ", + "Description": "๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์œผ๋กœ ์ธํ•œ ์ž ์žฌ์ ์ธ ํ”ผํ•ด ์˜ˆ๋ฐฉ์„ ์œ„ํ•˜์—ฌ ์ง๋ฌด ๋ถ„๋ฆฌ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋‹ค๋งŒ ๋ถˆ๊ฐ€ํ”ผํ•˜๊ฒŒ ์ง๋ฌด ๋ถ„๋ฆฌ๊ฐ€ ์–ด๋ ค์šด ๊ฒฝ์šฐ ๋ณ„๋„์˜ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Section": "2.2.2 ์ง๋ฌด ๋ถ„๋ฆฌ", + "AuditChecklist": [ + "๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์œผ๋กœ ์ธํ•œ ์ž ์žฌ์ ์ธ ํ”ผํ•ด ์˜ˆ๋ฐฉ์„ ์œ„ํ•˜์—ฌ ์ง๋ฌด ๋ถ„๋ฆฌ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ง๋ฌด ๋ถ„๋ฆฌ๊ฐ€ ์–ด๋ ค์šด ๊ฒฝ์šฐ ์ง๋ฌด์ž ๊ฐ„ ์ƒํ˜ธ ๊ฒ€ํ† , ์ƒ์œ„๊ด€๋ฆฌ์ž ์ •๊ธฐ ๋ชจ๋‹ˆํ„ฐ๋ง ๋ฐ ๋ณ€๊ฒฝ์‚ฌํ•ญ ์Šน์ธ, ์ฑ…์ž„์ถ”์ ์„ฑ ํ™•๋ณด ๋ฐฉ์•ˆ ๋“ฑ์˜ ๋ณด์™„ํ†ต์ œ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ง๋ฌด ๋ถ„๋ฆฌ ๊ด€๋ จ ์ง€์นจ(์ธ์  ๋ณด์•ˆ ์ง€์นจ ๋“ฑ)", + "์ง๋ฌด๊ธฐ์ˆ ์„œ(์‹œ์Šคํ…œ ์šด์˜ยท๊ด€๋ฆฌ, ๊ฐœ๋ฐœยท์šด์˜ ๋“ฑ)", + "์ง๋ฌด ๋ฏธ๋ถ„๋ฆฌ ์‹œ ๋ณด์™„ํ†ต์ œ ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์กฐ์ง์˜ ๊ทœ๋ชจ์™€ ์ธ์›์ด ๋‹ด๋‹น์ž๋ณ„ ์ง๋ฌด ๋ถ„๋ฆฌ๊ฐ€ ์ถฉ๋ถ„ํžˆ ๊ฐ€๋Šฅํ•œ ์กฐ์ง์ž„์—๋„ ์—…๋ฌด ํŽธ์˜์„ฑ๋งŒ์„ ์‚ฌ์œ ๋กœ ๋‚ด๋ถ€ ๊ทœ์ •์œผ๋กœ ์ •ํ•œ ์ง๋ฌด ๋ถ„๋ฆฌ ๊ธฐ์ค€์„ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์กฐ์ง์˜ ํŠน์„ฑ์ƒ ๊ฒฝ์˜์ง„์˜ ์Šน์ธ์„ ๋ฐ›์€ ํ›„ ๊ฐœ๋ฐœ๊ณผ ์šด์˜ ์ง๋ฌด๋ฅผ ๋ณ‘ํ–‰ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ง๋ฌด์ž ๊ฐ„ ์ƒํ˜ธ ๊ฒ€ํ† , ์ƒ์œ„๊ด€๋ฆฌ์ž์˜ ์ฃผ๊ธฐ์ ์ธ ์ง๋ฌด์ˆ˜ํ–‰ ๋ชจ๋‹ˆํ„ฐ๋ง ๋ฐ ๋ณ€๊ฒฝ ์‚ฌํ•ญ ๊ฒ€ํ† ยท์Šน์ธ, ์ง๋ฌด์ž์˜ ์ฑ…์ž„์ถ”์ ์„ฑ ํ™•๋ณด ๋“ฑ์˜ ๋ณด์™„ํ†ต์ œ ์ ˆ์ฐจ๊ฐ€ ๋งˆ๋ จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.2.3", + "Name": "๋ณด์•ˆ ์„œ์•ฝ", + "Description": "์ •๋ณด์ž์‚ฐ์„ ์ทจ๊ธ‰ํ•˜๊ฑฐ๋‚˜ ์ ‘๊ทผ๊ถŒํ•œ์ด ๋ถ€์—ฌ๋œ ์ž„์ง์›ยท์ž„์‹œ์ง์›ยท์™ธ๋ถ€์ž ๋“ฑ์ด ๋‚ด๋ถ€ ์ •์ฑ… ๋ฐ", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Section": "2.2.3 ๋ณด์•ˆ ์„œ์•ฝ", + "AuditChecklist": [ + "์‹ ๊ทœ ์ธ๋ ฅ ์ฑ„์šฉ ์‹œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฑ…์ž„์ด ๋ช…์‹œ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ž„์‹œ์ง์›, ์™ธ์ฃผ์šฉ์—ญ์ง์› ๋“ฑ ์™ธ๋ถ€์ž์—๊ฒŒ ์ •๋ณด์ž์‚ฐ์— ๋Œ€ํ•œ ์ ‘๊ทผ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•  ๊ฒฝ์šฐ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์— ๋Œ€ํ•œ ์ฑ…์ž„, ๋น„๋ฐ€์œ ์ง€ ์˜๋ฌด ๋“ฑ์ด ๋ช…์‹œ๋œ ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ž„์ง์› ํ‡ด์ง ์‹œ ๋ณ„๋„์˜ ๋น„๋ฐ€์œ ์ง€์— ๊ด€๋ จํ•œ ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ, ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๋น„๋ฐ€์œ ์ง€ ์„œ์•ฝ์„œ๋Š” ์•ˆ์ „ํ•˜๊ฒŒ ๋ณด๊ด€ํ•˜๊ณ  ํ•„์š”์‹œ ์‰ฝ๊ฒŒ ์ฐพ์•„๋ณผ ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์„œ์•ฝ์„œ(์ž„์ง์›, ์™ธ๋ถ€์ธ๋ ฅ)", + "๋น„๋ฐ€์œ ์ง€์„œ์•ฝ์„œ(ํ‡ด์ง์ž)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์‹ ๊ทœ ์ž…์‚ฌ์ž์— ๋Œ€ํ•ด์„œ๋Š” ์ž…์‚ฌ ์ ˆ์ฐจ์ƒ์— ๋ณด์•ˆ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›๋„๋ก ๊ทœ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ตœ๊ทผ์— ์ž…์‚ฌํ•œ ์ผ๋ถ€ ์ง์›์˜ ๋ณด์•ˆ์„œ์•ฝ์„œ ์ž‘์„ฑ์ด ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ž„์ง์›์— ๋Œ€ํ•ด์„œ๋Š” ๋ณด์•ˆ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›๊ณ  ์žˆ์œผ๋‚˜, ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ์ง์ ‘ ์ ‘์†์ด ๊ฐ€๋Šฅํ•œ ์™ธ์ฃผ ์ธ๋ ฅ์— ๋Œ€ํ•ด์„œ๋Š” ๋ณด์•ˆ์„œ์•ฝ์„œ๋ฅผ ๋ฐ›์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ œ์ถœ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์„œ์•ฝ์„œ๋ฅผ ๋ชจ์•„ ๋†“์€ ๋ฌธ์„œ์ฒ ์ด ๋น„์ธ๊ฐ€์ž๊ฐ€ ์ ‘๊ทผ ๊ฐ€๋Šฅํ•œ ์ƒํƒœ๋กœ ์‚ฌ๋ฌด์‹ค ์ฑ…์ƒ์— ๋ฐฉ์น˜๋˜์–ด ์žˆ๋Š” ๋“ฑ ๊ด€๋ฆฌ๊ฐ€ ๋ฏธํกํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž์— ๋Œ€ํ•˜์—ฌ ๋ณด์•ˆ์„œ์•ฝ์„œ๋งŒ ๋ฐ›๊ณ  ์žˆ์œผ๋‚˜, ๋ณด์•ˆ์„œ์•ฝ์„œ ๋‚ด์— ๋น„๋ฐ€์œ ์ง€์— ๋Œ€ํ•œ ๋‚ด์šฉ๋งŒ ์žˆ๊ณ  ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์— ๊ด€ํ•œ ์ฑ…์ž„ ๋ฐ ๋‚ด์šฉ์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.2.4", + "Name": "์ธ์‹์ œ๊ณ  ๋ฐ ๊ต์œกํ›ˆ๋ จ", + "Description": "์ž„์ง์› ๋ฐ ๊ด€๋ จ ์™ธ๋ถ€์ž๊ฐ€ ์กฐ์ง์˜ ๊ด€๋ฆฌ์ฒด๊ณ„์™€ ์ •์ฑ…์„ ์ดํ•ดํ•˜๊ณ  ์ง๋ฌด๋ณ„ ์ „๋ฌธ์„ฑ์„ ํ™•๋ณดํ•  ์ˆ˜ ์žˆ๋„๋ก ์—ฐ๊ฐ„ ์ธ์‹์ œ๊ณ  ํ™œ๋™ ๋ฐ ๊ต์œกํ›ˆ๋ จ ๊ณ„ํš์„ ์ˆ˜๋ฆฝยท์šด์˜ํ•˜๊ณ , ๊ทธ ๊ฒฐ๊ณผ์— ๋”ฐ๋ฅธ ํšจ๊ณผ์„ฑ์„ ํ‰๊ฐ€ํ•˜์—ฌ ๋‹ค์Œ ๊ณ„ํš์— ๋ฐ˜์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Section": "2.2.4 ์ธ์‹์ œ๊ณ  ๋ฐ ๊ต์œกํ›ˆ๋ จ", + "AuditChecklist": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก์˜ ์‹œ๊ธฐ, ๊ธฐ๊ฐ„, ๋Œ€์ƒ, ๋‚ด์šฉ, ๋ฐฉ๋ฒ• ๋“ฑ์˜ ๋‚ด์šฉ์ด ํฌํ•จ๋œ ์—ฐ๊ฐ„ ๊ต์œก ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ๊ฒฝ์˜์ง„์˜ ์Šน์ธ์„ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด ๋ชจ๋“  ์ž„์ง์›๊ณผ ์™ธ๋ถ€์ž๋ฅผ ๋Œ€์ƒ์œผ๋กœ ์—ฐ๊ฐ„ ๊ต์œก ๊ณ„ํš์— ๋”ฐ๋ผ ์—ฐ 1ํšŒ ์ด์ƒ ์ •๊ธฐ์ ์œผ๋กœ ๊ต์œก์„ ์ˆ˜ํ–‰ํ•˜๊ณ , ๊ด€๋ จ ๋ฒ•๊ทœ ๋ฐ ๊ทœ์ •์˜ ์ค‘๋Œ€ํ•œ ๋ณ€๊ฒฝ ์‹œ ์ด์— ๋Œ€ํ•œ ์ถ”๊ฐ€๊ต์œก์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ž„์ง์› ์ฑ„์šฉ ๋ฐ ์™ธ๋ถ€์ž ์‹ ๊ทœ ๊ณ„์•ฝ ์‹œ ์—…๋ฌด ์‹œ์ž‘ ์ „์— ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก์„ ์‹œํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "IT ๋ฐ ์ •๋ณด๋ณดํ˜ธ, ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์กฐ์ง ๋‚ด ์ž„์ง์›์€ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์™€ ๊ด€๋ จํ•˜์—ฌ ์ง๋ฌด๋ณ„ ์ „๋ฌธ์„ฑ ์ œ๊ณ ๋ฅผ ์œ„ํ•œ ๋ณ„๋„์˜ ๊ต์œก์„ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ต์œก์‹œํ–‰์— ๋Œ€ํ•œ ๊ธฐ๋ก์„ ๋‚จ๊ธฐ๊ณ  ๊ต์œก ํšจ๊ณผ์™€ ์ ์ •์„ฑ์„ ํ‰๊ฐ€ํ•˜์—ฌ ๋‹ค์Œ ๊ต์œก ๊ณ„ํš์— ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ26์กฐ(์—…๋ฌด์œ„ํƒ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ), ์ œ28์กฐ(๊ฐœ์ธ์ •๋ณด ์ทจ๊ธ‰์ž์— ๋Œ€ํ•œ ๊ฐ๋…), ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๊ณ„ํš์„œ", + "๊ต์œก ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ", + "๊ณตํ†ต, ์ง๋ฌด๋ณ„ ๊ต์œก์ž๋ฃŒ", + "๊ต์œก์ฐธ์„์ž ๋ชฉ๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ „๋…„๋„์—๋Š” ์—ฐ๊ฐ„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ดํ–‰ํ•˜์˜€์œผ๋‚˜, ๋‹นํ•ด ์—ฐ๋„์— ํƒ€๋‹นํ•œ ์‚ฌ์œ  ์—†์ด ์—ฐ๊ฐ„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์—ฐ๊ฐ„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๊ณ„ํš์— ๊ต์œก ์ฃผ๊ธฐ์™€ ๋Œ€์ƒ์€ ๋ช…์‹œํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์‹œํ–‰ ์ผ์ •, ๋‚ด์šฉ ๋ฐ ๋ฐฉ๋ฒ• ๋“ฑ์˜ ๋‚ด์šฉ์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์—ฐ๊ฐ„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๊ณ„ํš์— ์ „ ์ง์›์„ ๋Œ€์ƒ์œผ๋กœ ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ธ์‹ ๊ต์œก์€ ์ผ์ •์‹œ๊ฐ„ ๊ณ„ํš๋˜์–ด ์žˆ์œผ๋‚˜, ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด๋‹ด๋‹น์ž ๋“ฑ ์ง๋ฌด๋ณ„๋กœ ํ•„์š”ํ•œ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๊ต์œก ๊ณ„ํš์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๊ณ„ํš์„œ ๋ฐ ๊ฒฐ๊ณผ ๋ณด๊ณ ์„œ๋ฅผ ํ™•์ธํ•œ ๊ฒฐ๊ณผ, ์ธ์ฆ๋ฒ”์œ„ ๋‚ด์˜ ์ •๋ณด์ž์‚ฐ ๋ฐ ์„ค๋น„์— ์ ‘๊ทผํ•˜๋Š” ์™ธ์ฃผ์šฉ์—ญ์—…์ฒด ์ง์›(์ „์‚ฐ์‹ค ์ถœ์ž… ์ฒญ์†Œ์›, ๊ฒฝ๋น„์›, ์™ธ์ฃผ๊ฐœ๋ฐœ์ž ๋“ฑ)์„ ๊ต์œก ๋Œ€์ƒ์—์„œ ๋ˆ„๋ฝํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๋‹นํ•ด ์—ฐ๋„ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก์„ ์‹ค์‹œํ•˜์˜€์œผ๋‚˜, ๊ต์œก์‹œํ–‰ ๋ฐ ํ‰๊ฐ€์— ๊ด€ํ•œ ๊ธฐ๋ก(๊ต์œก ์ž๋ฃŒ, ์ถœ์„๋ถ€, ํ‰๊ฐ€ ์„ค๋ฌธ์ง€, ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ ๋“ฑ) ์ผ๋ถ€๋ฅผ ๋‚จ๊ธฐ์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ต์œก ๋ฏธ์ด์ˆ˜์ž๋ฅผ ํŒŒ์•…ํ•˜์ง€ ์•Š๊ณ  ์žˆ๊ฑฐ๋‚˜, ํ•ด๋‹น ๋ฏธ์ด์ˆ˜์ž์— ๋Œ€ํ•œ ์ถ”๊ฐ€๊ต์œก ๋ฐฉ๋ฒ•(์ „๋‹ฌ๊ต์œก, ์ถ”๊ฐ€๊ต์œก, ์˜จ๋ผ์ธ๊ต์œก ๋“ฑ)์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.2.5", + "Name": "ํ‡ด์ง ๋ฐ ์ง๋ฌด๋ณ€๊ฒฝ ๊ด€๋ฆฌ", + "Description": "ํ‡ด์ง ๋ฐ ์ง๋ฌด๋ณ€๊ฒฝ ์‹œ ์ธ์‚ฌยท์ •๋ณด๋ณดํ˜ธยท๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธยทIT ๋“ฑ ๊ด€๋ จ ๋ถ€์„œ๋ณ„ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•  ์ž์‚ฐ๋ฐ˜๋‚ฉ, ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ํšŒ์ˆ˜ยท์กฐ์ •, ๊ฒฐ๊ณผํ™•์ธ ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Section": "2.2.5 ํ‡ด์ง ๋ฐ ์ง๋ฌด๋ณ€๊ฒฝ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "ํ‡ด์ง, ์ง๋ฌด๋ณ€๊ฒฝ, ๋ถ€์„œ์ด๋™, ํœด์ง ๋“ฑ์œผ๋กœ ์ธํ•œ ์ธ์‚ฌ๋ณ€๊ฒฝ ๋‚ด์šฉ์ด ์ธ์‚ฌ๋ถ€์„œ, ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๋ถ€์„œ, ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ์šด์˜๋ถ€์„œ ๊ฐ„ ๊ณต์œ ๋˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์กฐ์ง ๋‚ด ์ธ๋ ฅ(์ž„์ง์›, ์ž„์‹œ์ง์›, ์™ธ์ฃผ์šฉ์—ญ์ง์› ๋“ฑ)์˜ ํ‡ด์ง ๋˜๋Š” ์ง๋ฌด๋ณ€๊ฒฝ ์‹œ ์ง€์ฒด ์—†๋Š” ์ •๋ณด์ž์‚ฐ ๋ฐ˜๋‚ฉ, ์ ‘๊ทผ๊ถŒํ•œ ํšŒ์ˆ˜ยท์กฐ์ •, ๊ฒฐ๊ณผ ํ™•์ธ ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "ํ‡ด์ง ๋ฐ ์ง๋ฌด๋ณ€๊ฒฝ ์ ˆ์ฐจ์„œ", + "ํ‡ด์ง ์‹œ ์ž์‚ฐ(๊ณ„์ •) ๋ฐ˜๋‚ฉ๊ด€๋ฆฌ๋Œ€์žฅ", + "ํ‡ด์ง์ž ๋ณด์•ˆ์ ๊ฒ€ ์ฒดํฌ๋ฆฌ์ŠคํŠธ ๋ฐ ์ ๊ฒ€ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ง๋ฌด ๋ณ€๋™์— ๋”ฐ๋ผ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž์—์„œ ์ œ์™ธ๋œ ์ธ๋ ฅ์˜ ๊ณ„์ •๊ณผ ๊ถŒํ•œ์ด ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ๊ทธ๋Œ€๋กœ ๋‚จ์•„ ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ตœ๊ทผ์— ํ‡ด์งํ•œ ์ฃผ์š”์ง๋ฌด์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž์— ๋Œ€ํ•˜์—ฌ ์ž์‚ฐ๋ฐ˜๋‚ฉ, ๊ถŒํ•œ ํšŒ์ˆ˜ ๋“ฑ์˜ ํ‡ด์ง์ ˆ์ฐจ ์ดํ–‰ ๊ธฐ๋ก์ด ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ž„์ง์› ํ‡ด์ง ์‹œ ์ž์‚ฐ๋ฐ˜๋‚ฉ ๊ด€๋ฆฌ๋Š” ์ž˜ ์ดํ–‰ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ธ์‚ฌ๊ทœ์ •์—์„œ ์ •ํ•œ ํ‡ด์ง์ž ๋ณด์•ˆ์ ๊ฒ€ ๋ฐ ํ‡ด์งํ™•์ธ์„œ๋ฅผ ์ž‘์„ฑํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ํ‡ด์ง ์‹œ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ์ ‘๊ทผ ๊ถŒํ•œ์€ ์ง€์ฒด ์—†์ด ํšŒ์ˆ˜๋˜์—ˆ์ง€๋งŒ, ์ถœ์ž…ํ†ต์ œ ์‹œ์Šคํ…œ ๋ฐ VPN ๋“ฑ ์ผ๋ถ€ ์‹œ์Šคํ…œ์˜ ์ ‘๊ทผ ๊ถŒํ•œ์ด ํšŒ์ˆ˜๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.2.6", + "Name": "๋ณด์•ˆ ์œ„๋ฐ˜ ์‹œ ์กฐ์น˜", + "Description": "์ž„์ง์› ๋ฐ ๊ด€๋ จ ์™ธ๋ถ€์ž๊ฐ€ ๋ฒ•๋ น, ๊ทœ์ œ ๋ฐ ๋‚ด๋ถ€์ •์ฑ…์„ ์œ„๋ฐ˜ํ•œ ๊ฒฝ์šฐ ์ด์— ๋”ฐ๋ฅธ ์กฐ์น˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.2. ์ธ์  ๋ณด์•ˆ", + "Section": "2.2.6 ๋ณด์•ˆ ์œ„๋ฐ˜ ์‹œ ์กฐ์น˜", + "AuditChecklist": [ + "์ž„์ง์› ๋ฐ ๊ด€๋ จ ์™ธ๋ถ€์ž๊ฐ€ ๋ฒ•๋ น๊ณผ ๊ทœ์ œ ๋ฐ ๋‚ด๋ถ€์ •์ฑ…์— ๋”ฐ๋ฅธ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ฑ…์ž„๊ณผ ์˜๋ฌด๋ฅผ ์œ„๋ฐ˜ํ•œ ๊ฒฝ์šฐ์— ๋Œ€ํ•œ ์ฒ˜๋ฒŒ ๊ทœ์ •์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ์œ„๋ฐ˜ ์‚ฌํ•ญ์ด ์ ๋ฐœ๋œ ๊ฒฝ์šฐ ๋‚ด๋ถ€ ์ ˆ์ฐจ์— ๋”ฐ๋ฅธ ์กฐ์น˜๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ธ์‚ฌ ๊ทœ์ •(์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๊ทœ์ • ์œ„๋ฐ˜์— ๋”ฐ๋ฅธ ์ฒ˜๋ฒŒ๊ทœ์ •)", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ง€์นจ ์œ„๋ฐ˜์ž ์ง•๊ณ„ ๋‚ด์—ญ", + "์‚ฌ๊ณ  ์‚ฌ๋ก€(์ „์‚ฌ ๊ณต์ง€, ๊ต์œก ๋‚ด์šฉ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ทœ์ • ์œ„๋ฐ˜์ž์— ๋Œ€ํ•œ ์ฒ˜๋ฆฌ ๊ธฐ์ค€ ๋ฐ ์ ˆ์ฐจ๊ฐ€ ๋‚ด๋ถ€ ๊ทœ์ •์— ์ „ํ˜€ ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ณด์•ˆ์‹œ์Šคํ…œ(DLP, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ์ œ์–ด์‹œ์Šคํ…œ, ๋‚ด๋ถ€์ •๋ณด์œ ์ถœํ†ต์ œ์‹œ์Šคํ…œ ๋“ฑ)์„ ํ†ตํ•˜์—ฌ ์ •์ฑ… ์œ„๋ฐ˜์ด ํƒ์ง€๋œ ๊ด€๋ จ์ž์—๊ฒŒ ๊ฒฝ๊ณ  ๋ฉ”์‹œ์ง€๋ฅผ ์ „๋‹ฌํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ์†Œ๋ช… ๋ฐ ์ถ”๊ฐ€ ์กฐ์‚ฌ, ์ง•๊ณ„ ์ฒ˜๋ถ„ ๋“ฑ ๋‚ด๋ถ€ ๊ทœ์ •์— ๋”ฐ๋ฅธ ํ›„์† ์กฐ์น˜๊ฐ€ ์ดํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.3.1", + "Name": "์™ธ๋ถ€์ž ํ˜„ํ™ฉ ๊ด€๋ฆฌ", + "Description": "์—…๋ฌด์˜ ์ผ๋ถ€(๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰, ์ •๋ณด๋ณดํ˜ธ, ์ •๋ณด์‹œ์Šคํ…œ ์šด์˜ ๋˜๋Š” ๊ฐœ๋ฐœ ๋“ฑ)๋ฅผ ์™ธ๋ถ€์— ์œ„ํƒํ•˜๊ฑฐ๋‚˜ ์™ธ๋ถ€์˜ ์‹œ์„ค ๋˜๋Š” ์„œ๋น„์Šค(์ง‘์ ์ •๋ณดํ†ต์‹ ์‹œ์„ค, ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค, ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ์„œ๋น„์Šค ๋“ฑ)๋ฅผ ์ด์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ํ˜„ํ™ฉ์„ ์‹๋ณ„ํ•˜๊ณ  ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ๋ฐ ์™ธ๋ถ€ ์กฐ์งยท์„œ๋น„์Šค๋กœ๋ถ€ํ„ฐ ๋ฐœ์ƒ๋˜๋Š” ์œ„ํ—˜์„ ํŒŒ์•…ํ•˜์—ฌ ์ ์ ˆํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Section": "2.3.1 ์™ธ๋ถ€์ž ํ˜„ํ™ฉ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด์—์„œ ๋ฐœ์ƒํ•˜๊ณ  ์žˆ๋Š” ์—…๋ฌด ์œ„ํƒ ๋ฐ ์™ธ๋ถ€ ์‹œ์„คยท์„œ๋น„์Šค์˜ ์ด์šฉ ํ˜„ํ™ฉ์„ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด ์œ„ํƒ ๋ฐ ์™ธ๋ถ€ ์‹œ์„คยท์„œ๋น„์Šค์˜ ์ด์šฉ์— ๋”ฐ๋ฅธ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ๊ณผ ์œ„ํ—˜์„ ํŒŒ์•…ํ•˜๊ณ  ์ ์ ˆํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ26์กฐ(์—…๋ฌด์œ„ํƒ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ50์กฐ์˜3(์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก์˜ ์œ„ํƒ ๋“ฑ)" + ], + "AuditEvidence": [ + "์™ธ๋ถ€ ์œ„ํƒ ๋ฐ ์™ธ๋ถ€ ์‹œ์„คยท์„œ๋น„์Šค ํ˜„ํ™ฉ", + "์™ธ๋ถ€ ์œ„ํƒ ๊ณ„์•ฝ์„œ", + "์œ„ํ—˜๋ถ„์„ ๋ณด๊ณ ์„œ ๋ฐ ๋ณดํ˜ธ๋Œ€์ฑ…", + "์œ„ํƒ ๋ณด์•ˆ๊ด€๋ฆฌ ์ง€์นจ, ์ฒดํฌ๋ฆฌ์ŠคํŠธ ๋“ฑ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ๊ทœ์ •์— ๋”ฐ๋ผ ์™ธ๋ถ€ ์œ„ํƒ ๋ฐ ์™ธ๋ถ€ ์‹œ์„คยท์„œ๋น„์Šค ํ˜„ํ™ฉ์„ ๋ชฉ๋ก์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ช‡ ๊ฐœ์›” ์ „์— ๋ณ€๊ฒฝ๋œ ์œ„ํƒ์—…์ฒด๊ฐ€ ๋ชฉ๋ก์— ๋ฐ˜์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๋“ฑ ํ˜„ํ–‰ํ™” ๊ด€๋ฆฌ๊ฐ€ ๋ฏธํกํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ด€๋ฆฌ์ฒด๊ณ„ ๋ฒ”์œ„ ๋‚ด ์ผ๋ถ€ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์„ ์™ธ๋ถ€ ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค๋กœ ์ด์ „ํ•˜์˜€์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ์‹๋ณ„ ๋ฐ ์œ„ํ—˜ํ‰๊ฐ€๊ฐ€ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.3.2", + "Name": "์™ธ๋ถ€์ž ๊ณ„์•ฝ ์‹œ ๋ณด์•ˆ", + "Description": "์™ธ๋ถ€ ์„œ๋น„์Šค๋ฅผ ์ด์šฉํ•˜๊ฑฐ๋‚˜ ์™ธ๋ถ€์ž์—๊ฒŒ ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ ์ด์— ๋”ฐ๋ฅธ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์š”๊ตฌ์‚ฌํ•ญ์„ ์‹๋ณ„ํ•˜๊ณ , ๊ด€๋ จ ๋‚ด์šฉ์„ ๊ณ„์•ฝ์„œ ๋˜๋Š” ํ˜‘์ •์„œ ๋“ฑ์— ๋ช…์‹œํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Section": "2.3.2 ์™ธ๋ถ€์ž ๊ณ„์•ฝ ์‹œ ๋ณด์•ˆ", + "AuditChecklist": [ + "์ค‘์š”์ •๋ณด ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์™€ ๊ด€๋ จ๋œ ์™ธ๋ถ€ ์„œ๋น„์Šค ๋ฐ ์œ„ํƒ ์—…์ฒด๋ฅผ ์„ ์ •ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ์—ญ๋Ÿ‰์„ ๊ณ ๋ คํ•˜๋„๋ก ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์™ธ๋ถ€ ์„œ๋น„์Šค ์ด์šฉ ๋ฐ ์—…๋ฌด ์œ„ํƒ์— ๋”ฐ๋ฅธ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์š”๊ตฌ์‚ฌํ•ญ์„ ์‹๋ณ„ํ•˜๊ณ  ์ด๋ฅผ ๊ณ„์•ฝ์„œ ๋˜๋Š” ํ˜‘์ •์„œ์— ๋ช…์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๊ฐœ๋ฐœ์„ ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ๋ฐœ ์‹œ ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•  ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์š”๊ตฌ์‚ฌํ•ญ์„ ๊ณ„์•ฝ์„œ์— ๋ช…์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ26์กฐ(์—…๋ฌด์œ„ํƒ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ)" + ], + "AuditEvidence": [ + "์œ„ํƒ ๊ณ„์•ฝ์„œ", + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ํ˜‘์•ฝ์„œ(์•ฝ์ •์„œ, ๋ถ€์†ํ•ฉ์˜์„œ)", + "์œ„ํƒ ๊ด€๋ จ ๋‚ด๋ถ€ ์ง€์นจ", + "์œ„ํƒ์—…์ฒด ์„ ์ • ๊ด€๋ จ RFP(์ œ์•ˆ์š”์ฒญ์„œ), ํ‰๊ฐ€ํ‘œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : IT ์šด์˜, ๊ฐœ๋ฐœ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๋Š” ์™ธ์ฃผ์šฉ์—ญ์—…์ฒด์— ๋Œ€ํ•œ ์œ„ํƒ๊ณ„์•ฝ์„œ๊ฐ€ ์กด์žฌํ•˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๋Š” ์™ธ๋ถ€์—…์ฒด์™€์˜ ์œ„ํƒ๊ณ„์•ฝ์„œ์ƒ์— ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ๋“ฑ ๋ฒ•๋ น์—์„œ ์š”๊ตฌํ•˜๋Š” ์ผ๋ถ€ ํ•ญ๋ชฉ(๊ด€๋ฆฌยท๊ฐ๋…์— ๊ด€ํ•œ ์‚ฌํ•ญ ๋“ฑ)์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ธํ”„๋ผ ์šด์˜๊ณผ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์ผ๋ถ€๋ฅผ ์™ธ๋ถ€์—…์ฒด์— ์œ„ํƒํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ณ„์•ฝ์„œ ๋“ฑ์—๋Š” ์œ„ํƒ์—…๋ฌด์˜ ํŠน์„ฑ์— ๋”ฐ๋ฅธ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์„ ์‹๋ณ„ยท๋ฐ˜์˜ํ•˜์ง€ ์•Š๊ณ  ๋น„๋ฐ€์œ ์ง€ ๋ฐ ์†ํ•ด๋ฐฐ์ƒ์— ๊ด€ํ•œ ์ผ๋ฐ˜ ์‚ฌํ•ญ๋งŒ ๊ทœ์ •ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.3.3", + "Name": "์™ธ๋ถ€์ž ๋ณด์•ˆ ์ดํ–‰ ๊ด€๋ฆฌ", + "Description": "๊ณ„์•ฝ์„œ, ํ˜‘์ •์„œ, ๋‚ด๋ถ€์ •์ฑ…์— ๋ช…์‹œ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ์™ธ๋ถ€์ž์˜ ๋ณดํ˜ธ๋Œ€์ฑ… ์ดํ–‰ ์—ฌ๋ถ€๋ฅผ ์ฃผ๊ธฐ์ ์ธ ์ ๊ฒ€ ๋˜๋Š” ๊ฐ์‚ฌ ๋“ฑ ๊ด€๋ฆฌยท๊ฐ๋…ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Section": "2.3.3 ์™ธ๋ถ€์ž ๋ณด์•ˆ ์ดํ–‰ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์™ธ๋ถ€์ž๊ฐ€ ๊ณ„์•ฝ์„œ, ํ˜‘์ •์„œ, ๋‚ด๋ถ€์ •์ฑ…์— ๋ช…์‹œ๋œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์š”๊ตฌ์‚ฌํ•ญ์„ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ๋Š”์ง€ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ ๋˜๋Š” ๊ฐ์‚ฌ๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์™ธ๋ถ€์ž์— ๋Œ€ํ•œ ์ ๊ฒ€ ๋˜๋Š” ๊ฐ์‚ฌ ์‹œ ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์— ๋Œ€ํ•˜์—ฌ ๊ฐœ์„ ๊ณ„ํš์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์œ„ํƒ๋ฐ›์€ ์ˆ˜ํƒ์ž๊ฐ€ ๊ด€๋ จ ์—…๋ฌด๋ฅผ ์ œ3์ž์—๊ฒŒ ์žฌ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ ์œ„ํƒ์ž์˜ ๋™์˜๋ฅผ ๋ฐ›๋„๋ก ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ26์กฐ(์—…๋ฌด์œ„ํƒ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ50์กฐ์˜3(์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก์˜ ์œ„ํƒ ๋“ฑ)" + ], + "AuditEvidence": [ + "์™ธ๋ถ€์ž ๋ฐ ์ˆ˜ํƒ์ž ๋ณด์•ˆ์ ๊ฒ€ ๊ฒฐ๊ณผ", + "์™ธ๋ถ€์ž ๋ฐ ์ˆ˜ํƒ์ž ๊ต์œก ๋‚ด์—ญ(๊ต์œก ๊ฒฐ๊ณผ, ์ฐธ์„์ž ๋ช…๋‹จ, ๊ต์œก๊ต์žฌ ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ์œ„ํƒ ๊ณ„์•ฝ์„œ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์žฌ์œ„ํƒ ์‹œ ์œ„ํƒ์ž ๋™์˜ ์ฆ๊ฑฐ์ž๋ฃŒ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํšŒ์‚ฌ ๋‚ด์— ์ƒ์ฃผํ•˜์—ฌ IT ๊ฐœ๋ฐœ ๋ฐ ์šด์˜ ์—…๋ฌด๋ฅผ ์ˆ˜ํ–‰ํ•˜๋Š” ์™ธ์ฃผ์—…์ฒด์— ๋Œ€ํ•ด์„œ๋Š” ์ •๊ธฐ์ ์œผ๋กœ ๋ณด์•ˆ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ์ˆ˜ํƒ์ž์— ๋Œ€ํ•˜์—ฌ ๋ณด์•ˆ๊ต์œก์„ ์‹ค์‹œํ•˜๋ผ๋Š” ๊ณต๋ฌธ์„ ๋ฐœ์†กํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ต์œก ์ˆ˜ํ–‰ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ˆ˜ํƒ์ž๊ฐ€ ์ž์ฒด์ ์œผ๋กœ ๋ณด์•ˆ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•œ ํ›„ ๊ทธ ๊ฒฐ๊ณผ๋ฅผ ํ†ต์ง€ํ•˜๋„๋ก ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ˆ˜ํƒ์ž๊ฐ€ ๋ณด์•ˆ ์ ๊ฒ€์„ ์ถฉ์‹คํžˆ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”์ง€ ์—ฌ๋ถ€์— ๋Œ€ํ•˜์—ฌ ํ™•์ธํ•˜๋Š” ์ ˆ์ฐจ๊ฐ€ ์กด์žฌํ•˜์ง€ ์•Š์•„ ๋ณด์•ˆ์ ๊ฒ€ ๊ฒฐ๊ณผ์˜ ์‹ ๋ขฐ์„ฑ์ด ๋งค์šฐ ๋–จ์–ด์ง€๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์ˆ˜ํƒ์ž ์ค‘ ์ผ๋ถ€๊ฐ€ ์œ„ํƒ์ž์˜ ๋™์˜ ์—†์ด ํ•ด๋‹น ์—…๋ฌด๋ฅผ ์ œ3์ž์—๊ฒŒ ์žฌ์œ„ํƒํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์˜๋ฆฌ ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด์ „์†ก ์—…๋ฌด๋ฅผ ํƒ€์ธ์—๊ฒŒ ์œ„ํƒํ•˜๋ฉด์„œ ์ˆ˜ํƒ์ž์— ๋Œ€ํ•œ ๊ด€๋ฆฌยท๊ฐ๋…์„ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.3.4", + "Name": "์™ธ๋ถ€์ž ๊ณ„์•ฝ ๋ณ€๊ฒฝ ๋ฐ ๋งŒ๋ฃŒ ์‹œ ๋ณด์•ˆ", + "Description": "์™ธ๋ถ€์ž ๊ณ„์•ฝ๋งŒ๋ฃŒ, ์—…๋ฌด์ข…๋ฃŒ, ๋‹ด๋‹น์ž ๋ณ€๊ฒฝ ์‹œ์—๋Š” ์ œ๊ณตํ•œ ์ •๋ณด์ž์‚ฐ ๋ฐ˜๋‚ฉ, ์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ๊ณ„์ • ์‚ญ์ œ, ์ค‘์š”์ •๋ณด ํŒŒ๊ธฐ, ์—…๋ฌด ์ˆ˜ํ–‰ ์ค‘ ์ทจ๋“์ •๋ณด์˜ ๋น„๋ฐ€์œ ์ง€ ํ™•์•ฝ์„œ ์ง•๊ตฌ ๋“ฑ์˜ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.3. ์™ธ๋ถ€์ž ๋ณด์•ˆ", + "Section": "2.3.4 ์™ธ๋ถ€์ž ๊ณ„์•ฝ ๋ณ€๊ฒฝ ๋ฐ ๋งŒ๋ฃŒ ์‹œ ๋ณด์•ˆ", + "AuditChecklist": [ + "์™ธ๋ถ€์ž ๊ณ„์•ฝ๋งŒ๋ฃŒ, ์—…๋ฌด ์ข…๋ฃŒ, ๋‹ด๋‹น์ž ๋ณ€๊ฒฝ ์‹œ ๊ณต์‹์ ์ธ ์ ˆ์ฐจ์— ๋”ฐ๋ฅธ ์ •๋ณด์ž์‚ฐ ๋ฐ˜๋‚ฉ, ์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ๊ณ„์ • ์‚ญ์ œ, ๋น„๋ฐ€์œ ์ง€ ํ™•์•ฝ์„œ ์ง•๊ตฌ ๋“ฑ์ด ์ด๋ฃจ์–ด์งˆ ์ˆ˜ ์žˆ๋„๋ก ๋ณด์•ˆ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์™ธ๋ถ€์ž ๊ณ„์•ฝ ๋งŒ๋ฃŒ ์‹œ ์œ„ํƒ ์—…๋ฌด์™€ ๊ด€๋ จํ•˜์—ฌ ์™ธ๋ถ€์ž๊ฐ€ ์ค‘์š”์ •๋ณด ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ณด์œ ํ•˜๊ณ  ์žˆ๋Š”์ง€ ํ™•์ธํ•˜๊ณ  ์ด๋ฅผ ํšŒ์ˆ˜ยทํŒŒ๊ธฐํ•  ์ˆ˜ ์žˆ๋„๋ก ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ26์กฐ(์—…๋ฌด์œ„ํƒ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ50์กฐ์˜3(์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก์˜ ์œ„ํƒ ๋“ฑ)" + ], + "AuditEvidence": [ + "์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์„œ์•ฝ์„œ", + "๋น„๋ฐ€์œ ์ง€ ํ™•์•ฝ์„œ", + "์ •๋ณด ๋ฐ ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ํ™•์•ฝ์„œ", + "์™ธ๋ถ€์ž ๊ณ„์•ฝ ์ข…๋ฃŒ์™€ ๊ด€๋ จ๋œ ๋‚ด๋ถ€ ์ •์ฑ…, ์ง€์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ผ๋ถ€ ์ •๋ณด์‹œ์Šคํ…œ์—์„œ ๊ณ„์•ฝ ๋งŒ๋ฃŒ๋œ ์™ธ๋ถ€์ž์˜ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ์ด ์‚ญ์ œ๋˜์ง€ ์•Š๊ณ  ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์™ธ์ฃผ์šฉ์—ญ์‚ฌ์—… ์ˆ˜ํ–‰๊ณผ์ •์—์„œ ์ผ๋ถ€ ์šฉ์—ญ์—…์ฒด ๋‹ด๋‹น์ž๊ฐ€ ๊ต์ฒด๋˜๊ฑฐ๋‚˜ ๊ณ„์•ฝ ๋งŒ๋ฃŒ๋กœ ํ‡ด์งํ•˜์˜€์œผ๋‚˜, ๊ด€๋ จ ์ธ๋ ฅ๋“ค์— ๋Œ€ํ•œ ํ‡ด์‚ฌ ์‹œ ๋ณด์•ˆ์„œ์•ฝ์„œ ๋“ฑ ๋‚ด๋ถ€ ๊ทœ์ •์— ๋”ฐ๋ฅธ ์กฐ์น˜๊ฐ€ ์ดํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ์œ„ํƒํ•œ ์—…์ฒด์™€ ๊ณ„์•ฝ ์ข…๋ฃŒ ์ดํ›„ ๋ณด์œ ํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜์˜€๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ํ™•์ธยท์ ๊ฒ€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.1", + "Name": "๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ •", + "Description": "๋ฌผ๋ฆฌ์ ยทํ™˜๊ฒฝ์  ์œ„ํ˜‘์œผ๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด, ๋ฌธ์„œ, ์ €์žฅ๋งค์ฒด, ์ฃผ์š” ์„ค๋น„ ๋ฐ ์‹œ์Šคํ…œ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ํ†ต์ œ๊ตฌ์—ญยท์ œํ•œ๊ตฌ์—ญยท์ ‘๊ฒฌ๊ตฌ์—ญ ๋“ฑ ๋ฌผ๋ฆฌ์  ๋ณดํ˜ธ๊ตฌ์—ญ์„ ์ง€์ •ํ•˜๊ณ  ๊ตฌ์—ญ๋ณ„ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.1 ๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ •", + "AuditChecklist": [ + "๋ฌผ๋ฆฌ์ ยทํ™˜๊ฒฝ์  ์œ„ํ˜‘์œผ๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด, ๋ฌธ์„œ, ์ €์žฅ๋งค์ฒด, ์ฃผ์š” ์„ค๋น„ ๋ฐ ์‹œ์Šคํ…œ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ํ†ต์ œ๊ตฌ์—ญ, ์ œํ•œ๊ตฌ์—ญ, ์ ‘๊ฒฌ๊ตฌ์—ญ ๋“ฑ ๋ฌผ๋ฆฌ์  ๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ •๊ธฐ์ค€์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฌผ๋ฆฌ์  ๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ •๊ธฐ์ค€์— ๋”ฐ๋ผ ๋ณดํ˜ธ๊ตฌ์—ญ์„ ์ง€์ •ํ•˜๊ณ  ๊ตฌ์—ญ๋ณ„ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ10์กฐ(๋ฌผ๋ฆฌ์  ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "๋ฌผ๋ฆฌ์  ๋ณด์•ˆ ์ง€์นจ(๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ • ๊ธฐ์ค€)", + "๋ณดํ˜ธ๊ตฌ์—ญ ์ง€์ • ํ˜„ํ™ฉ", + "๋ณดํ˜ธ๊ตฌ์—ญ ํ‘œ์‹œ", + "๋ณดํ˜ธ๊ตฌ์—ญ๋ณ„ ๋ณดํ˜ธ๋Œ€์ฑ… ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ๋ฌผ๋ฆฌ๋ณด์•ˆ ์ง€์นจ์—๋Š” ๊ฐœ์ธ์ •๋ณด ๋ณด๊ด€์‹œ์„ค ๋ฐ ์‹œ์Šคํ…œ ๊ตฌ์—ญ์„ ํ†ต์ œ๊ตฌ์—ญ์œผ๋กœ ์ง€์ •ํ•œ๋‹ค๊ณ  ๋ช…์‹œ๋˜์–ด ์žˆ์œผ๋‚˜, ๋ฉค๋ฒ„์‹ญ ๊ฐ€์ž…์‹ ์ฒญ ์„œ๋ฅ˜๊ฐ€ ๋ณด๊ด€๋˜์–ด ์žˆ๋Š” ๋ฌธ์„œ๊ณ  ๋“ฑ ์ผ๋ถ€ ๋Œ€์ƒ ๊ตฌ์—ญ์ด ํ†ต์ œ๊ตฌ์—ญ์—์„œ ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ๋ฌผ๋ฆฌ๋ณด์•ˆ ์ง€์นจ์— ํ†ต์ œ๊ตฌ์—ญ์— ๋Œ€ํ•ด์„œ๋Š” ์ง€์ •๋œ ์–‘์‹์˜ ํ†ต์ œ๊ตฌ์—ญ ํ‘œ์ง€ํŒ์„ ์„ค์น˜ํ•˜๋„๋ก ๋ช…์‹œํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ผ๋ถ€ ํ†ต์ œ๊ตฌ์—ญ์— ํ‘œ์‹œํŒ์„ ์„ค์น˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.2", + "Name": "์ถœ์ž…ํ†ต์ œ", + "Description": "๋ณดํ˜ธ๊ตฌ์—ญ์€ ์ธ๊ฐ€๋œ ์‚ฌ๋žŒ๋งŒ์ด ์ถœ์ž…ํ•˜๋„๋ก ํ†ต์ œํ•˜๊ณ  ์ฑ…์ž„์ถ”์ ์„ฑ์„ ํ™•๋ณดํ•  ์ˆ˜ ์žˆ๋„๋ก ์ถœ์ž… ๋ฐ ์ ‘๊ทผ ์ด๋ ฅ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.2 ์ถœ์ž…ํ†ต์ œ", + "AuditChecklist": [ + "๋ณดํ˜ธ๊ตฌ์—ญ์€ ์ถœ์ž…์ ˆ์ฐจ์— ๋”ฐ๋ผ ์ถœ์ž…์ด ํ—ˆ๊ฐ€๋œ ์ž๋งŒ ์ถœ์ž…ํ•˜๋„๋ก ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐ ๋ณดํ˜ธ๊ตฌ์—ญ์— ๋Œ€ํ•œ ๋‚ดยท์™ธ๋ถ€์ž ์ถœ์ž…๊ธฐ๋ก์„ ์ผ์ •๊ธฐ๊ฐ„ ๋ณด์กดํ•˜๊ณ  ์ถœ์ž…๊ธฐ๋ก ๋ฐ ์ถœ์ž…๊ถŒํ•œ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ10์กฐ(๋ฌผ๋ฆฌ์  ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "์ถœ์ž… ๊ด€๋ฆฌ๋Œ€์žฅ ๋ฐ ์ถœ์ž…๋กœ๊ทธ", + "์ถœ์ž… ๋“ฑ๋ก ์‹ ์ฒญ์„œ ๋ฐ ์Šน์ธ ๋‚ด์—ญ", + "์ถœ์ž…๊ธฐ๋ก ๊ฒ€ํ† ์„œ", + "์ถœ์ž…ํ†ต์ œ์‹œ์Šคํ…œ ๊ด€๋ฆฌํ™”๋ฉด(์ถœ์ž…์ž ๋“ฑ๋ก ํ˜„ํ™ฉ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํ†ต์ œ๊ตฌ์—ญ์„ ์ •์˜ํ•˜์—ฌ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ถœ์ž… ๊ฐ€๋Šฅํ•œ ์ž„์ง์›์„ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ถœ์ž…๊ธฐ๋ก์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์ง€ ์•Š์•„ ํ‡ด์ง, ์ „๋ฐฐ ๋“ฑ์— ๋”ฐ๋ฅธ ์žฅ๊ธฐ ๋ฏธ์ถœ์ž…์ž๊ฐ€ ๋‹ค์ˆ˜ ์กด์žฌํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ „์‚ฐ์‹ค, ๋ฌธ์„œ๊ณ  ๋“ฑ ํ†ต์ œ๊ตฌ์—ญ์— ์ถœ์ž…ํ†ต์ œ ์žฅ์น˜๊ฐ€ ์„ค์น˜๋˜์–ด ์žˆ์œผ๋‚˜, ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋˜๋Š” ์Šน์ธ ์—†์ด ์žฅ์‹œ๊ฐ„ ๊ฐœ๋ฐฉ ์ƒํƒœ๋กœ ์œ ์ง€ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ผ๋ถ€ ์™ธ๋ถ€ ํ˜‘๋ ฅ์—…์ฒด ์ง์›์—๊ฒŒ ๊ณผ๋„ํ•˜๊ฒŒ ์ „ ๊ตฌ์—ญ์„ ์ƒ์‹œ ์ถœ์ž…ํ•  ์ˆ˜ ์žˆ๋Š” ์ถœ์ž…์นด๋“œ๋ฅผ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.3", + "Name": "์ •๋ณด์‹œ์Šคํ…œ ๋ณดํ˜ธ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ์€ ํ™˜๊ฒฝ์  ์œ„ํ˜‘๊ณผ ์œ ํ•ด์š”์†Œ, ๋น„์ธ๊ฐ€ ์ ‘๊ทผ ๊ฐ€๋Šฅ์„ฑ์„ ๊ฐ์†Œ์‹œํ‚ฌ ์ˆ˜ ์žˆ๋„๋ก ์ค‘์š”๋„์™€ ํŠน์„ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ๋ฐฐ์น˜ํ•˜๊ณ , ํ†ต์‹  ๋ฐ ์ „๋ ฅ ์ผ€์ด๋ธ”์ด ์†์ƒ์„ ์ž…์ง€ ์•Š๋„๋ก ๋ณดํ˜ธํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.3 ์ •๋ณด์‹œ์Šคํ…œ ๋ณดํ˜ธ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์˜ ์ค‘์š”๋„, ์šฉ๋„, ํŠน์„ฑ ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ๋ฐฐ์น˜ ์žฅ์†Œ๋ฅผ ๋ถ„๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์˜ ์‹ค์ œ ๋ฌผ๋ฆฌ์  ์œ„์น˜๋ฅผ ์†์‰ฝ๊ฒŒ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ์•ˆ์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ „๋ ฅ ๋ฐ ํ†ต์‹ ์ผ€์ด๋ธ”์„ ์™ธ๋ถ€๋กœ๋ถ€ํ„ฐ์˜ ๋ฌผ๋ฆฌ์  ์†์ƒ ๋ฐ ์ „๊ธฐ์  ์˜ํ–ฅ์œผ๋กœ๋ถ€ํ„ฐ ์•ˆ์ „ํ•˜๊ฒŒ ๋ณดํ˜ธํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด์ฒ˜๋ฆฌ์‹œ์„ค ๋„๋ฉด", + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐฐ์น˜๋„", + "์ž์‚ฐ๋ชฉ๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์‹œ์Šคํ…œ ๋ฐฐ์น˜๋„๊ฐ€ ์ตœ์‹  ๋ณ€๊ฒฝ์‚ฌํ•ญ์„ ๋ฐ˜์˜ํ•˜์—ฌ ์—…๋ฐ์ดํŠธ๋˜์ง€ ์•Š์•„ ์žฅ์• ๊ฐ€ ๋ฐœ์ƒ๋œ ์ •๋ณด์‹œ์Šคํ…œ์„ ์‹ ์†ํ•˜๊ฒŒ ํ™•์ธํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์„œ๋ฒ„์‹ค ๋ฐ”๋‹ฅ ๋˜๋Š” ๋ž™์— ๋งŽ์€ ์ผ€์ด๋ธ”์ด ์ •๋ฆฌ๋˜์ง€ ์•Š๊ณ  ๋’ค์—‰์ผœ ์žˆ์–ด ์ „๊ธฐ์ ์œผ๋กœ ๊ฐ„์„ญ, ์†์ƒ, ๋ˆ„์ˆ˜, ๋ถ€์ฃผ์˜ ๋“ฑ์— ์˜ํ•œ ์žฅ์•  ๋ฐœ์ƒ์ด ์šฐ๋ ค๋˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.4", + "Name": "๋ณดํ˜ธ์„ค๋น„ ์šด์˜", + "Description": "๋ณดํ˜ธ๊ตฌ์—ญ์— ์œ„์น˜ํ•œ ์ •๋ณด์‹œ์Šคํ…œ์˜ ์ค‘์š”๋„ ๋ฐ ํŠน์„ฑ์— ๋”ฐ๋ผ ์˜จยท์Šต๋„ ์กฐ์ ˆ, ํ™”์žฌ๊ฐ์ง€, ์†Œํ™”์„ค๋น„, ๋ˆ„์ˆ˜๊ฐ์ง€, UPS, ๋น„์ƒ๋ฐœ์ „๊ธฐ, ์ด์ค‘์ „์›์„  ๋“ฑ์˜ ๋ณดํ˜ธ์„ค๋น„๋ฅผ ๊ฐ–์ถ”๊ณ  ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์šด์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.4 ๋ณดํ˜ธ์„ค๋น„ ์šด์˜", + "AuditChecklist": [ + "๊ฐ ๋ณดํ˜ธ๊ตฌ์—ญ์˜ ์ค‘์š”๋„ ๋ฐ ํŠน์„ฑ์— ๋”ฐ๋ผ ํ™”์žฌ, ์ˆ˜ํ•ด, ์ „๋ ฅ ์ด์ƒ ๋“ฑ ์ธ์žฌ ๋ฐ ์ž์—ฐ์žฌํ•ด ๋“ฑ์— ๋Œ€๋น„ํ•˜์—ฌ ํ•„์š”ํ•œ ์„ค๋น„๋ฅผ ๊ฐ–์ถ”๊ณ  ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์™ธ๋ถ€ ์ง‘์ ์ •๋ณดํ†ต์‹ ์‹œ์„ค(IDC)์— ์œ„ํƒ ์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ๋ฌผ๋ฆฌ์  ๋ณดํ˜ธ์— ํ•„์š”ํ•œ ์š”๊ตฌ์‚ฌํ•ญ์„ ๊ณ„์•ฝ์„œ์— ๋ฐ˜์˜ํ•˜๊ณ  ์šด์˜์ƒํƒœ๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ46์กฐ(์ง‘์ ๋œ ์ •๋ณดํ†ต์‹ ์‹œ์„ค์˜ ๋ณดํ˜ธ)", + "์ง‘์ ์ •๋ณด ํ†ต์‹ ์‹œ์„ค ๋ณดํ˜ธ์ง€์นจ", + "์†Œ๋ฐฉ์‹œ์„ค ์„ค์น˜ ๋ฐ ๊ด€๋ฆฌ์— ๊ด€ํ•œ ๋ฒ•๋ฅ (์†Œ๋ฐฉ์‹œ์„ค๋ฒ•) ์ œ12์กฐ(ํŠน์ •์†Œ๋ฐฉ๋Œ€์ƒ๋ฌผ์— ์„ค์น˜ํ•˜๋Š” ์†Œ๋ฐฉ์‹œ์„ค์˜ ๊ด€๋ฆฌ ๋“ฑ), ์ œ16์กฐ(ํ”ผ๋‚œ์‹œ์„ค, ๋ฐฉํ™”๊ตฌ์—ญ ๋ฐ ๋ฐฉํ™”์‹œ์„ค์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "๋ฌผ๋ฆฌ์  ๋ณด์•ˆ ์ง€์นจ(๋ณดํ˜ธ์„ค๋น„ ๊ด€๋ จ)", + "์ „์‚ฐ์‹ค ์„ค๋น„ ํ˜„ํ™ฉ ๋ฐ ์ ๊ฒ€ํ‘œ", + "IDC ์œ„ํƒ์šด์˜ ๊ณ„์•ฝ์„œ, SLA ๋“ฑ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋ณธ์‚ฌ ์ „์‚ฐ์‹ค ๋“ฑ ์ผ๋ถ€ ๋ณดํ˜ธ๊ตฌ์—ญ์— ๋‚ด๋ถ€ ์ง€์นจ์— ์ •ํ•œ ๋ณดํ˜ธ์„ค๋น„๋ฅผ ๊ฐ–์ถ”๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ „์‚ฐ์‹ค ๋‚ด์— UPS, ์†Œํ™”์„ค๋น„ ๋“ฑ์˜ ๋ณดํ˜ธ์„ค๋น„๋Š” ๊ฐ–์ถ”๊ณ  ์žˆ์œผ๋‚˜, ๊ด€๋ จ ์„ค๋น„์— ๋Œ€ํ•œ ์šด์˜ ๋ฐ ์ ๊ฒ€ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์šด์˜์ง€์นจ์— ๋”ฐ๋ผ ์ „์‚ฐ์‹ค ๋‚ด์— ์˜จยท์Šต๋„ ์กฐ์ ˆ๊ธฐ๋ฅผ ์„ค์น˜ํ•˜์˜€์œผ๋‚˜, ์šฉ๋Ÿ‰ ๋ถ€์กฑ์œผ๋กœ ์ธํ•˜์—ฌ ํ‘œ์ค€ ์˜จยท์Šต๋„๋ฅผ ์œ ์ง€ํ•˜์ง€ ๋ชปํ•˜์—ฌ ์žฅ์• ๋ฐœ์ƒ ๊ฐ€๋Šฅ์„ฑ์ด ๋†’์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.5", + "Name": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…", + "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด์—์„œ์˜ ๋น„์ธ๊ฐ€ํ–‰์œ„ ๋ฐ ๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•œ ์ž‘์—… ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ์ดํ–‰ํ•˜๊ณ , ์ž‘์—… ๊ธฐ๋ก์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.5 ๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ ๋„์ž…, ์œ ์ง€๋ณด์ˆ˜ ๋“ฑ์œผ๋กœ ๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…์ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ์— ๋Œ€ํ•œ ๊ณต์‹์ ์ธ ์ž‘์—…์‹ ์ฒญ ๋ฐ ์ˆ˜ํ–‰ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—…์ด ํ†ต์ œ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์ ์ ˆํžˆ ์ˆ˜ํ–‰๋˜์—ˆ๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ž‘์—… ๊ธฐ๋ก์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ž‘์—… ์‹ ์ฒญ์„œ, ์ž‘์—… ์ผ์ง€", + "ํ†ต์ œ๊ตฌ์—ญ ์ถœ์ž… ๋Œ€์žฅ", + "ํ†ต์ œ๊ตฌ์—ญ์— ๋Œ€ํ•œ ์ถœ์ž…๊ธฐ๋ก ๋ฐ ์ž‘์—… ๊ธฐ๋ก ๊ฒ€ํ†  ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ „์‚ฐ์‹ค ์ถœ์ž…๋กœ๊ทธ์—๋Š” ์™ธ๋ถ€ ์œ ์ง€๋ณด์ˆ˜ ์—…์ฒด ์ง์›์˜ ์ถœ์ž…๊ธฐ๋ก์ด ๋‚จ์•„ ์žˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ๋ณดํ˜ธ๊ตฌ์—ญ ์ž‘์—… ์‹ ์ฒญ ๋ฐ ์Šน์ธ ๋‚ด์—ญ์ด ์กด์žฌํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ(๋‚ด๋ถ€ ๊ทœ์ •์— ๋”ฐ๋ฅธ ๋ณดํ˜ธ๊ตฌ์—ญ ์ž‘์—… ์‹ ์ฒญ ์—†์ด ๋ณดํ˜ธ๊ตฌ์—ญ ์ถœ์ž… ๋ฐ ์ž‘์—…์ด ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ)", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—… ๊ธฐ๋ก์— ๋Œ€ํ•˜์—ฌ ๋ถ„๊ธฐ๋ณ„ 1ํšŒ ์ด์ƒ ์ ๊ฒ€ํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ํŠน๋ณ„ํ•œ ์‚ฌ์œ  ์—†์ด ์žฅ๊ธฐ๊ฐ„ ๋™์•ˆ ๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ž‘์—… ๊ธฐ๋ก์— ๋Œ€ํ•œ ์ ๊ฒ€์ด ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.6", + "Name": "๋ฐ˜์ถœ์ž… ๊ธฐ๊ธฐ ํ†ต์ œ", + "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ์ •๋ณด์‹œ์Šคํ…œ, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ, ์ €์žฅ๋งค์ฒด ๋“ฑ์— ๋Œ€ํ•œ ๋ฐ˜์ถœ์ž… ํ†ต์ œ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ์ดํ–‰ํ•˜๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.6 ๋ฐ˜์ถœ์ž… ๊ธฐ๊ธฐ ํ†ต์ œ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ, ์ €์žฅ๋งค์ฒด ๋“ฑ์„ ๋ณดํ˜ธ๊ตฌ์—ญ์— ๋ฐ˜์ž…ํ•˜๊ฑฐ๋‚˜ ๋ฐ˜์ถœํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์œ ์ถœ, ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ ๋“ฑ ๋ณด์•ˆ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ์„ ์œ„ํ•œ ํ†ต์ œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฐ˜์ถœ์ž… ํ†ต์ œ์ ˆ์ฐจ์— ๋”ฐ๋ฅธ ๊ธฐ๋ก์„ ์œ ์ง€ยท๊ด€๋ฆฌํ•˜๊ณ , ์ ˆ์ฐจ ์ค€์ˆ˜ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ฐ˜์ถœ์ž… ์ด๋ ฅ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ10์กฐ(๋ฌผ๋ฆฌ์  ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "๋ณดํ˜ธ๊ตฌ์—ญ ๋‚ด ๋ฐ˜์ถœ์ž… ์‹ ์ฒญ์„œ", + "๋ฐ˜์ถœ์ž… ๊ด€๋ฆฌ๋Œ€์žฅ", + "๋ฐ˜์ถœ์ž… ์ด๋ ฅ ๊ฒ€ํ†  ๊ฒฐ๊ณผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ด๋™์ปดํ“จํŒ…๊ธฐ๊ธฐ ๋ฐ˜์ถœ์ž…์— ๋Œ€ํ•œ ํ†ต์ œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ์œผ๋‚˜, ํ†ต์ œ๊ตฌ์—ญ ๋‚ด ์ด๋™์ปดํ“จํŒ…๊ธฐ๊ธฐ ๋ฐ˜์ž…์— ๋Œ€ํ•œ ํ†ต์ œ๋ฅผ ํ•˜๊ณ  ์žˆ์ง€ ์•Š์•„ ์ถœ์ž…์ด ํ—ˆ์šฉ๋œ ๋‚ดยท์™ธ๋ถ€์ธ์ด ์ด๋™์ปดํ“จํŒ…๊ธฐ๊ธฐ๋ฅผ ์ œ์•ฝ ์—†์ด ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ์ง€์นจ์— ๋”ฐ๋ผ ์ „์‚ฐ์žฅ๋น„ ๋ฐ˜์ถœ์ž…์ด ์žˆ๋Š” ๊ฒฝ์šฐ ์ž‘์—…๊ณ„ํš์„œ์— ๋ฐ˜์ถœ์ž… ๋‚ด์šฉ์„ ๊ธฐ์žฌํ•˜๊ณ  ๊ด€๋ฆฌ ์ฑ…์ž„์ž์˜ ์„œ๋ช…์„ ๋ฐ›๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์ž‘์—…๊ณ„ํš์„œ์˜ ๋ฐ˜์ถœ์ž… ๊ธฐ๋ก์— ๊ด€๋ฆฌ์ฑ…์ž„์ž์˜ ์„œ๋ช…์ด ๋‹ค์ˆ˜ ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.4.7", + "Name": "์—…๋ฌดํ™˜๊ฒฝ ๋ณด์•ˆ", + "Description": "๊ณต์šฉ์œผ๋กœ ์‚ฌ์šฉํ•˜๋Š” ์‚ฌ๋ฌด์šฉ ๊ธฐ๊ธฐ(๋ฌธ์„œ๊ณ , ๊ณต์šฉ PC, ๋ณตํ•ฉ๊ธฐ, ํŒŒ์ผ์„œ๋ฒ„ ๋“ฑ) ๋ฐ ๊ฐœ์ธ ์—…๋ฌดํ™˜๊ฒฝ(์—…๋ฌด์šฉ PC, ์ฑ…์ƒ ๋“ฑ)์„ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๊ฐ€ ๋น„์ธ๊ฐ€์ž์—๊ฒŒ ๋…ธ์ถœ ๋˜๋Š” ์œ ์ถœ๋˜์ง€ ์•Š๋„๋ก ํด๋ฆฐ๋ฐ์Šคํฌ, ์ •๊ธฐ์ ๊ฒ€ ๋“ฑ ์—…๋ฌดํ™˜๊ฒฝ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.4. ๋ฌผ๋ฆฌ ๋ณด์•ˆ", + "Section": "2.4.7 ์—…๋ฌดํ™˜๊ฒฝ ๋ณด์•ˆ", + "AuditChecklist": [ + "๋ฌธ์„œ๊ณ , ๊ณต์šฉ PC, ๋ณตํ•ฉ๊ธฐ, ํŒŒ์ผ์„œ๋ฒ„ ๋“ฑ ๊ณต์šฉ์œผ๋กœ ์‚ฌ์šฉํ•˜๋Š” ์‹œ์„ค ๋ฐ ์‚ฌ๋ฌด์šฉ ๊ธฐ๊ธฐ์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด์šฉ PC, ์ฑ…์ƒ, ์„œ๋ž ๋“ฑ ๊ฐœ์ธ์—…๋ฌด ํ™˜๊ฒฝ์„ ํ†ตํ•œ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ์œ ยท๋…ธ์ถœ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ์ข…์ด ์ธ์‡„๋ฌผ ๋“ฑ ๊ฐœ์ธ์ •๋ณด์˜ ์ถœ๋ ฅยท๋ณต์‚ฌ๋ฌผ์„ ์•ˆ์ „ํ•˜๊ฒŒ ๊ด€๋ฆฌํ•˜๊ธฐ ์œ„ํ•ด ํ•„์š”ํ•œ ๋ณดํ˜ธ์กฐ์น˜๋ฅผ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ ๋ฐ ๊ณต์šฉ์—…๋ฌด ํ™˜๊ฒฝ์—์„œ์˜ ์ •๋ณด๋ณดํ˜ธ ์ค€์ˆ˜ ์—ฌ๋ถ€๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ10์กฐ(๋ฌผ๋ฆฌ์  ์•ˆ์ „์กฐ์น˜), ์ œ12์กฐ(์ถœ๋ ฅยท๋ณต์‚ฌ์‹œ ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "์‚ฌ๋ฌด์‹ค ๋ฐ ๊ณต์šฉ๊ณต๊ฐ„ ๋ณด์•ˆ์ ๊ฒ€ ๋ณด๊ณ ์„œ", + "์‚ฌ๋ฌด์‹ค ๋ฐ ๊ณต์šฉ๊ณต๊ฐ„ ๋ณด์•ˆ์ ๊ฒ€ํ‘œ", + "๋ฏธ์ค€์ˆ˜์ž์— ๋Œ€ํ•œ ์กฐ์น˜ ์‚ฌํ•ญ(๊ต์œก, ์ƒ๋ฒŒ ๋“ฑ)", + "์ถœ๋ ฅยท๋ณต์‚ฌ๋ฌผ ๋ณดํ˜ธ์กฐ์น˜ ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด ๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์„œ ๋‚ด ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ๋ฅผ ์œ„ํ•œ ์ƒํ™œ๋ณด์•ˆ ์ ๊ฒ€(ํด๋ฆฐ๋ฐ์Šคํฌ ์šด์˜ ๋“ฑ)์„ ์ •๊ธฐ์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜๋„๋ก ๋ช…์‹œํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ด๋ฅผ ์ดํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ฉค๋ฒ„์‹ญ ๊ฐ€์ž…์‹ ์ฒญ์„œ ๋“ฑ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ์„œ๋ฅ˜๋ฅผ ์ž ๊ธˆ์žฅ์น˜๊ฐ€ ์—†๋Š” ์‚ฌ๋ฌด์‹ค ๋ฌธ์„œํ•จ์— ๋ณด๊ด€ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ง์›๋“ค์˜ ์ปดํ“จํ„ฐ ํ™”๋ฉด๋ณดํ˜ธ๊ธฐ ๋ฐ ํŒจ์Šค์›Œ๋“œ๊ฐ€ ์„ค์ •๋˜์–ด ์žˆ์ง€ ์•Š๊ณ , ํœด๊ฐ€์ž ์ฑ…์ƒ ์œ„์— ์ค‘์š”๋ฌธ์„œ๊ฐ€ ์žฅ๊ธฐ๊ฐ„ ๋ฐฉ์น˜๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ํšŒ์˜์‹ค ๋“ฑ ๊ณต์šฉ ์‚ฌ๋ฌด ๊ณต๊ฐ„์— ์„ค์น˜๋œ ๊ณต์šฉPC์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์•„ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ํŒŒ์ผ์ด ์•”ํ˜ธํ™”๋˜์ง€ ์•Š์€ ์ฑ„๋กœ ์ €์žฅ๋˜์–ด ์žˆ๊ฑฐ๋‚˜, ๋ณด์•ˆ ์—…๋ฐ์ดํŠธ ๋ฏธ์ ์šฉ, ๋ฐฑ์‹  ๋ฏธ์„ค์น˜ ๋“ฑ ์ทจ์•ฝํ•œ ์ƒํƒœ๋กœ ์œ ์ง€ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.5.1", + "Name": "์‚ฌ์šฉ์ž ๊ณ„์ • ๊ด€๋ฆฌ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ณ  ์—…๋ฌด ๋ชฉ์ ์— ๋”ฐ๋ฅธ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ตœ์†Œํ•œ์œผ๋กœ ๋ถ€์—ฌํ•  ์ˆ˜ ์žˆ๋„๋ก ์‚ฌ์šฉ์ž ๋“ฑ๋กยทํ•ด์ง€ ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ€์—ฌยท๋ณ€๊ฒฝยท๋ง์†Œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ์‚ฌ์šฉ์ž ๋“ฑ๋ก ๋ฐ ๊ถŒํ•œ๋ถ€์—ฌ ์‹œ ์‚ฌ์šฉ์ž์—๊ฒŒ ๋ณด์•ˆ์ฑ…์ž„์ด ์žˆ์Œ์„ ๊ทœ์ •ํ™”ํ•˜๊ณ  ์ธ์‹์‹œ์ผœ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "organizations_scp_check_deny_regions", + "cognito_user_pool_self_registration_disabled", + "cloudtrail_threat_detection_privilege_escalation", + "iam_user_administrator_access_policy", + "iam_customer_unattached_policy_no_administrative_privileges", + "iam_inline_policy_allows_privilege_escalation", + "iam_inline_policy_no_administrative_privileges", + "iam_aws_attached_policy_no_administrative_privileges", + "iam_policy_allows_privilege_escalation", + "iam_policy_no_full_access_to_kms", + "iam_role_cross_service_confused_deputy_prevention", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_role_cross_account_readonlyaccess_policy", + "iam_inline_policy_no_full_access_to_kms", + "iam_user_accesskey_unused", + "iam_securityaudit_role_created", + "iam_no_custom_policy_permissive_role_assumption", + "iam_customer_attached_policy_no_administrative_privileges", + "iam_group_administrator_access_policy", + "iam_user_console_access_unused", + "iam_policy_attached_only_to_group_or_roles", + "iam_policy_no_full_access_to_cloudtrail", + "iam_role_administratoraccess_policy" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Section": "2.5.1 ์‚ฌ์šฉ์ž ๊ณ„์ • ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์˜ ๋“ฑ๋กยท๋ณ€๊ฒฝยท์‚ญ์ œ์— ๊ด€ํ•œ ๊ณต์‹์ ์ธ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ์ƒ์„ฑ ๋ฐ ๋“ฑ๋กยท๋ณ€๊ฒฝ ์‹œ ์ง๋ฌด๋ณ„ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ„๋ฅ˜ ์ฒด๊ณ„์— ๋”ฐ๋ผ ์—…๋ฌด์ƒ ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ๊ถŒํ•œ๋งŒ์„ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‚ฌ์šฉ์ž์—๊ฒŒ ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•˜๋Š” ๊ฒฝ์šฐ ํ•ด๋‹น ๊ณ„์ •์— ๋Œ€ํ•œ ๋ณด์•ˆ์ฑ…์ž„์ด ๋ณธ์ธ์—๊ฒŒ ์žˆ์Œ์„ ๋ช…ํ™•ํžˆ ์ธ์‹์‹œํ‚ค๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ์‹ ์ฒญ์„œ", + "์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ๊ด€๋ฆฌ๋Œ€์žฅ ๋˜๋Š” ํ™”๋ฉด", + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ๋ณ„ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ„๋ฅ˜ํ‘œ", + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ๋ณ„ ์‚ฌ์šฉ์ž, ๊ด€๋ฆฌ์ž, ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋ชฉ๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์‚ฌ์šฉ์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž์— ๋Œ€ํ•œ ๊ณ„์ •ยท๊ถŒํ•œ์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ๋“ฑ๋ก, ํ•ด์ง€ ๋ฐ ์Šน์ธ์ ˆ์ฐจ ์—†์ด ๊ตฌ๋‘ ์š”์ฒญ, ์ด๋ฉ”์ผ ๋“ฑ์œผ๋กœ ์ฒ˜๋ฆฌํ•˜์—ฌ ์ด์— ๋Œ€ํ•œ ์Šน์ธ ๋ฐ ์ฒ˜๋ฆฌ ์ด๋ ฅ์ด ํ™•์ธ๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๊ฐ€ ํœด๊ฐ€, ์ถœ์žฅ, ๊ณต๊ฐ€ ๋“ฑ์— ๋”ฐ๋ฅธ ์—…๋ฌด ๋ฐฑ์—…์„ ์‚ฌ์œ ๋กœ ๊ณต์‹์ ์ธ ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜์ง€ ์•Š๊ณ  ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๋กœ ์ง€์ •๋˜์ง€ ์•Š์€ ์ธ์›์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๊ณ„์ •์„ ์•Œ๋ ค์ฃผ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ •๋ณด์‹œ์Šคํ…œ ๋˜๋Š” ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ์‚ฌ์šฉ์ž์—๊ฒŒ ํ•„์š” ์ด์ƒ์˜ ๊ณผ๋„ํ•œ ๊ถŒํ•œ์„ ๋ถ€์—ฌํ•˜์—ฌ ์—…๋ฌด์ƒ ๋ถˆํ•„์š”ํ•œ ์ •๋ณด ๋˜๋Š” ๊ฐœ์ธ์ •๋ณด์— ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.5.2", + "Name": "์‚ฌ์šฉ์ž ์‹๋ณ„", + "Description": "์‚ฌ์šฉ์ž ๊ณ„์ •์€ ์‚ฌ์šฉ์ž๋ณ„๋กœ ์œ ์ผํ•˜๊ฒŒ ๊ตฌ๋ถ„ํ•  ์ˆ˜ ์žˆ๋„๋ก ์‹๋ณ„์ž๋ฅผ ํ• ๋‹นํ•˜๊ณ  ์ถ”์ธก ๊ฐ€๋Šฅํ•œ ์‹๋ณ„์ž ์‚ฌ์šฉ์„ ์ œํ•œํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ๋™์ผํ•œ ์‹๋ณ„์ž๋ฅผ ๊ณต์œ ํ•˜์—ฌ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ์‚ฌ์œ ์™€ ํƒ€๋‹น์„ฑ์„ ๊ฒ€ํ† ํ•˜์—ฌ ์ฑ…์ž„์ž์˜ ์Šน์ธ ๋ฐ ์ฑ…์ž„์ถ”์ ์„ฑ ํ™•๋ณด ๋“ฑ ๋ณด์™„๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Section": "2.5.2 ์‚ฌ์šฉ์ž ์‹๋ณ„", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์—์„œ ์‚ฌ์šฉ์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๋ฅผ ์œ ์ผํ•˜๊ฒŒ ๊ตฌ๋ถ„ํ•  ์ˆ˜ ์žˆ๋Š” ์‹๋ณ„์ž๋ฅผ ํ• ๋‹นํ•˜๊ณ  ์ถ”์ธก ๊ฐ€๋Šฅํ•œ ์‹๋ณ„์ž์˜ ์‚ฌ์šฉ์„ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ถˆ๊ฐ€ํ”ผํ•œ ์‚ฌ์œ ๋กœ ๋™์ผํ•œ ์‹๋ณ„์ž๋ฅผ ๊ณต์œ ํ•˜์—ฌ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ์‚ฌ์œ ์™€ ํƒ€๋‹น์„ฑ์„ ๊ฒ€ํ† ํ•˜๊ณ  ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ ์ฑ…์ž„์ž์˜ ์Šน์ธ์„ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๋กœ๊ทธ์ธ ํ™”๋ฉด", + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๊ด€๋ฆฌ์ž, ์‚ฌ์šฉ์ž, ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๊ณ„์ • ๋ชฉ๋ก", + "์˜ˆ์™ธ ์ฒ˜๋ฆฌ์— ๋Œ€ํ•œ ์Šน์ธ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด์‹œ์Šคํ…œ(์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ, ์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ, DBMS ๋“ฑ)์˜ ๊ณ„์ • ํ˜„ํ™ฉ์„ ํ™•์ธํ•œ ๊ฒฐ๊ณผ, ์ œ์กฐ์‚ฌ์—์„œ ์ œ๊ณตํ•˜๋Š” ๊ธฐ๋ณธ ๊ด€๋ฆฌ์ž ๊ณ„์ •์„ ๊ธฐ์ˆ ์ ์œผ๋กœ ๋ณ€๊ฒฝ ๊ฐ€๋Šฅํ•จ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๋ณ€๊ฒฝํ•˜์ง€ ์•Š๊ณ  ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ๋ฐœ์ž๊ฐ€ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๊ณ„์ •์„ ๊ณต์šฉ์œผ๋กœ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ์œผ๋‚˜, ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ๋˜๋Š” ์ฑ…์ž„์ž์˜ ์Šน์ธ ๋“ฑ์ด ์—†์ด ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์™ธ๋ถ€์ง์›์ด ์œ ์ง€๋ณด์ˆ˜ํ•˜๊ณ  ์žˆ๋Š” ์ •๋ณด์‹œ์Šคํ…œ์˜ ์šด์˜๊ณ„์ •์„ ๋ณ„๋„์˜ ์Šน์ธ ์ ˆ์ฐจ ์—†์ด ๊ฐœ์ธ ๊ณ„์ •์ฒ˜๋Ÿผ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.5.3", + "Name": "์‚ฌ์šฉ์ž ์ธ์ฆ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž์˜ ์ ‘๊ทผ์€ ์•ˆ์ „ํ•œ ์ธ์ฆ์ ˆ์ฐจ์™€ ํ•„์š”์— ๋”ฐ๋ผ ๊ฐ•ํ™”๋œ ์ธ์ฆ๋ฐฉ์‹์„ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ๋กœ๊ทธ์ธ ํšŸ์ˆ˜ ์ œํ•œ, ๋ถˆ๋ฒ• ๋กœ๊ทธ์ธ ์‹œ๋„ ๊ฒฝ๊ณ  ๋“ฑ ๋น„์ธ๊ฐ€์ž ์ ‘๊ทผ ํ†ต์ œ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cognito_user_pool_advanced_security_enabled", + "cognito_user_pool_client_token_revocation_enabled", + "cognito_user_pool_client_prevent_user_existence_errors", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_self_registration_disabled", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "directoryservice_supported_mfa_radius_enabled", + "iam_rotate_access_key_90_days", + "iam_root_hardware_mfa_enabled", + "iam_user_no_setup_initial_access_key", + "iam_root_mfa_enabled", + "iam_user_with_temporary_credentials", + "iam_user_hardware_mfa_enabled", + "iam_check_saml_providers_sts", + "iam_user_two_active_access_key", + "iam_user_accesskey_unused", + "iam_user_mfa_enabled_console_access", + "iam_administrator_access_with_mfa", + "apigatewayv2_api_authorizers_enabled", + "kafka_cluster_unrestricted_access_disabled", + "rds_cluster_iam_authentication_enabled", + "rds_instance_iam_authentication_enabled", + "apigateway_restapi_authorizers_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Section": "2.5.3 ์‚ฌ์šฉ์ž ์ธ์ฆ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์ ‘๊ทผ์€ ์‚ฌ์šฉ์ž ์ธ์ฆ, ๋กœ๊ทธ์ธ ํšŸ์ˆ˜ ์ œํ•œ, ๋ถˆ๋ฒ• ๋กœ๊ทธ์ธ ์‹œ๋„ ๊ฒฝ๊ณ  ๋“ฑ ์•ˆ์ „ํ•œ ์‚ฌ์šฉ์ž ์ธ์ฆ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณดํ†ต์‹ ๋ง์„ ํ†ตํ•˜์—ฌ ์™ธ๋ถ€์—์„œ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ์ ‘์†ํ•˜๋ ค๋Š” ๊ฒฝ์šฐ์—๋Š” ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ์•ˆ์ „ํ•œ ์ธ์ฆ์ˆ˜๋‹จ ๋˜๋Š” ์•ˆ์ „ํ•œ ์ ‘์†์ˆ˜๋‹จ์„ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ), ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๋กœ๊ทธ์ธ ํ™”๋ฉด", + "๋กœ๊ทธ์ธ ํšŸ์ˆ˜ ์ œํ•œ ์„ค์ • ํ™”๋ฉด", + "๋กœ๊ทธ์ธ ์‹คํŒจ ๋ฉ”์‹œ์ง€ ํ™”๋ฉด", + "์™ธ๋ถ€ ์ ‘์† ์‹œ ์ ˆ์ฐจ(์™ธ๋ถ€์ ‘์† ์‹ ์ฒญ์„œ, ์™ธ๋ถ€์ ‘์†์ž ํ˜„ํ™ฉ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๊ฐ€ ๊ณต๊ฐœ๋œ ์™ธ๋ถ€ ์ธํ„ฐ๋„ท๋ง์„ ํ†ตํ•˜์—ฌ ์ด์šฉ์ž์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ ์‹œ์Šคํ…œ์— ์ ‘๊ทผ ์‹œ ์•ˆ์ „ํ•œ ์ธ์ฆ์ˆ˜๋‹จ์„ ์ ์šฉํ•˜์ง€ ์•Š๊ณ  IDยท๋น„๋ฐ€๋ฒˆํ˜ธ ๋ฐฉ์‹์œผ๋กœ๋งŒ ์ธ์ฆํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๋กœ๊ทธ์ธ ์‹คํŒจ ์‹œ ํ•ด๋‹น ID๊ฐ€ ์กด์žฌํ•˜์ง€ ์•Š๊ฑฐ๋‚˜ ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ํ‹€๋ฆผ์„ ์ž์„ธํžˆ ํ‘œ์‹œํ•ด ์ฃผ๊ณ  ์žˆ์œผ๋ฉฐ, ๋กœ๊ทธ์ธ ์‹คํŒจํšŸ์ˆ˜์— ๋Œ€ํ•œ ์ œํ•œ์ด ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.5.4", + "Name": "๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ", + "Description": "๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ, ์™ธ๋ถ€ ์œ„ํ˜‘์š”์ธ ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ์ •๋ณด์‹œ์Šคํ…œ ์‚ฌ์šฉ์ž ๋ฐ ๊ณ ๊ฐ, ํšŒ์› ๋“ฑ ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)๊ฐ€ ์‚ฌ์šฉํ•˜๋Š” ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cognito_user_pool_temporary_password_expiration", + "cognito_user_pool_password_policy_uppercase", + "cognito_user_pool_password_policy_number", + "cognito_user_pool_password_policy_lowercase", + "cognito_user_pool_password_policy_minimum_length_14", + "cognito_user_pool_password_policy_symbol", + "iam_password_policy_number", + "iam_password_policy_minimum_length_14", + "iam_password_policy_expires_passwords_within_90_days_or_less", + "iam_password_policy_symbol", + "iam_password_policy_reuse_24", + "iam_password_policy_lowercase", + "iam_password_policy_uppercase" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Section": "2.5.4 ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์•ˆ์ „ํ•œ ์‚ฌ์šฉ์ž ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ์ ˆ์ฐจ ๋ฐ ์ž‘์„ฑ๊ทœ์น™์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)๊ฐ€ ์•ˆ์ „ํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ด์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ๋น„๋ฐ€๋ฒˆํ˜ธ ์ž‘์„ฑ๊ทœ์น™์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋˜๋Š” ์ •๋ณด์ฃผ์ฒด์˜ ์ธ์ฆ์ˆ˜๋‹จ์„ ์•ˆ์ „ํ•˜๊ฒŒ ์ ์šฉํ•˜๊ณ  ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "์›นํŽ˜์ด์ง€, ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ๋น„๋ฐ€๋ฒˆํ˜ธ ์„ค์ • ํ™”๋ฉด", + "๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ฆฌ ์ •์ฑ… ๋ฐ ์ ˆ์ฐจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ์ •์ฑ…, ์ง€์นจ ๋“ฑ์—์„œ ๋น„๋ฐ€๋ฒˆํ˜ธ ์ƒ์„ฑ๊ทœ์น™์˜ ๊ธฐ์ค€์„ ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ผ๋ถ€ ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์—์„œ ๋‚ด๋ถ€ ์ง€์นจ๊ณผ ์ƒ์ดํ•œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ จ ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ์ดˆ๊ธฐํ™” ์‹œ ์ž„์‹œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ๋ถ€์—ฌ๋ฐ›๊ณ  ๊ฐ•์ œ์ ์œผ๋กœ ๋ณ€๊ฒฝํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์‹ค์ œ๋กœ๋Š” ์ž„์‹œ ๋น„๋ฐ€๋ฒˆํ˜ธ๋ฅผ ๊ทธ๋Œ€๋กœ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋น„๋ฐ€๋ฒˆํ˜ธ ๊ด€๋ จ ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ์‚ฌ์šฉ์ž ๋ฐ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž์˜ ๋น„๋ฐ€๋ฒˆํ˜ธ ๋ณ€๊ฒฝ์ฃผ๊ธฐ๋ฅผ ์ •ํ•˜๊ณ  ์ดํ–‰ํ•˜๋„๋ก ํ•˜๊ณ  ์žˆ์Œ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๋ณ€๊ฒฝํ•˜์ง€ ์•Š๊ณ  ๊ทธ๋Œ€๋กœ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.5.5", + "Name": "ํŠน์ˆ˜ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ๊ด€๋ฆฌ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ฆฌ, ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด ๊ด€๋ฆฌ ๋“ฑ ํŠน์ˆ˜ ๋ชฉ์ ์„ ์œ„ํ•˜์—ฌ ์‚ฌ์šฉํ•˜๋Š” ๊ณ„์ • ๋ฐ ๊ถŒํ•œ์€ ์ตœ์†Œํ•œ์œผ๋กœ ๋ถ€์—ฌํ•˜๊ณ  ๋ณ„๋„๋กœ ์‹๋ณ„ํ•˜์—ฌ ํ†ต์ œํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "organizations_delegated_administrators", + "cloudwatch_log_metric_filter_root_usage", + "iam_root_hardware_mfa_enabled", + "iam_root_mfa_enabled", + "iam_support_role_created", + "iam_avoid_root_usage", + "iam_no_root_access_key", + "rds_instance_default_admin", + "rds_cluster_default_admin", + "sagemaker_notebook_instance_root_access_disabled", + "ec2_instance_profile_attached" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Section": "2.5.5 ํŠน์ˆ˜ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "๊ด€๋ฆฌ์ž ๊ถŒํ•œ ๋“ฑ ํŠน์ˆ˜๊ถŒํ•œ์€ ์ตœ์†Œํ•œ์˜ ์ธ์›์—๊ฒŒ๋งŒ ๋ถ€์—ฌ๋  ์ˆ˜ ์žˆ๋„๋ก ๊ณต์‹์ ์ธ ๊ถŒํ•œ ์‹ ์ฒญ ๋ฐ ์Šน์ธ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "ํŠน์ˆ˜ ๋ชฉ์ ์„ ์œ„ํ•˜์—ฌ ๋ถ€์—ฌํ•œ ๊ณ„์ • ๋ฐ ๊ถŒํ•œ์„ ์‹๋ณ„ํ•˜๊ณ  ๋ณ„๋„ ๋ชฉ๋ก์œผ๋กœ ๊ด€๋ฆฌํ•˜๋Š” ๋“ฑ ํ†ต์ œ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "ํŠน์ˆ˜๊ถŒํ•œ ๊ด€๋ จ ์ง€์นจ", + "ํŠน์ˆ˜๊ถŒํ•œ ์‹ ์ฒญยท์Šน์ธ ๋‚ด์—ญ", + "ํŠน์ˆ˜๊ถŒํ•œ์ž ๋ชฉ๋ก", + "ํŠน์ˆ˜๊ถŒํ•œ ๊ฒ€ํ†  ๋‚ด์šฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ๊ด€๋ฆฌ์ž ๋ฐ ํŠน์ˆ˜๊ถŒํ•œ ๋ถ€์—ฌ ๋“ฑ์˜ ์Šน์ธ ์ด๋ ฅ์ด ์‹œ์Šคํ…œ์ด๋‚˜ ๋ฌธ์„œ์ƒ์œผ๋กœ ํ™•์ธ์ด ๋˜์ง€ ์•Š๊ฑฐ๋‚˜, ์Šน์ธ ์ด๋ ฅ๊ณผ ํŠน์ˆ˜๊ถŒํ•œ ๋‚ด์—ญ์ด ์„œ๋กœ ์ผ์น˜๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ๊ฐœ์ธ์ •๋ณด ๊ด€๋ฆฌ์ž ๋ฐ ํŠน์ˆ˜๊ถŒํ•œ ๋ณด์œ ์ž๋ฅผ ๋ชฉ๋ก์œผ๋กœ ์ž‘์„ฑยท๊ด€๋ฆฌํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜ ์ด๋ฅผ ์ž‘์„ฑยท๊ด€๋ฆฌํ•˜๊ณ  ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜, ๋ณด์•ˆ์‹œ์Šคํ…œ ๊ด€๋ฆฌ์ž ๋“ฑ ์ผ๋ถ€ ํŠน์ˆ˜๊ถŒํ•œ์ด ์‹๋ณ„ยท๊ด€๋ฆฌ๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ์œ ์ง€๋ณด์ˆ˜๋ฅผ ์œ„ํ•˜์—ฌ ๋ถ„๊ธฐ 1ํšŒ์— ๋ฐฉ๋ฌธํ•˜๋Š” ์œ ์ง€๋ณด์ˆ˜์šฉ ํŠน์ˆ˜ ๊ณ„์ •์ด ์‚ฌ์šฉ๊ธฐ๊ฐ„ ์ œํ•œ์—†์ด ์ƒ์‹œ๋กœ ํ™œ์„ฑํ™”๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ด€๋ฆฌ์ž ๋ฐ ํŠน์ˆ˜๊ถŒํ•œ์˜ ์‚ฌ์šฉ ์—ฌ๋ถ€๋ฅผ ์ •๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์ง€ ์•Š์•„ ์ผ๋ถ€ ํŠน์ˆ˜๊ถŒํ•œ์ž์˜ ์—…๋ฌด๊ฐ€ ๋ณ€๊ฒฝ๋˜์—ˆ์Œ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๊ธฐ์กด ๊ด€๋ฆฌ์ž ๋ฐ ํŠน์ˆ˜๊ถŒํ•œ์„ ๊ณ„์† ๋ณด์œ ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.5.6", + "Name": "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ์ ‘๊ทผํ•˜๋Š” ์‚ฌ์šฉ์ž ๊ณ„์ •์˜ ๋“ฑ๋กยท์ด์šฉยท์‚ญ์ œ ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์˜ ๋ถ€์—ฌยท๋ณ€๊ฒฝยท์‚ญ์ œ ์ด๋ ฅ์„ ๋‚จ๊ธฐ๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜์—ฌ ์ ์ •์„ฑ ์—ฌ๋ถ€๋ฅผ ์ ๊ฒ€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "accessanalyzer_enabled_without_findings", + "accessanalyzer_enabled", + "cloudtrail_insights_exist", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.5. ์ธ์ฆ ๋ฐ ๊ถŒํ•œ๊ด€๋ฆฌ", + "Section": "2.5.6 ์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ ์ƒ์„ฑยท๋“ฑ๋กยท๋ถ€์—ฌ ๋ฐ ์ด์šฉยท๋ณ€๊ฒฝยท๋ง์†Œ ๋“ฑ์˜ ์ด๋ ฅ์„ ๋‚จ๊ธฐ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ๊ณผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ๊ณ„์ • ๋ฐ ์ ‘๊ทผ๊ถŒํ•œ์˜ ์ ์ •์„ฑ ๊ฒ€ํ†  ๊ธฐ์ค€, ๊ฒ€ํ† ์ฃผ์ฒด, ๊ฒ€ํ† ๋ฐฉ๋ฒ•, ์ฃผ๊ธฐ ๋“ฑ์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ •๊ธฐ์  ๊ฒ€ํ† ๋ฅผ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ†  ๊ฒฐ๊ณผ ์ ‘๊ทผ๊ถŒํ•œ ๊ณผ๋‹ค ๋ถ€์—ฌ, ๊ถŒํ•œ๋ถ€์—ฌ ์ ˆ์ฐจ ๋ฏธ์ค€์ˆ˜, ๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ ๋ฌธ์ œ์ ์ด ๋ฐœ๊ฒฌ๋œ ๊ฒฝ์šฐ ๊ทธ์— ๋”ฐ๋ฅธ ์กฐ์น˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ)" + ], + "AuditEvidence": [ + "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ†  ๊ธฐ์ค€ ๋ฐ ์ ˆ์ฐจ", + "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ†  ์ด๋ ฅ", + "์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ†  ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ ๋ฐ ํ›„์†์กฐ์น˜ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ์™€ ๊ด€๋ จ๋œ ๋ฐฉ๋ฒ•, ์ ๊ฒ€์ฃผ๊ธฐ, ๋ณด๊ณ ์ฒด๊ณ„, ์˜คยท๋‚จ์šฉ ๊ธฐ์ค€ ๋“ฑ์ด ๊ด€๋ จ ์ง€์นจ์— ๊ตฌ์ฒด์ ์œผ๋กœ ์ •์˜๋˜์–ด ์žˆ์ง€ ์•Š์•„ ์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ๊ฐ€ ์ •๊ธฐ์ ์œผ๋กœ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ์ •์ฑ…, ์ง€์นจ ๋“ฑ์— ์žฅ๊ธฐ ๋ฏธ์‚ฌ์šฉ์ž ๊ณ„์ •์— ๋Œ€ํ•œ ์ž ๊ธˆ(๋น„ํ™œ์„ฑํ™”) ๋˜๋Š” ์‚ญ์ œ ์กฐ์น˜ํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, 6๊ฐœ์›” ์ด์ƒ ๋ฏธ์ ‘์†ํ•œ ์‚ฌ์šฉ์ž์˜ ๊ณ„์ •์ด ํ™œ์„ฑํ™”๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ(์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ† ๊ฐ€ ์ถฉ์‹คํžˆ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์•„ ํ•ด๋‹น ๊ณ„์ •์ด ์‹๋ณ„๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ)", + "์‚ฌ๋ก€ 3 : ์ ‘๊ทผ๊ถŒํ•œ ๊ฒ€ํ†  ์‹œ ์ ‘๊ทผ๊ถŒํ•œ์˜ ๊ณผ๋‹ค ๋ถ€์—ฌ ๋ฐ ์˜คยท๋‚จ์šฉ ์˜์‹ฌ์‚ฌ๋ก€๊ฐ€ ๋ฐœ๊ฒฌ๋˜์—ˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ์ƒ์„ธ์กฐ์‚ฌ, ๋‚ด๋ถ€๋ณด๊ณ  ๋“ฑ์˜ ํ›„์†์กฐ์น˜๊ฐ€ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.1", + "Name": "๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", + "Description": "๋„คํŠธ์›Œํฌ์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ธฐ ์œ„ํ•˜์—ฌ IP๊ด€๋ฆฌ, ๋‹จ๋ง์ธ์ฆ ๋“ฑ ๊ด€๋ฆฌ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ์ดํ–‰ํ•˜๊ณ , ์—…๋ฌด๋ชฉ์  ๋ฐ ์ค‘์š”๋„์— ๋”ฐ๋ผ ๋„คํŠธ์›Œํฌ ๋ถ„๋ฆฌ(DMZ, ์„œ๋ฒ„ํŒœ, DB์กด, ๊ฐœ๋ฐœ์กด ๋“ฑ)์™€ ์ ‘๊ทผํ†ต์ œ๋ฅผ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "ssm_documents_set_as_public", + "s3_access_point_public_access_block", + "s3_bucket_public_write_acl", + "s3_bucket_acl_prohibited", + "s3_account_level_public_access_blocks", + "s3_bucket_level_public_access_block", + "emr_cluster_account_public_block_enabled", + "emr_cluster_master_nodes_no_public_ip", + "emr_cluster_publicly_accesible", + "documentdb_cluster_public_snapshot", + "sns_topics_not_publicly_accessible", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_blocks_potential_malicious_sign_in_attempts", + "cloudfront_distributions_geo_restrictions_enabled", + "opensearch_service_domains_not_publicly_accessible", + "glacier_vaults_policy_public_access", + "lightsail_instance_public", + "lightsail_database_public", + "neptune_cluster_uses_public_subnet", + "neptune_cluster_public_snapshot", + "ecr_repositories_not_publicly_accessible", + "workspaces_vpc_2private_1public_subnets_nat", + "elb_internet_facing", + "sqs_queues_not_publicly_accessible", + "redshift_cluster_public_access", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "awslambda_function_url_public", + "awslambda_function_url_cors_policy", + "awslambda_function_not_publicly_accessible", + "iam_user_administrator_access_policy", + "iam_group_administrator_access_policy", + "iam_user_mfa_enabled_console_access", + "networkfirewall_in_all_vpc", + "eks_cluster_network_policy_enabled", + "eks_control_plane_endpoint_access_restricted", + "eks_cluster_private_nodes_enabled", + "eks_endpoints_not_publicly_accessible", + "kafka_cluster_is_public", + "kafka_cluster_unrestricted_access_disabled", + "vpc_peering_routing_tables_with_least_privilege", + "vpc_subnet_no_public_ip_by_default", + "vpc_endpoint_services_allowed_principals_trust_boundaries", + "vpc_endpoint_connections_trust_boundaries", + "vpc_subnet_separate_private_public", + "dms_instance_no_public_access", + "elbv2_internet_facing", + "elbv2_listeners_underneath", + "elasticache_cluster_uses_public_subnet", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout", + "rds_snapshots_public_access", + "rds_instance_no_public_access", + "rds_instance_event_subscription_security_groups", + "rds_instance_iam_authentication_enabled", + "apigateway_restapi_public", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_public_with_authorizer", + "sagemaker_training_jobs_network_isolation_enabled", + "sagemaker_models_vpc_settings_configured", + "sagemaker_training_jobs_vpc_settings_configured", + "sagemaker_models_network_isolation_enabled", + "sagemaker_notebook_instance_without_direct_internet_access_configured", + "sagemaker_notebook_instance_vpc_settings_configured", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_securitygroup_not_used", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_elastic_ip_shodan", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_networkacl_allow_ingress_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_ebs_public_snapshot", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_transitgateway_auto_accept_vpc_attachments", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_ami_public", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_instance_imdsv2_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_public_ip", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.1 ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", + "AuditChecklist": [ + "์กฐ์ง์˜ ๋„คํŠธ์›Œํฌ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๋ชจ๋“  ๊ฒฝ๋กœ๋ฅผ ์‹๋ณ„ํ•˜๊ณ  ์ ‘๊ทผํ†ต์ œ ์ •์ฑ…์— ๋”ฐ๋ผ ๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ๋Š” ์ธ๊ฐ€๋œ ์‚ฌ์šฉ์ž๋งŒ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์„œ๋น„์Šค, ์‚ฌ์šฉ์ž ๊ทธ๋ฃน, ์ •๋ณด์ž์‚ฐ์˜ ์ค‘์š”๋„, ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ๋„คํŠธ์›Œํฌ ์˜์—ญ์„ ๋ฌผ๋ฆฌ์  ๋˜๋Š” ๋…ผ๋ฆฌ์ ์œผ๋กœ ๋ถ„๋ฆฌํ•˜๊ณ  ๊ฐ ์˜์—ญ ๊ฐ„ ์ ‘๊ทผํ†ต์ œ๋ฅผ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋„คํŠธ์›Œํฌ ๋Œ€์—ญ๋ณ„ IP์ฃผ์†Œ ๋ถ€์—ฌ ๊ธฐ์ค€์„ ๋งˆ๋ จํ•˜๊ณ  ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์„œ๋ฒ„ ๋“ฑ ์™ธ๋ถ€ ์—ฐ๊ฒฐ์ด ํ•„์š”ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ ์‚ฌ์„ค IP๋กœ ํ• ๋‹นํ•˜๋Š” ๋“ฑ์˜ ๋Œ€์ฑ…์„ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฌผ๋ฆฌ์ ์œผ๋กœ ๋–จ์–ด์ง„ IDC, ์ง€์‚ฌ, ๋Œ€๋ฆฌ์  ๋“ฑ๊ณผ์˜ ๋„คํŠธ์›Œํฌ ์—ฐ๊ฒฐ ์‹œ ์ „์†ก๊ตฌ๊ฐ„ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„", + "IP ๊ด€๋ฆฌ๋Œ€์žฅ", + "์ •๋ณด์ž์‚ฐ ๋ชฉ๋ก", + "๋ฐฉํ™”๋ฒฝ๋ฃฐ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„์™€ ์ธํ„ฐ๋ทฐ๋ฅผ ํ†ตํ•˜์—ฌ ํ™•์ธํ•œ ๊ฒฐ๊ณผ, ์™ธ๋ถ€ ์ง€์ ์—์„œ ์‚ฌ์šฉํ•˜๋Š” ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์‹œ์Šคํ…œ๊ณผ IDC์— ์œ„์น˜ํ•œ ์„œ๋ฒ„ ๊ฐ„ ์—ฐ๊ฒฐ ์‹œ ์ผ๋ฐ˜ ์ธํ„ฐ๋„ท ํšŒ์„ ์„ ํ†ตํ•˜์—ฌ ๋ฐ์ดํ„ฐ ์†ก์ˆ˜์‹ ์„ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ์–ด ๋‚ด๋ถ€ ๊ทœ์ •์— ๋ช…์‹œ๋œ VPN์ด๋‚˜ ์ „์šฉ๋ง ๋“ฑ์„ ์ด์šฉํ•œ ํ†ต์‹ ์ด ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€๋ง์— ์œ„์น˜ํ•œ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์„œ๋ฒ„ ๋“ฑ ์ผ๋ถ€ ์ค‘์š” ์„œ๋ฒ„์˜ IP์ฃผ์†Œ๊ฐ€ ๋‚ด๋ถ€ ๊ทœ์ •๊ณผ ๋‹ฌ๋ฆฌ ๊ณต์ธ IP๋กœ ์„ค์ •๋˜์–ด ์žˆ๊ณ , ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ ์ฐจ๋‹จ์ด ์ ์šฉ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์„œ๋ฒ„ํŒœ์ด ๊ตฌ์„ฑ๋˜์–ด ์žˆ์œผ๋‚˜, ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ์ œ์–ด ์„ค์ • ๋ฏธํก์œผ๋กœ ๋‚ด๋ถ€๋ง์—์„œ ์„œ๋ฒ„ํŒœ์œผ๋กœ์˜ ์ ‘๊ทผ์ด ๊ณผ๋„ํ•˜๊ฒŒ ํ—ˆ์šฉ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์™ธ๋ถ€์ž(์™ธ๋ถ€ ๊ฐœ๋ฐœ์ž, ๋ฐฉ๋ฌธ์ž ๋“ฑ)์—๊ฒŒ ์ œ๊ณต๋˜๋Š” ๋„คํŠธ์›Œํฌ๋ฅผ ๋ณ„๋„์˜ ํ†ต์ œ ์—†์ด ๋‚ด๋ถ€ ์—…๋ฌด ๋„คํŠธ์›Œํฌ์™€ ๋ถ„๋ฆฌํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๋‚ด๋ถ€ ๊ทœ์ •๊ณผ๋Š” ๋‹ฌ๋ฆฌ MAC์ฃผ์†Œ ์ธ์ฆ, ํ•„์ˆ˜ ๋ณด์•ˆ ์†Œํ”„ํŠธ์›จ์–ด ์„ค์น˜ ๋“ฑ์˜ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ ์šฉํ•˜์ง€ ์•Š์€ ์ƒํƒœ๋กœ ๋„คํŠธ์›Œํฌ ์ผ€์ด๋ธ” ์—ฐ๊ฒฐ๋งŒ์œผ๋กœ ์‚ฌ๋‚ด ๋„คํŠธ์›Œํฌ์— ์ ‘๊ทผ ๋ฐ ์ด์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.2", + "Name": "์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ", + "Description": "์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ์— ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๋Š” ์‚ฌ์šฉ์ž, ์ ‘๊ทผ์ œํ•œ ๋ฐฉ์‹, ์•ˆ์ „ํ•œ ์ ‘๊ทผ์ˆ˜๋‹จ ๋“ฑ์„ ์ •์˜ํ•˜์—ฌ ํ†ต์ œํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "lightsail_instance_public", + "lightsail_static_ip_unused", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_elastic_ip_unassigned", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_elastic_ip_shodan", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_instance_managed_by_ssm", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_instance_public_ip", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.2 ์ •๋ณด์‹œ์Šคํ…œ ์ ‘๊ทผ", + "AuditChecklist": [ + "์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ๋ณ„ ์šด์˜์ฒด์ œ(OS)์— ์ ‘๊ทผ์ด ํ—ˆ์šฉ๋˜๋Š” ์‚ฌ์šฉ์ž, ์ ‘๊ทผ ๊ฐ€๋Šฅ ์œ„์น˜, ์ ‘๊ทผ ์ˆ˜๋‹จ ๋“ฑ์„ ์ •์˜ํ•˜์—ฌ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์— ์ ‘์† ํ›„ ์ผ์ •์‹œ๊ฐ„ ์—…๋ฌด์ฒ˜๋ฆฌ๋ฅผ ํ•˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ ์ž๋™์œผ๋กœ ์‹œ์Šคํ…œ ์ ‘์†์ด ์ฐจ๋‹จ๋˜๋„๋ก ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์˜ ์‚ฌ์šฉ๋ชฉ์ ๊ณผ ๊ด€๊ณ„ ์—†๋Š” ์„œ๋น„์Šค๋ฅผ ์ œ๊ฑฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ์š” ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•˜๋Š” ์ •๋ณด์‹œ์Šคํ…œ์€ ๋…๋ฆฝ๋œ ์„œ๋ฒ„๋กœ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "์ •๋ณด์‹œ์Šคํ…œ ์šด์˜์ฒด์ œ ๊ณ„์ • ๋ชฉ๋ก", + "์„œ๋ฒ„ ๋ณด์•ˆ ์„ค์ •", + "์„œ๋ฒ„์ ‘๊ทผ์ œ์–ด ์ •์ฑ…(SecureOS ๊ด€๋ฆฌํ™”๋ฉด ๋“ฑ)", + "์„œ๋ฒ„ ๋ฐ ๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„", + "์ •๋ณด์ž์‚ฐ ๋ชฉ๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์‚ฌ๋ฌด์‹ค์—์„œ ์„œ๋ฒ„๊ด€๋ฆฌ์ž๊ฐ€ IDC์— ์œ„์น˜ํ•œ ์œˆ๋„์šฐ ์„œ๋ฒ„์— ์ ‘๊ทผ ์‹œ ํ„ฐ๋ฏธ๋„ ์„œ๋น„์Šค๋ฅผ ์ด์šฉํ•˜์—ฌ ์ ‘๊ทผํ•˜๊ณ  ์žˆ์œผ๋‚˜, ํ„ฐ๋ฏธ๋„ ์„œ๋น„์Šค์— ๋Œ€ํ•œ ์„ธ์…˜ ํƒ€์ž„์•„์›ƒ ์„ค์ •์ด ๋˜์–ด ์žˆ์ง€ ์•Š์•„ ์žฅ์‹œ๊ฐ„ ์•„๋ฌด๋Ÿฐ ์ž‘์—…์„ ํ•˜์ง€ ์•Š์•„๋„ ํ•ด๋‹น ์„ธ์…˜์ด ์ฐจ๋‹จ๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์„œ๋ฒ„ ๊ฐ„ ์ ‘์†์ด ์ ์ ˆํžˆ ์ œํ•œ๋˜์ง€ ์•Š์•„ ํŠน์ • ์‚ฌ์šฉ์ž๊ฐ€ ๋ณธ์ธ์—๊ฒŒ ์ธ๊ฐ€๋œ ์„œ๋ฒ„์— ์ ‘์†ํ•œ ํ›„ ํ•ด๋‹น ์„œ๋ฒ„๋ฅผ ๊ฒฝ์œ ํ•˜์—ฌ ๋‹ค๋ฅธ ์ธ๊ฐ€๋ฐ›์ง€ ์•Š์€ ์„œ๋ฒ„์—๋„ ์ ‘์†ํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋˜๋Š” ๋ณด์™„ ๋Œ€์ฑ… ์—†์ด ์•ˆ์ „ํ•˜์ง€ ์•Š์€ ์ ‘์† ํ”„๋กœํ† ์ฝœ(telnet, ftp ๋“ฑ)์„ ์‚ฌ์šฉํ•˜์—ฌ ์ ‘๊ทผํ•˜๊ณ  ์žˆ์œผ๋ฉฐ, ๋ถˆํ•„์š”ํ•œ ์„œ๋น„์Šค ๋ฐ ํฌํŠธ๋ฅผ ์˜คํ”ˆํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋ชจ๋“  ์„œ๋ฒ„๋กœ์˜ ์ ‘๊ทผ์€ ์„œ๋ฒ„์ ‘๊ทผ์ œ์–ด ์‹œ์Šคํ…œ์„ ํ†ตํ•˜๋„๋ก ์ ‘๊ทผํ†ต์ œ ์ •์ฑ…์„ ๊ฐ€์ ธ๊ฐ€๊ณ  ์žˆ์œผ๋‚˜, ์„œ๋ฒ„์ ‘๊ทผ์ œ์–ด ์‹œ์Šคํ…œ์„ ํ†ตํ•˜์ง€ ์•Š๊ณ  ์„œ๋ฒ„์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ์šฐํšŒ ๊ฒฝ๋กœ๊ฐ€ ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.3", + "Name": "์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ", + "Description": "์‚ฌ์šฉ์ž๋ณ„ ์—…๋ฌด ๋ฐ ์ ‘๊ทผ ์ •๋ณด์˜ ์ค‘์š”๋„ ๋“ฑ์— ๋”ฐ๋ผ ์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ œํ•œํ•˜๊ณ , ๋ถˆํ•„์š”ํ•œ ์ •๋ณด ๋˜๋Š” ์ค‘์š”์ •๋ณด ๋…ธ์ถœ์„ ์ตœ์†Œํ™”ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.3 ์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ", + "AuditChecklist": [ + "์ค‘์š”์ •๋ณด ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์‚ฌ์šฉ์ž์˜ ์—…๋ฌด์— ๋”ฐ๋ผ ์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ฐจ๋“ฑ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ผ์ •์‹œ๊ฐ„ ๋™์•ˆ ์ž…๋ ฅ์ด ์—†๋Š” ์„ธ์…˜์€ ์ž๋™ ์ฐจ๋‹จํ•˜๊ณ , ๋™์ผ ์‚ฌ์šฉ์ž์˜ ๋™์‹œ ์„ธ์…˜ ์ˆ˜๋ฅผ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ด€๋ฆฌ์ž ์ „์šฉ ์‘์šฉํ”„๋กœ๊ทธ๋žจ(๊ด€๋ฆฌ์ž ์›นํŽ˜์ด์ง€, ๊ด€๋ฆฌ์ฝ˜์†” ๋“ฑ)์€ ๋น„์ธ๊ฐ€์ž๊ฐ€ ์ ‘๊ทผํ•  ์ˆ˜ ์—†๋„๋ก ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ํ‘œ์‹œ์ œํ•œ ๋ณดํ˜ธ์กฐ์น˜์˜ ์ผ๊ด€์„ฑ์„ ํ™•๋ณดํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ จ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ๋ถˆํ•„์š”ํ•œ ๋…ธ์ถœ(์กฐํšŒ, ํ™”๋ฉดํ‘œ์‹œ, ์ธ์‡„, ๋‹ค์šด๋กœ๋“œ ๋“ฑ)์„ ์ตœ์†Œํ™”ํ•  ์ˆ˜ ์žˆ๋„๋ก ์‘์šฉํ”„๋กœ๊ทธ๋žจ์„ ๊ตฌํ˜„ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ), ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ), ์ œ12์กฐ(์ถœ๋ ฅยท๋ณต์‚ฌ์‹œ ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "์‘์šฉํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ๊ถŒํ•œ ๋ถ„๋ฅ˜ ์ฒด๊ณ„", + "์‘์šฉํ”„๋กœ๊ทธ๋žจ ๊ณ„์ •ยท๊ถŒํ•œ ๊ด€๋ฆฌ ํ™”๋ฉด", + "์‘์šฉํ”„๋กœ๊ทธ๋žจ ์‚ฌ์šฉ์žยท๊ด€๋ฆฌ์ž ํ™”๋ฉด(๊ฐœ์ธ์ •๋ณด ์กฐํšŒ ๋“ฑ)", + "์‘์šฉํ”„๋กœ๊ทธ๋žจ ์„ธ์…˜ ํƒ€์ž„ ๋ฐ ๋™์‹œ์ ‘์† ํ—ˆ์šฉ ์—ฌ๋ถ€ ๋‚ด์—ญ", + "์‘์šฉํ”„๋กœ๊ทธ๋žจ ๊ด€๋ฆฌ์ž ์ ‘์†๋กœ๊ทธ ๋ชจ๋‹ˆํ„ฐ๋ง ๋‚ด์—ญ", + "์ •๋ณด์ž์‚ฐ ๋ชฉ๋ก", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ๊ฐœ์ธ์ •๋ณด ์กฐํšŒ, ๊ฒ€์ƒ‰ ํ™”๋ฉด", + "๊ฐœ์ธ์ •๋ณด ๋งˆ์Šคํ‚น ํ‘œ์ค€", + "๊ฐœ์ธ์ •๋ณด ๋งˆ์Šคํ‚น ์ ์šฉ ํ™”๋ฉด" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์˜ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌํ™”๋ฉด ์ค‘ ์ผ๋ถ€ ํ™”๋ฉด์˜ ๊ถŒํ•œ ์ œ์–ด ๊ธฐ๋Šฅ์— ์˜ค๋ฅ˜๊ฐ€ ์กด์žฌํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์—ด๋žŒ ๊ถŒํ•œ์ด ์—†๋Š” ์‚ฌ์šฉ์ž์—๊ฒŒ๋„ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๋…ธ์ถœ๋˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์˜ ๊ด€๋ฆฌ์ž ํŽ˜์ด์ง€๊ฐ€ ์™ธ๋ถ€์ธํ„ฐ๋„ท์— ์˜คํ”ˆ๋˜์–ด ์žˆ์œผ๋ฉด์„œ ์•ˆ์ „ํ•œ ์ธ์ฆ์ˆ˜๋‹จ์ด ์ ์šฉ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์— ๋Œ€ํ•˜์—ฌ ํƒ€๋‹นํ•œ ์‚ฌ์œ  ์—†์ด ์„ธ์…˜ ํƒ€์ž„์•„์›ƒ ๋˜๋Š” ๋™์ผ ์‚ฌ์šฉ์ž ๊ณ„์ •์˜ ๋™์‹œ ์ ‘์†์„ ์ œํ•œํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์„ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋‹ค์šด๋กœ๋“œ๋ฐ›๋Š” ๊ฒฝ์šฐ ํ•ด๋‹น ํŒŒ์ผ ๋‚ด์— ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ๋“ฑ ์—…๋ฌด์ƒ ๋ถˆํ•„์š”ํ•œ ์ •๋ณด๊ฐ€ ๊ณผ๋„ํ•˜๊ฒŒ ํฌํ•จ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ์˜ ๊ฐœ์ธ์ •๋ณด ์กฐํšŒํ™”๋ฉด์—์„œ like ๊ฒ€์ƒ‰์„ ๊ณผ๋„ํ•˜๊ฒŒ ํ—ˆ์šฉํ•˜๊ณ  ์žˆ์–ด, ๋ชจ๋“  ์‚ฌ์šฉ์ž๊ฐ€ ๋ณธ์ธ์˜ ์—…๋ฌด ๋ฒ”์œ„๋ฅผ ์ดˆ๊ณผํ•˜์—ฌ ์„ฑ์”จ๋งŒ์œผ๋กœ๋„ ์ „์ฒด ๊ณ ๊ฐ ์ •๋ณด๋ฅผ ์กฐํšŒํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ๊ฐœ์ธ์ •๋ณด ํ‘œ์‹œ์ œํ•œ ์กฐ์น˜ ๊ธฐ์ค€์ด ๋งˆ๋ จ๋˜์–ด ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜ ์ด๋ฅผ ์ค€์ˆ˜ํ•˜์ง€ ์•Š๋Š” ๋“ฑ์˜ ์‚ฌ์œ ๋กœ ๋™์ผํ•œ ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์— ๋Œ€ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ํ™”๋ฉด๋ณ„๋กœ ์„œ๋กœ ๋‹ค๋ฅธ ๋งˆ์Šคํ‚น ๊ธฐ์ค€์ด ์ ์šฉ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 7 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ํ™”๋ฉด์ƒ์—๋Š” ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๋งˆ์Šคํ‚น๋˜์–ด ํ‘œ์‹œ๋˜์–ด ์žˆ์œผ๋‚˜, ์›น๋ธŒ๋ผ์šฐ์ € ์†Œ์Šค๋ณด๊ธฐ๋ฅผ ํ†ตํ•˜์—ฌ ๋งˆ์Šคํ‚น๋˜์ง€ ์•Š์€ ์ „์ฒด ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๋…ธ์ถœ๋˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.4", + "Name": "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ", + "Description": "ํ…Œ์ด๋ธ” ๋ชฉ๋ก ๋“ฑ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋‚ด์—์„œ ์ €์žฅยท๊ด€๋ฆฌ๋˜๊ณ  ์žˆ๋Š” ์ •๋ณด๋ฅผ ์‹๋ณ„ํ•˜๊ณ , ์ •๋ณด์˜ ์ค‘์š”๋„์™€ ์‘์šฉํ”„๋กœ๊ทธ๋žจ ๋ฐ ์‚ฌ์šฉ์ž ์œ ํ˜• ๋“ฑ์— ๋”ฐ๋ฅธ ์ ‘๊ทผํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "documentdb_cluster_public_snapshot", + "opensearch_service_domains_internal_user_database_enabled", + "opensearch_service_domains_use_cognito_authentication_for_kibana", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_not_publicly_accessible", + "accessanalyzer_enabled_without_findings", + "accessanalyzer_enabled", + "lightsail_database_public", + "neptune_cluster_iam_authentication_enabled", + "neptune_cluster_uses_public_subnet", + "neptune_cluster_public_snapshot", + "dynamodb_table_cross_account_access", + "redshift_cluster_public_access", + "vpc_subnet_separate_private_public", + "dms_instance_no_public_access", + "rds_cluster_iam_authentication_enabled", + "rds_snapshots_public_access", + "rds_instance_no_public_access", + "rds_instance_iam_authentication_enabled", + "rds_instance_transport_encrypted", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_instance_port_mongodb_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.4 ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ", + "AuditChecklist": [ + "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์˜ ํ…Œ์ด๋ธ” ๋ชฉ๋ก ๋“ฑ ์ €์žฅยท๊ด€๋ฆฌ๋˜๊ณ  ์žˆ๋Š” ์ •๋ณด๋ฅผ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋‚ด ์ •๋ณด์— ์ ‘๊ทผ์ด ํ•„์š”ํ•œ ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ์ •๋ณด์‹œ์Šคํ…œ(์„œ๋ฒ„) ๋ฐ ์‚ฌ์šฉ์ž๋ฅผ ๋ช…ํ™•ํžˆ ์‹๋ณ„ํ•˜๊ณ  ์ ‘๊ทผํ†ต์ œ ์ •์ฑ…์— ๋”ฐ๋ผ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ5์กฐ(์ ‘๊ทผ๊ถŒํ•œ์˜ ๊ด€๋ฆฌ), ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ํ˜„ํ™ฉ(ํ…Œ์ด๋ธ”, ์ปฌ๋Ÿผ ๋“ฑ)", + "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘์†์ž ๊ณ„์ •ยท๊ถŒํ•œ ๋ชฉ๋ก", + "๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ์ œ์–ด ์ •์ฑ…(๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ์ œ์–ด์‹œ์Šคํ…œ ๊ด€๋ฆฌํ™”๋ฉด ๋“ฑ)", + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„(๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์กด ๋“ฑ)", + "์ •๋ณด์ž์‚ฐ ๋ชฉ๋ก" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋Œ€๋Ÿ‰์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ณด๊ด€ยท์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š” ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ์ธํ„ฐ๋„ท์„ ํ†ตํ•˜์—ฌ ์ ‘๊ทผ ๊ฐ€๋Šฅํ•œ ์›น ์‘์šฉํ”„๋กœ๊ทธ๋žจ๊ณผ ๋ถ„๋ฆฌํ•˜์ง€ ์•Š๊ณ  ๋ฌผ๋ฆฌ์ ์œผ๋กœ ๋™์ผํ•œ ์„œ๋ฒ„์—์„œ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ๋ฐœ์ž ๋ฐ ์šด์˜์ž๋“ค์ด ์‘์‘ ํ”„๋กœ๊ทธ๋žจ์—์„œ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ณ„์ •์„ ๊ณต์œ ํ•˜์—ฌ ์šด์˜ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ์ ‘์†ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์˜ ์ ‘์†๊ถŒํ•œ์„ ์˜ค๋ธŒ์ ํŠธ๋ณ„๋กœ ์ œํ•œํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ๊ถŒํ•œ์„ ์šด์˜์ž์—๊ฒŒ ์ผ๊ด„ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ์–ด ๊ฐœ์ธ์ •๋ณด ํ…Œ์ด๋ธ”์— ์ ‘๊ทผํ•  ํ•„์š”๊ฐ€ ์—†๋Š” ์šด์˜์ž์—๊ฒŒ๋„ ๊ณผ๋„ํ•˜๊ฒŒ ์ ‘๊ทผ ๊ถŒํ•œ์ด ๋ถ€์—ฌ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ์ œ์–ด ์†”๋ฃจ์…˜์„ ๋„์ž…ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘์†์ž์— ๋Œ€ํ•œ IP์ฃผ์†Œ ๋“ฑ์ด ์ ์ ˆํžˆ ์ œํ•œ๋˜์–ด ์žˆ์ง€ ์•Š์•„ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ์ œ์–ด ์†”๋ฃจ์…˜์„ ์šฐํšŒํ•˜์—ฌ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ์ ‘์†ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ €์žฅํ•˜๊ณ  ์žˆ๋Š” ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์˜ ํ…Œ์ด๋ธ” ํ˜„ํ™ฉ์ด ํŒŒ์•…๋˜์ง€ ์•Š์•„, ์ž„์‹œ๋กœ ์ƒ์„ฑ๋œ ํ…Œ์ด๋ธ”์— ๋ถˆํ•„์š”ํ•œ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ํŒŒ๊ธฐ๋˜์ง€ ์•Š๊ณ  ๋Œ€๋Ÿ‰์œผ๋กœ ์ €์žฅ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.5", + "Name": "๋ฌด์„  ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", + "Description": "๋ฌด์„  ๋„คํŠธ์›Œํฌ๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์‚ฌ์šฉ์ž ์ธ์ฆ, ์†ก์ˆ˜์‹  ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™”, AP ํ†ต์ œ ๋“ฑ ๋ฌด์„  ๋„คํŠธ์›Œํฌ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ AD Hoc ์ ‘์†, ๋น„์ธ๊ฐ€ AP ์‚ฌ์šฉ ๋“ฑ ๋น„์ธ๊ฐ€ ๋ฌด์„  ๋„คํŠธ์›Œํฌ ์ ‘์†์œผ๋กœ๋ถ€ํ„ฐ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.5 ๋ฌด์„  ๋„คํŠธ์›Œํฌ ์ ‘๊ทผ", + "AuditChecklist": [ + "๋ฌด์„ ๋„คํŠธ์›Œํฌ๋ฅผ ์—…๋ฌด์ ์œผ๋กœ ์‚ฌ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๋ฌด์„  AP ๋ฐ ๋„คํŠธ์›Œํฌ ๊ตฌ๊ฐ„ ๋ณด์•ˆ์„ ์œ„ํ•˜์—ฌ ์ธ์ฆ, ์†ก์ˆ˜์‹  ๋ฐ์ดํ„ฐ ์•”ํ˜ธํ™” ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ธ๊ฐ€๋œ ์ž„์ง์›๋งŒ์ด ๋ฌด์„ ๋„คํŠธ์›Œํฌ๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ๋„๋ก ์‚ฌ์šฉ ์‹ ์ฒญ ๋ฐ ํ•ด์ง€ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "AD Hoc ์ ‘์† ๋ฐ ์กฐ์ง ๋‚ด ํ—ˆ๊ฐ€๋ฐ›์ง€ ์•Š์€ ๋ฌด์„  AP ํƒ์ง€ยท์ฐจ๋‹จ ๋“ฑ ๋น„์ธ๊ฐ€๋œ ๋ฌด์„ ๋„คํŠธ์›Œํฌ์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„", + "AP ๋ณด์•ˆ ์„ค์ • ๋‚ด์—ญ", + "๋น„์ธ๊ฐ€ ๋ฌด์„  ๋„คํŠธ์›Œํฌ ์ ๊ฒ€ ์ด๋ ฅ", + "๋ฌด์„ ๋„คํŠธ์›Œํฌ ์‚ฌ์šฉ ์‹ ์ฒญยท์Šน์ธ ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์™ธ๋ถ€์ธ์šฉ ๋ฌด์„  ๋„คํŠธ์›Œํฌ์™€ ๋‚ด๋ถ€ ๋ฌด์„  ๋„คํŠธ์›Œํฌ ์˜์—ญ๋Œ€๊ฐ€ ๋™์ผํ•˜์—ฌ ์™ธ๋ถ€์ธ๋„ ๋ฌด์„ ๋„คํŠธ์›Œํฌ๋ฅผ ํ†ตํ•˜์—ฌ ๋ณ„๋„์˜ ํ†ต์ œ ์—†์ด ๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ์— ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ฌด์„  AP ์„ค์ • ์‹œ ์ •๋ณด ์†ก์ˆ˜์‹  ์•”ํ˜ธํ™” ๊ธฐ๋Šฅ์„ ์„ค์ •ํ•˜์˜€์œผ๋‚˜, ์•ˆ์ „ํ•˜์ง€ ์•Š์€ ๋ฐฉ์‹์œผ๋กœ ์„ค์ •ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์—…๋ฌด ๋ชฉ์ ์œผ๋กœ ๋‚ด๋ถ€๋ง์— ์—ฐ๊ฒฐ๋œ ๋ฌด์„ AP์— ๋Œ€ํ•˜์—ฌ ๋ฌด์„ AP ๊ด€๋ฆฌ์ž ๋น„๋ฐ€๋ฒˆํ˜ธ ๋…ธ์ถœ(๋””ํดํŠธ ๋น„๋ฐ€๋ฒˆํ˜ธ ์‚ฌ์šฉ), ์ ‘๊ทผ์ œ์–ด ๋ฏธ์ ์šฉ ๋“ฑ ๋ณด์•ˆ ์„ค์ •์ด ๋ฏธํกํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.6", + "Name": "์›๊ฒฉ์ ‘๊ทผ ํ†ต์ œ", + "Description": "๋ณดํ˜ธ๊ตฌ์—ญ ์ด์™ธ ์žฅ์†Œ์—์„œ์˜ ์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ฆฌ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋Š” ์›์น™์ ์œผ๋กœ ๊ธˆ์ง€ํ•˜๊ณ , ์žฌํƒ๊ทผ๋ฌดยท์žฅ์• ๋Œ€์‘ยท์›๊ฒฉํ˜‘์—… ๋“ฑ ๋ถˆ๊ฐ€ํ”ผํ•œ ์‚ฌ์œ ๋กœ ์›๊ฒฉ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์ฑ…์ž„์ž ์Šน์ธ, ์ ‘๊ทผ ๋‹จ๋ง ์ง€์ •, ์ ‘๊ทผ ํ—ˆ์šฉ๋ฒ”์œ„ ๋ฐ ๊ธฐ๊ฐ„ ์„ค์ •, ๊ฐ•ํ™”๋œ ์ธ์ฆ, ๊ตฌ๊ฐ„ ์•”ํ˜ธํ™”, ์ ‘์†๋‹จ๋ง ๋ณด์•ˆ(๋ฐฑ์‹ , ํŒจ์น˜ ๋“ฑ) ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cognito_identity_pool_guest_access_disabled", + "cognito_user_pool_mfa_enabled", + "cognito_user_pool_self_registration_disabled", + "workspaces_vpc_2private_1public_subnets_nat", + "workspaces_volume_encryption_enabled", + "iam_user_console_access_unused", + "iam_user_mfa_enabled_console_access", + "networkfirewall_in_all_vpc", + "vpc_subnet_no_public_ip_by_default", + "vpc_flow_logs_enabled", + "vpc_subnet_separate_private_public", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout", + "ec2_client_vpn_endpoint_connection_logging_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_networkacl_allow_ingress_any_port", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_networkacl_allow_ingress_tcp_port_22" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.6 ์›๊ฒฉ์ ‘๊ทผ ํ†ต์ œ", + "AuditChecklist": [ + "์ธํ„ฐ๋„ท๊ณผ ๊ฐ™์€ ์™ธ๋ถ€ ๋„คํŠธ์›Œํฌ๋ฅผ ํ†ตํ•œ ์ •๋ณด์‹œ์Šคํ…œ ์›๊ฒฉ์šด์˜์€ ์›์น™์ ์œผ๋กœ ๊ธˆ์ง€ํ•˜๊ณ  ์žฅ์• ๋Œ€์‘ ๋“ฑ ๋ถ€๋“์ดํ•˜๊ฒŒ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ๋ฅผ ํ†ตํ•˜์—ฌ ์›๊ฒฉ์œผ๋กœ ์ •๋ณด์‹œ์Šคํ…œ์„ ์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ํŠน์ • ๋‹จ๋ง์— ํ•œํ•ด์„œ๋งŒ ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์žฌํƒ๊ทผ๋ฌด, ์›๊ฒฉํ˜‘์—…, ์Šค๋งˆํŠธ์›Œํฌ ๋“ฑ๊ณผ ๊ฐ™์€ ์›๊ฒฉ์—…๋ฌด ์ˆ˜ํ–‰ ์‹œ ์ค‘์š”์ •๋ณด ์œ ์ถœ, ํ•ดํ‚น ๋“ฑ ์นจํ•ด์‚ฌ๊ณ  ์˜ˆ๋ฐฉ์„ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ๊ด€๋ฆฌ, ์šด์˜, ๊ฐœ๋ฐœ, ๋ณด์•ˆ ๋“ฑ์„ ๋ชฉ์ ์œผ๋กœ ์›๊ฒฉ์œผ๋กœ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ ์‹œ์Šคํ…œ์— ์ ‘์†ํ•˜๋Š” ๋‹จ๋ง๊ธฐ๋Š” ๊ด€๋ฆฌ์šฉ ๋‹จ๋ง๊ธฐ๋กœ ์ง€์ •ํ•˜๊ณ  ์ž„์˜์กฐ์ž‘ ๋ฐ ๋ชฉ์  ์™ธ ์‚ฌ์šฉ ๊ธˆ์ง€ ๋“ฑ ์•ˆ์ „์กฐ์น˜๋ฅผ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "VPN ๋“ฑ ์‚ฌ์™ธ์ ‘์† ์‹ ์ฒญ์„œ", + "VPN ๊ณ„์ • ๋ชฉ๋ก", + "VPN ์ ‘๊ทผ์ œ์–ด ์ •์ฑ… ์„ค์ • ํ˜„ํ™ฉ", + "IP ๊ด€๋ฆฌ๋Œ€์žฅ", + "์›๊ฒฉ ์ ‘๊ทผ์ œ์–ด ์„ค์ •(์„œ๋ฒ„ ์„ค์ •, ๋ณด์•ˆ์‹œ์Šคํ…œ ์„ค์ • ๋“ฑ)", + "๊ด€๋ฆฌ์šฉ ๋‹จ๋ง๊ธฐ ์ง€์ • ๋ฐ ๊ด€๋ฆฌ ํ˜„ํ™ฉ", + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์›๊ฒฉ ์ ‘๊ทผ์€ ์›์น™์ ์œผ๋กœ ๊ธˆ์ง€ํ•˜๊ณ  ๋ถˆ๊ฐ€ํ”ผํ•œ ๊ฒฝ์šฐ IP ๊ธฐ๋ฐ˜์˜ ์ ‘๊ทผํ†ต์ œ๋ฅผ ํ†ตํ•˜์—ฌ ์Šน์ธ๋œ ์‚ฌ์šฉ์ž๋งŒ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ช…์‹œํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์›๊ฒฉ ๋ฐ์Šคํฌํ†ฑ ์—ฐ๊ฒฐ, SSH ์ ‘์†์ด IP์ฃผ์†Œ ๋“ฑ์œผ๋กœ ์ œํ•œ๋˜์–ด ์žˆ์ง€ ์•Š์•„ ๋ชจ๋“  PC์—์„œ ์›๊ฒฉ ์ ‘์†์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์›๊ฒฉ์šด์˜๊ด€๋ฆฌ๋ฅผ ์œ„ํ•˜์—ฌ VPN์„ ๊ตฌ์ถ•ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, VPN์— ๋Œ€ํ•œ ์‚ฌ์šฉ ์Šน์ธ ๋˜๋Š” ์ ‘์† ๊ธฐ๊ฐ„ ์ œํ•œ ์—†์ด ์ƒ์‹œ ํ—ˆ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์™ธ๋ถ€ ๊ทผ๋ฌด์ž๋ฅผ ์œ„ํ•˜์—ฌ ๊ฐœ์ธ ์Šค๋งˆํŠธ ๊ธฐ๊ธฐ์— ์—…๋ฌด์šฉ ๋ชจ๋ฐ”์ผ ์•ฑ์„ ์„ค์น˜ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์•…์„ฑ์ฝ”๋“œ, ๋ถ„์‹คยท๋„๋‚œ ๋“ฑ์— ์˜ํ•œ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•œ ์ ์ ˆํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…(๋ฐฑ์‹ , ์ดˆ๊ธฐํ™”, ์•”ํ˜ธํ™” ๋“ฑ)์„ ์ ์šฉํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์™ธ๋ถ€ ์ ‘์†์šฉ VPN์—์„œ ์‚ฌ์šฉ์ž๋ณ„๋กœ ์›๊ฒฉ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•œ ๋„คํŠธ์›Œํฌ ๊ตฌ๊ฐ„ ๋ฐ ์ •๋ณด์‹œ์Šคํ…œ์„ ์ œํ•œํ•˜์ง€ ์•Š์•„ ์›๊ฒฉ์ ‘๊ทผ ์ธ์ฆ์„ ๋ฐ›์€ ์‚ฌ์šฉ์ž๊ฐ€ ์ „์ฒด ๋‚ด๋ถ€๋ง ๋ฐ ์ •๋ณด์‹œ์Šคํ…œ์— ๊ณผ๋„ํ•˜๊ฒŒ ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.6.7", + "Name": "์ธํ„ฐ๋„ท ์ ‘์† ํ†ต์ œ", + "Description": "์ธํ„ฐ๋„ท์„ ํ†ตํ•œ ์ •๋ณด ์œ ์ถœ, ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ, ๋‚ด๋ถ€๋ง ์นจํˆฌ ๋“ฑ์„ ์˜ˆ๋ฐฉํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ฃผ์š” ์ •๋ณด์‹œ์Šคํ…œ, ์ฃผ์š” ์ง๋ฌด ์ˆ˜ํ–‰ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ทจ๊ธ‰ ๋‹จ๋ง๊ธฐ ๋“ฑ์— ๋Œ€ํ•œ ์ธํ„ฐ๋„ท ์ ‘์† ๋˜๋Š” ์„œ๋น„์Šค(P2P, ์›นํ•˜๋“œ, ๋ฉ”์‹ ์ € ๋“ฑ)๋ฅผ ์ œํ•œํ•˜๋Š” ๋“ฑ ์ธํ„ฐ๋„ท ์ ‘์† ํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_changes_to_network_acls_alarm_configured", + "workspaces_vpc_2private_1public_subnets_nat", + "workspaces_volume_encryption_enabled", + "networkfirewall_in_all_vpc", + "vpc_subnet_no_public_ip_by_default", + "vpc_flow_logs_enabled", + "vpc_subnet_separate_private_public", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout", + "route53_dangling_ip_subdomain_takeover", + "ec2_elastic_ip_unassigned", + "ec2_elastic_ip_shodan", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_public_ip" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.6. ์ ‘๊ทผํ†ต์ œ", + "Section": "2.6.7 ์ธํ„ฐ๋„ท ์ ‘์† ํ†ต์ œ", + "AuditChecklist": [ + "์ฃผ์š” ์ง๋ฌด ์ˆ˜ํ–‰ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ทจ๊ธ‰ ๋‹จ๋ง๊ธฐ ๋“ฑ ์—…๋ฌด์šฉ PC์˜ ์ธํ„ฐ๋„ท ์ ‘์†์— ๋Œ€ํ•œ ํ†ต์ œ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ์š” ์ •๋ณด์‹œ์Šคํ…œ(DB์„œ๋ฒ„ ๋“ฑ)์—์„œ ๋ถˆํ•„์š”ํ•œ ์™ธ๋ถ€ ์ธํ„ฐ๋„ท ์ ‘์†์„ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ด€๋ จ ๋ฒ•๋ น์— ๋”ฐ๋ผ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์˜๋ฌด๊ฐ€ ๋ถ€๊ณผ๋œ ๊ฒฝ์šฐ ๋Œ€์ƒ์ž๋ฅผ ์‹๋ณ„ํ•˜์—ฌ ์•ˆ์ „ํ•œ ๋ฐฉ์‹์œผ๋กœ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜๋ฅผ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "๋น„์—…๋ฌด์‚ฌ์ดํŠธ(P2P ๋“ฑ) ์ฐจ๋‹จ์ •์ฑ…(๋น„์—…๋ฌด์‚ฌ์ดํŠธ ์ฐจ๋‹จ์‹œ์Šคํ…œ ๊ด€๋ฆฌํ™”๋ฉด ๋“ฑ)", + "์ธํ„ฐ๋„ท ์ ‘์†๋‚ด์—ญ ๋ชจ๋‹ˆํ„ฐ๋ง ์ด๋ ฅ", + "์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ์กฐ์น˜ ๋Œ€์ƒ์ž ๋ชฉ๋ก", + "๋ง๊ฐ„ ์ž๋ฃŒ ์ „์†ก ์ ˆ์ฐจ ๋ฐ ์ฒ˜๋ฆฌ๋‚ด์—ญ(์‹ ์ฒญยท์Šน์ธ๋‚ด์—ญ ๋“ฑ)", + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ•์— ๋”ฐ๋ผ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜๋ฅผ ์ ์šฉํ•˜์˜€์œผ๋‚˜, ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ์ ‘๊ทผ๊ถŒํ•œ ์„ค์ • ๊ฐ€๋Šฅ์ž ๋“ฑ ์ผ๋ถ€ ์˜๋ฌด๋Œ€์ƒ์ž์— ๋Œ€ํ•˜์—ฌ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜ ์ ์šฉ์ด ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ•์— ๋”ฐ๋ฅธ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜ ์˜๋ฌด๋Œ€์ƒ์œผ๋กœ์„œ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜๋ฅผ ์ ์šฉํ•˜์˜€์œผ๋‚˜, ๋‹ค๋ฅธ ์„œ๋ฒ„๋ฅผ ๊ฒฝ์œ ํ•œ ์šฐํšŒ์ ‘์†์ด ๊ฐ€๋Šฅํ•˜์—ฌ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜๊ฐ€ ์ ์šฉ๋˜์ง€ ์•Š์€ ํ™˜๊ฒฝ์—์„œ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ์ ‘์†ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด์˜ ๋‹ค์šด๋กœ๋“œ, ํŒŒ๊ธฐ ๋“ฑ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : DMZ ๋ฐ ๋‚ด๋ถ€๋ง์— ์œ„์น˜ํ•œ ์ผ๋ถ€ ์„œ๋ฒ„์—์„œ ๋ถˆํ•„์š”ํ•˜๊ฒŒ ์ธํ„ฐ๋„ท์œผ๋กœ์˜ ์ง์ ‘ ์ ‘์†์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ธํ„ฐ๋„ท PC์™€ ๋‚ด๋ถ€ ์—…๋ฌด์šฉ PC๋ฅผ ๋ฌผ๋ฆฌ์  ๋ง๋ถ„๋ฆฌ ๋ฐฉ์‹์œผ๋กœ ์ธํ„ฐ๋„ท๋ง ์ฐจ๋‹จ ์กฐ์น˜๋ฅผ ์ ์šฉํ•˜๊ณ  ๋ง๊ฐ„ ์ž๋ฃŒ์ „์†ก์‹œ์Šคํ…œ์„ ๊ตฌ์ถ•ยท์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ž๋ฃŒ ์ „์†ก์— ๋Œ€ํ•œ ์Šน์ธ ์ ˆ์ฐจ๊ฐ€ ๋ถ€์žฌํ•˜๊ณ  ์ž๋ฃŒ ์ „์†ก ๋‚ด์—ญ์— ๋Œ€ํ•œ ์ฃผ๊ธฐ์  ๊ฒ€ํ† ๊ฐ€ ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž๊ฐ€ P2P ๋ฐ ์›นํ•˜๋“œ ์‚ฌ์ดํŠธ ์ ‘์† ์‹œ ์ฑ…์ž„์ž ์Šน์ธ์„ ๊ฑฐ์ณ ํŠน์ • ๊ธฐ๊ฐ„ ๋™์•ˆ๋งŒ ํ—ˆ์šฉํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์Šน์ธ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜์ง€ ์•Š๊ณ  ์˜ˆ์™ธ ์ ‘์†์ด ํ—ˆ์šฉ๋œ ์‚ฌ๋ก€๊ฐ€ ๋‹ค์ˆ˜ ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.7.1", + "Name": "์•”ํ˜ธ์ •์ฑ… ์ ์šฉ", + "Description": "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์œ„ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ๋ฐ˜์˜ํ•œ ์•”ํ˜ธํ™” ๋Œ€์ƒ, ์•”ํ˜ธ ๊ฐ•๋„, ์•”ํ˜ธ ์‚ฌ์šฉ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด์˜ ์ €์žฅยท์ „์†กยท์ „๋‹ฌ ์‹œ ์•”ํ˜ธํ™”๋ฅผ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "ssm_document_secrets", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_group_no_secrets_in_logs", + "glue_etl_jobs_amazon_s3_encryption_enabled", + "glue_development_endpoints_s3_encryption_enabled", + "glue_data_catalogs_metadata_encryption_enabled", + "glue_data_catalogs_connection_passwords_encryption_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_database_connections_ssl_enabled", + "glue_etl_jobs_job_bookmark_encryption_enabled", + "glue_development_endpoints_job_bookmark_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_default_encryption", + "s3_bucket_secure_transport_policy", + "documentdb_cluster_storage_encrypted", + "sns_subscription_not_using_http_endpoints", + "sns_topics_kms_encryption_at_rest_enabled", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_field_level_encryption_enabled", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "opensearch_service_domains_encryption_at_rest_enabled", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_node_to_node_encryption_enabled", + "neptune_cluster_storage_encrypted", + "dynamodb_accelerator_cluster_encryption_enabled", + "dynamodb_tables_kms_cmk_encryption_enabled", + "storagegateway_fileshare_encryption_enabled", + "ecs_task_definitions_no_environment_secrets", + "directoryservice_radius_server_security_protocol", + "workspaces_volume_encryption_enabled", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "sqs_queues_server_side_encryption_enabled", + "cloudtrail_kms_encryption_enabled", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "eks_cluster_kms_cmk_encryption_in_secrets_enabled", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_encryption_at_rest_uses_cmk", + "kafka_cluster_in_transit_encryption_enabled", + "autoscaling_find_secrets_ec2_launch_configuration", + "elbv2_insecure_ssl_ciphers", + "elbv2_ssl_listeners", + "backup_vaults_exist", + "backup_vaults_encrypted", + "cloudformation_stack_outputs_find_secrets", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "elasticache_redis_cluster_rest_encryption_enabled", + "rds_instance_storage_encrypted", + "rds_snapshots_encrypted", + "rds_instance_transport_encrypted", + "apigateway_restapi_client_certificate_enabled", + "efs_encryption_at_rest_enabled", + "sagemaker_training_jobs_volume_and_output_encryption_enabled", + "sagemaker_training_jobs_intercontainer_encryption_enabled", + "sagemaker_notebook_instance_encryption_enabled", + "acm_certificates_with_secure_key_algorithms", + "athena_workgroup_enforce_configuration", + "athena_workgroup_encryption", + "ec2_instance_secrets_user_data", + "ec2_ebs_default_encryption", + "ec2_ebs_snapshots_encrypted", + "ec2_launch_template_no_secrets", + "ec2_ebs_volume_encryption" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.7. ์•”ํ˜ธํ™” ์ ์šฉ", + "Section": "2.7.1 ์•”ํ˜ธ์ •์ฑ… ์ ์šฉ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด์˜ ๋ณดํ˜ธ๋ฅผ ์œ„ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ๋ฐ˜์˜ํ•œ ์•”ํ˜ธํ™” ๋Œ€์ƒ, ์•”ํ˜ธ๊ฐ•๋„, ์•”ํ˜ธ์‚ฌ์šฉ ๋“ฑ์ด ํฌํ•จ๋œ ์•”ํ˜ธ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์•”ํ˜ธ์ •์ฑ…์— ๋”ฐ๋ผ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ฃผ์š”์ •๋ณด์˜ ์ €์žฅ, ์ „์†ก, ์ „๋‹ฌ ์‹œ ์•”ํ˜ธํ™”๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ24์กฐ์˜2(์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ฒ˜๋ฆฌ์˜ ์ œํ•œ), ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ7์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์•”ํ˜ธํ™”)" + ], + "AuditEvidence": [ + "์•”ํ˜ธํ†ต์ œ ์ •์ฑ…(๋Œ€์ƒ, ๋ฐฉ์‹, ์•Œ๊ณ ๋ฆฌ์ฆ˜ ๋“ฑ)", + "์•”ํ˜ธํ™” ์ ์šฉํ˜„ํ™ฉ(์ €์žฅ ๋ฐ ์ „์†ก ์‹œ)", + "์œ„ํ—˜๋„ ๋ถ„์„ ๊ฒฐ๊ณผ(๋‚ด๋ถ€๋ง์—์„œ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ด์™ธ์˜ ๊ณ ์œ ์‹๋ณ„์ •๋ณด ์•”ํ˜ธํ™” ๋ฏธ์ ์šฉ ์‹œ)", + "์•”ํ˜ธํ™” ์†”๋ฃจ์…˜ ๊ด€๋ฆฌ ํ™”๋ฉด" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ์ •์ฑ…ยท์ง€์นจ์— ์•”ํ˜ธํ†ต์ œ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ๊ณ ๋ คํ•œ ์•”ํ˜ธํ™” ๋Œ€์ƒ, ์•”ํ˜ธ ๊ฐ•๋„, ์ €์žฅ ๋ฐ ์ „์†ก ์‹œ ์•”ํ˜ธํ™” ๋ฐฉ๋ฒ•, ์•”ํ˜ธํ™” ๊ด€๋ จ ๋‹ด๋‹น์ž์˜ ์—ญํ•  ๋ฐ ์ฑ…์ž„ ๋“ฑ์— ๊ด€ํ•œ ์‚ฌํ•ญ์ด ์ ์ ˆํžˆ ๋ช…์‹œ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์•”ํ˜ธ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๋ฉด์„œ ํ•ด๋‹น ๊ธฐ์—…์ด ์ ์šฉ๋ฐ›๋Š” ๋ฒ•๊ทœ๋ฅผ ์ž˜๋ชป ์ ์šฉํ•˜์—ฌ ์•”ํ˜ธํ™” ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ์ค€์ˆ˜ํ•˜์ง€ ๋ชปํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ(์˜ˆ๋ฅผ ๋“ค์–ด, ์ด์šฉ์ž์˜ ๊ณ„์ขŒ๋ฒˆํ˜ธ๋ฅผ ์ €์žฅํ•˜๋ฉด์„œ ์•”ํ˜ธํ™” ๋ฏธ์ ์šฉ)", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ๋ฐ ์ •๋ณด์ฃผ์ฒด์˜ ๋น„๋ฐ€๋ฒˆํ˜ธ์— ๋Œ€ํ•˜์—ฌ ์ผ๋ฐฉํ–ฅ ์•”ํ˜ธํ™”๋ฅผ ์ ์šฉํ•˜์˜€์œผ๋‚˜, ์•ˆ์ „ํ•˜์ง€ ์•Š์€ MD5 ์•Œ๊ณ ๋ฆฌ์ฆ˜์„ ์‚ฌ์šฉํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๊ฐ€ ๊ด€๋ จ ๋ฒ•๊ทœ ๋ฐ ๋‚ด๋ถ€ ๊ทœ์ •์— ๋”ฐ๋ผ ์ธํ„ฐ๋„ท ์‡ผํ•‘๋ชฐ์— ๋Œ€ํ•˜์—ฌ ๋ณด์•ˆ์„œ๋ฒ„๋ฅผ ์ ์šฉํ•˜์˜€์œผ๋‚˜, ํšŒ์›์ •๋ณด ์กฐํšŒ ๋ฐ ๋ณ€๊ฒฝ, ๋น„๋ฐ€๋ฒˆํ˜ธ ์ฐพ๊ธฐ, ๋น„๋ฐ€๋ฒˆํ˜ธ ๋ณ€๊ฒฝ ๋“ฑ ์ด์šฉ์ž์˜ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ์ „์†ก๋˜๋Š” ์ผ๋ถ€ ๊ตฌ๊ฐ„์— ์•”ํ˜ธํ™” ์กฐ์น˜๊ฐ€ ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ •๋ณด์‹œ์Šคํ…œ ์ ‘์†์šฉ ๋น„๋ฐ€๋ฒˆํ˜ธ, ์ธ์ฆํ‚ค ๊ฐ’ ๋“ฑ์ด ์‹œ์Šคํ…œ ์„ค์ •ํŒŒ์ผ ๋ฐ ์†Œ์Šค์ฝ”๋“œ ๋‚ด์— ํ‰๋ฌธ์œผ๋กœ ์ €์žฅ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.7.2", + "Name": "์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ", + "Description": "์•”ํ˜ธํ‚ค์˜ ์•ˆ์ „ํ•œ ์ƒ์„ฑยท์ด์šฉยท๋ณด๊ด€ยท๋ฐฐํฌยทํŒŒ๊ธฐ๋ฅผ ์œ„ํ•œ ๊ด€๋ฆฌ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ํ•„์š” ์‹œ ๋ณต๊ตฌ๋ฐฉ์•ˆ์„ ๋งˆ๋ จํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "secretsmanager_automatic_rotation_enabled", + "kms_cmk_are_used", + "kms_key_not_publicly_accessible", + "kms_cmk_rotation_enabled", + "kms_cmk_not_deleted_unintentionally", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "directoryservice_ldap_certificate_expiration", + "rds_instance_certificate_expiration", + "acm_certificates_transparency_logs_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.7. ์•”ํ˜ธํ™” ์ ์šฉ", + "Section": "2.7.2 ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์•”ํ˜ธํ‚ค ์ƒ์„ฑ, ์ด์šฉ, ๋ณด๊ด€, ๋ฐฐํฌ, ๋ณ€๊ฒฝ, ๋ณต๊ตฌ, ํŒŒ๊ธฐ ๋“ฑ์— ๊ด€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์•”ํ˜ธํ‚ค๋Š” ํ•„์š”์‹œ ๋ณต๊ตฌ๊ฐ€ ๊ฐ€๋Šฅํ•˜๋„๋ก ๋ณ„๋„์˜ ์•ˆ์ „ํ•œ ์žฅ์†Œ์— ๋ณด๊ด€ํ•˜๊ณ  ์•”ํ˜ธํ‚ค ์‚ฌ์šฉ์— ๊ด€ํ•œ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ตœ์†Œํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ7์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์•”ํ˜ธํ™”)" + ], + "AuditEvidence": [ + "์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ์ •์ฑ…", + "์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ๋Œ€์žฅ ๋ฐ ๊ด€๋ฆฌ์‹œ์Šคํ…œ ํ™”๋ฉด" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์•”ํ˜ธ ์ •์ฑ… ๋‚ด์— ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ์™€ ๊ด€๋ จ๋œ ์ ˆ์ฐจ, ๋ฐฉ๋ฒ• ๋“ฑ์ด ๋ช…์‹œ๋˜์–ด ์žˆ์ง€ ์•Š์•„ ๋‹ด๋‹น์ž๋ณ„๋กœ ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ ์ˆ˜์ค€ ๋ฐ ๋ฐฉ๋ฒ• ์ƒ์ด ๋“ฑ ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ์— ์ทจ์•ฝ์‚ฌํ•ญ์ด ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ๊ทœ์ •์— ์ค‘์š” ์ •๋ณด๋ฅผ ์•”ํ˜ธํ™” ํ•  ๊ฒฝ์šฐ ๊ด€๋ จ ์ฑ…์ž„์ž ์Šน์ธ ํ•˜์— ์•”ํ˜ธํ™” ํ‚ค๋ฅผ ์ƒ์„ฑํ•˜๊ณ  ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ๋Œ€์žฅ์„ ์ž‘์„ฑํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์•”ํ˜ธํ‚ค ๊ด€๋ฆฌ๋Œ€์žฅ์— ์ผ๋ถ€ ์•”ํ˜ธํ‚ค๊ฐ€ ๋ˆ„๋ฝ๋˜์–ด ์žˆ๊ฑฐ๋‚˜ ํ˜„ํ–‰ํ™”๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ๋ฐœ์‹œ์Šคํ…œ์— ์ ์šฉ๋˜์–ด ์žˆ๋Š” ์•”ํ˜ธํ‚ค์™€ ์šด์˜์‹œ์Šคํ…œ์— ์ ์šฉ๋œ ์•”ํ˜ธํ‚ค๊ฐ€ ๋™์ผํ•˜์—ฌ, ์•”ํ˜ธํ™”๋œ ์‹ค๋ฐ์ดํ„ฐ๊ฐ€ ๊ฐœ๋ฐœ์‹œ์Šคํ…œ์„ ํ†ตํ•ด ์‰ฝ๊ฒŒ ๋ณตํ˜ธํ™”๊ฐ€ ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.8.1", + "Name": "๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ์ •์˜", + "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ๋„์ž…ยท๊ฐœ๋ฐœยท๋ณ€๊ฒฝ ์‹œ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ, ์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์ , ์•ˆ์ „ํ•œ ์ฝ”๋”ฉ๋ฐฉ๋ฒ• ๋“ฑ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์„ ์ •์˜ํ•˜๊ณ  ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "codebuild_project_user_controlled_buildspec", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "macie_is_enabled", + "inspector2_is_enabled", + "config_recorder_all_regions_enabled", + "fms_policy_compliant", + "wafv2_webacl_logging_enabled", + "accessanalyzer_enabled", + "wellarchitected_workload_no_high_or_medium_risks", + "cloudtrail_cloudwatch_logging_enabled", + "networkfirewall_in_all_vpc", + "vpc_flow_logs_enabled", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "securityhub_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Section": "2.8.1 ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ์ •์˜", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์„ ์‹ ๊ทœ๋กœ ๋„์ž…ยท๊ฐœ๋ฐœ ๋˜๋Š” ๋ณ€๊ฒฝํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ ์ธก๋ฉด์˜ ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ๋ฐ ์ธ์ˆ˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์„ ์‹ ๊ทœ๋กœ ๋„์ž…ยท๊ฐœ๋ฐœ ๋˜๋Š” ๋ณ€๊ฒฝํ•˜๋Š” ๊ฒฝ์šฐ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ, ์ตœ์‹  ์ทจ์•ฝ์  ๋“ฑ์„ ํฌํ•จํ•œ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์„ค๊ณ„ ๋‹จ๊ณ„์—์„œ๋ถ€ํ„ฐ ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์˜ ์•ˆ์ „ํ•œ ๊ตฌํ˜„์„ ์œ„ํ•œ ์ฝ”๋”ฉ ํ‘œ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด์‹œ์Šคํ…œ ์ธ์ˆ˜ ๊ธฐ์ค€ ๋ฐ ์ ˆ์ฐจ", + "์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… RFP(์ œ์•ˆ์š”์ฒญ์„œ) ๋ฐ ๊ตฌ๋งค๊ณ„์•ฝ์„œ", + "๊ฐœ๋ฐœ ์‚ฐ์ถœ๋ฌผ(์‚ฌ์—…์ˆ˜ํ–‰๊ณ„ํš์„œ, ์š”๊ตฌ์‚ฌํ•ญ์ •์˜์„œ, ํ™”๋ฉด์„ค๊ณ„์„œ, ๋ณด์•ˆ์•„ํ‚คํ…์ฒ˜ ์„ค๊ณ„์„œ, ์‹œํ—˜๊ณ„ํš์„œ ๋“ฑ)", + "์‹œํ์–ด ์ฝ”๋”ฉ ํ‘œ์ค€" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด์‹œ์Šคํ…œ ์ธ์ˆ˜ ์ „ ๋ณด์•ˆ์„ฑ ๊ฒ€์ฆ ๊ธฐ์ค€ ๋ฐ ์ ˆ์ฐจ๊ฐ€ ๋งˆ๋ จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์‹ ๊ทœ ์‹œ์Šคํ…œ ๋„์ž… ์‹œ ๊ธฐ์กด ์šด์˜ํ™˜๊ฒฝ์— ๋Œ€ํ•œ ์˜ํ–ฅ ๋ฐ ๋ณด์•ˆ์„ฑ์„ ๊ฒ€ํ† ํ•˜๋„๋ก ๋‚ด๋ถ€ ๊ทœ์ •์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ตœ๊ทผ ๋„์ž…ํ•œ ์ผ๋ถ€ ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•˜์—ฌ ์ธ์ˆ˜ ์‹œ ๋ณด์•ˆ์š”๊ฑด์— ๋Œ€ํ•ด ์„ธ๋ถ€ ๊ธฐ์ค€ ๋ฐ ๊ณ„ํš์ด ์ˆ˜๋ฆฝ๋˜์ง€ ์•Š์•˜์œผ๋ฉฐ, ์ด์— ๋”ฐ๋ผ ์ธ์ˆ˜ ์‹œ ๋ณด์•ˆ์„ฑ๊ฒ€ํ† ๊ฐ€ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ๋ฐœ ๊ด€๋ จ ๋‚ด๋ถ€ ์ง€์นจ์— ๊ฐœ๋ฐœ๊ณผ ๊ด€๋ จ๋œ ์ฃผ์š” ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ(์ธ์ฆ ๋ฐ ์•”ํ˜ธํ™”, ๋ณด์•ˆ๋กœ๊ทธ ๋“ฑ)์ด ์ •์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : สป๊ฐœ๋ฐœํ‘œ์ค€์ •์˜์„œสผ์— ์‚ฌ์šฉ์ž ํŒจ์Šค์›Œ๋“œ๋ฅผ ์•ˆ์ „ํ•˜์ง€ ์•Š์€ ์•”ํ˜ธํ™” ์•Œ๊ณ ๋ฆฌ์ฆ˜(MD5, SHA1)์œผ๋กœ ์‚ฌ์šฉํ•˜๋„๋ก ๋˜์–ด ์žˆ์–ด ๊ด€๋ จ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ์ ์ ˆํžˆ ๋ฐ˜์˜ํ•˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.8.2", + "Name": "๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ๊ฒ€ํ†  ๋ฐ ์‹œํ—˜", + "Description": "์‚ฌ์ „ ์ •์˜๋œ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ์ •๋ณด์‹œ์Šคํ…œ์ด ๋„์ž… ๋˜๋Š” ๊ตฌํ˜„๋˜์—ˆ๋Š”์ง€๋ฅผ ๊ฒ€ํ† ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ ์ค€์ˆ˜, ์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์  ์ ๊ฒ€, ์•ˆ์ „ํ•œ ์ฝ”๋”ฉ ๊ตฌํ˜„, ๊ฐœ์ธ์ •๋ณด ์˜ํ–ฅํ‰๊ฐ€ ๋“ฑ์˜ ๊ฒ€ํ†  ๊ธฐ์ค€๊ณผ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์— ๋Œ€ํ•œ ๊ฐœ์„ ์กฐ์น˜๋ฅผ ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "codebuild_project_user_controlled_buildspec", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "macie_is_enabled", + "inspector2_is_enabled", + "inspector2_active_findings_exist", + "config_recorder_all_regions_enabled", + "fms_policy_compliant", + "wafv2_webacl_logging_enabled", + "accessanalyzer_enabled_without_findings", + "accessanalyzer_enabled", + "wellarchitected_workload_no_high_or_medium_risks", + "cloudtrail_cloudwatch_logging_enabled", + "networkfirewall_in_all_vpc", + "vpc_flow_logs_enabled", + "guardduty_no_high_severity_findings", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "securityhub_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Section": "2.8.2 ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ ๊ฒ€ํ†  ๋ฐ ์‹œํ—˜", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์˜ ๋„์ž…, ๊ฐœ๋ฐœ, ๋ณ€๊ฒฝ ์‹œ ๋ถ„์„ ๋ฐ ์„ค๊ณ„ ๋‹จ๊ณ„์—์„œ ์ •์˜ํ•œ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์ด ํšจ๊ณผ์ ์œผ๋กœ ์ ์šฉ๋˜์—ˆ๋Š”์ง€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•œ ์‹œํ—˜์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์ด ์•ˆ์ „ํ•œ ์ฝ”๋”ฉ ๊ธฐ์ค€ ๋“ฑ์— ๋”ฐ๋ผ ์•ˆ์ „ํ•˜๊ฒŒ ๊ฐœ๋ฐœ๋˜์—ˆ๋Š”์ง€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•œ ์ทจ์•ฝ์  ์ ๊ฒ€์ด ์ˆ˜ํ–‰๋˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‹œํ—˜ ๋ฐ ์ทจ์•ฝ์  ์ ๊ฒ€ ๊ณผ์ •์—์„œ ๋ฐœ๊ฒฌ๋œ ๋ฌธ์ œ์ ์ด ์‹ ์†ํ•˜๊ฒŒ ๊ฐœ์„ ๋  ์ˆ˜ ์žˆ๋„๋ก ๊ฐœ์„ ๊ณ„ํš ์ˆ˜๋ฆฝ, ์ดํ–‰์ ๊ฒ€ ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ณต๊ธฐ๊ด€์€ ๊ด€๋ จ ๋ฒ•๋ น์— ๋”ฐ๋ผ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ์‹ ๊ทœ ๊ฐœ๋ฐœ ๋ฐ ๋ณ€๊ฒฝ ์‹œ ๋ถ„์„ยท์„ค๊ณ„ ๋‹จ๊ณ„์—์„œ ์˜ํ–ฅํ‰๊ฐ€๊ธฐ๊ด€์„ ํ†ตํ•˜์—ฌ ์˜ํ–ฅํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ๊ทธ ๊ฒฐ๊ณผ๋ฅผ ๊ฐœ๋ฐœ ๋ฐ ๋ณ€๊ฒฝ ์‹œ ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ33์กฐ(๊ฐœ์ธ์ •๋ณด ์˜ํ–ฅํ‰๊ฐ€)", + "๊ฐœ์ธ์ •๋ณด ์˜ํ–ฅํ‰๊ฐ€์— ๊ด€ํ•œ ๊ณ ์‹œ" + ], + "AuditEvidence": [ + "์ •๋ณด์‹œ์Šคํ…œ ์ธ์ˆ˜ ์‹œํ—˜ ๊ฒฐ๊ณผ", + "์š”๊ตฌ์‚ฌํ•ญ ์ถ”์  ๋งคํŠธ๋ฆญ์Šค", + "์‹œํ—˜ ๊ณ„ํš์„œ, ์‹œํ—˜ ๊ฒฐ๊ณผ์„œ", + "์ทจ์•ฝ์  ์ ๊ฒ€ ๊ฒฐ๊ณผ์„œ", + "๊ฐœ์ธ์ •๋ณด ์˜ํ–ฅํ‰๊ฐ€์„œ", + "๊ฐœ์ธ์ •๋ณด ์˜ํ–ฅํ‰๊ฐ€ ๊ฐœ์„ ๊ณ„ํš ์ดํ–‰์ ๊ฒ€ ํ™•์ธ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ •๋ณด์‹œ์Šคํ…œ ๊ตฌํ˜„ ์ดํ›„ ๊ฐœ๋ฐœ ๊ด€๋ จ ๋‚ด๋ถ€ ์ง€์นจ ๋ฐ ๋ฌธ์„œ์— ์ •์˜๋œ ๋ณด์•ˆ ์š”๊ตฌ์‚ฌํ•ญ์„ ์‹œํ—˜ํ•˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์‘์šฉํ”„๋กœ๊ทธ๋žจ ํ…Œ์ŠคํŠธ ์‹œ๋‚˜๋ฆฌ์˜ค ๋ฐ ๊ธฐ์ˆ ์  ์ทจ์•ฝ์  ์ ๊ฒ€ํ•ญ๋ชฉ์— ์ž…๋ ฅ๊ฐ’ ์œ ํšจ์„ฑ ์ฒดํฌ ๋“ฑ์˜ ์ค‘์š” ์ ๊ฒ€ํ•ญ๋ชฉ ์ผ๋ถ€๊ฐ€ ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ตฌํ˜„ ๋˜๋Š” ์‹œํ—˜ ๊ณผ์ •์—์„œ ์•Œ๋ ค์ง„ ๊ธฐ์ˆ ์  ์ทจ์•ฝ์ ์ด ์กด์žฌํ•˜๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ ๊ฒ€ํ•˜์ง€ ์•Š๊ฑฐ๋‚˜, ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋˜๋Š” ์Šน์ธ ์—†์ด ํ™•์ธ๋œ ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ ๊ฐœ์„ ์กฐ์น˜๋ฅผ ์ดํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ณต๊ณต๊ธฐ๊ด€์ด 5๋งŒ ๋ช… ์ด์ƒ ์ •๋ณด์ฃผ์ฒด์˜ ๊ณ ์œ ์‹๋ณ„์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๋“ฑ ์˜ํ–ฅํ‰๊ฐ€ ์˜๋ฌด ๋Œ€์ƒ ๊ฐœ์ธ์ •๋ณด ํŒŒ์ผ ๋ฐ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์„ ์‹ ๊ทœ๋กœ ๊ตฌ์ถ•ํ•˜๋ฉด์„œ ์˜ํ–ฅํ‰๊ฐ€๋ฅผ ์‹ค์‹œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๊ณต๊ณต๊ธฐ๊ด€์ด ์˜ํ–ฅํ‰๊ฐ€๋ฅผ ์ˆ˜ํ–‰ํ•œ ํ›„ ์˜ํ–ฅํ‰๊ฐ€๊ธฐ๊ด€์œผ๋กœ๋ถ€ํ„ฐ ์˜ํ–ฅํ‰๊ฐ€์„œ๋ฅผ ๋ฐ›์€ ์ง€ 2๊ฐœ์›”์ด ์ง€๋‚ฌ์Œ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ์˜ํ–ฅํ‰๊ฐ€์„œ๋ฅผ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์œ„์›ํšŒ์— ์ œ์ถœํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ์‹ ๊ทœ ์‹œ์Šคํ…œ ๋„์ž… ์‹œ ๊ธฐ์กด ์šด์˜ํ™˜๊ฒฝ์— ๋Œ€ํ•œ ์˜ํ–ฅ ๋ฐ ๋ณด์•ˆ์„ฑ์„ ๊ฒ€ํ† (์ทจ์•ฝ์  ์ ๊ฒ€ ๋“ฑ)ํ•˜๋„๋ก ๋‚ด๋ถ€ ์ง€์นจ์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ตœ๊ทผ ๋„์ž…ํ•œ ์ผ๋ถ€ ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•˜์—ฌ ์ธ์ˆ˜ ์‹œ ์ทจ์•ฝ์  ์ ๊ฒ€ ๋“ฑ ๋ณด์•ˆ์„ฑ๊ฒ€ํ† ๊ฐ€ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.8.3", + "Name": "์‹œํ—˜๊ณผ ์šด์˜ ํ™˜๊ฒฝ ๋ถ„๋ฆฌ", + "Description": "๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ์‹œ์Šคํ…œ์€ ์šด์˜์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ ๋ฐ ๋ณ€๊ฒฝ์˜ ์œ„ํ—˜์„ ๊ฐ์†Œ์‹œํ‚ค๊ธฐ ์œ„ํ•˜์—ฌ ์›์น™์ ์œผ๋กœ ๋ถ„๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_user_controlled_buildspec" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Section": "2.8.3 ์‹œํ—˜๊ณผ ์šด์˜ ํ™˜๊ฒฝ ๋ถ„๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ์‹œ์Šคํ…œ์„ ์šด์˜์‹œ์Šคํ…œ๊ณผ ๋ถ„๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ถˆ๊ฐ€ํ”ผํ•œ ์‚ฌ์œ ๋กœ ๊ฐœ๋ฐœ๊ณผ ์šด์˜ํ™˜๊ฒฝ์˜ ๋ถ„๋ฆฌ๊ฐ€ ์–ด๋ ค์šด ๊ฒฝ์šฐ ์ƒํ˜ธ๊ฒ€ํ† , ์ƒ๊ธ‰์ž ๋ชจ๋‹ˆํ„ฐ๋ง, ๋ณ€๊ฒฝ ์Šน์ธ, ์ฑ…์ž„์ถ”์ ์„ฑ ํ™•๋ณด ๋“ฑ์˜ ๋ณด์•ˆ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„(์‹œํ—˜ํ™˜๊ฒฝ ๊ตฌ์„ฑ ํฌํ•จ)", + "์šด์˜ ํ™˜๊ฒฝ๊ณผ ๊ฐœ๋ฐœยท์‹œํ—˜ ํ™˜๊ฒฝ ๊ฐ„ ์ ‘๊ทผํ†ต์ œ ์ ์šฉ ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋˜๋Š” ์Šน์ธ ์—†์ด ๋ณ„๋„์˜ ๊ฐœ๋ฐœํ™˜๊ฒฝ์„ ๊ตฌ์„ฑํ•˜์ง€ ์•Š๊ณ  ์šด์˜ํ™˜๊ฒฝ์—์„œ ์ง์ ‘ ์†Œ์Šค์ฝ”๋“œ ๋ณ€๊ฒฝ์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ถˆ๊ฐ€ํ”ผํ•˜๊ฒŒ ๊ฐœ๋ฐœ์‹œ์Šคํ…œ๊ณผ ์šด์˜์‹œ์Šคํ…œ์„ ๋ถ„๋ฆฌํ•˜์ง€ ์•Š๊ณ  ์šด์˜ ์ค‘์— ์žˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ์ƒํ˜ธ ๊ฒ€ํ†  ๋‚ด์—ญ, ๋ชจ๋‹ˆํ„ฐ๋ง ๋‚ด์—ญ ๋“ฑ์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ๋ฐœ์‹œ์Šคํ…œ์ด ๋ณ„๋„๋กœ ๊ตฌ์„ฑ๋˜์–ด ์žˆ์œผ๋‚˜, ๊ฐœ๋ฐœํ™˜๊ฒฝ์œผ๋กœ๋ถ€ํ„ฐ ์šด์˜ํ™˜๊ฒฝ์œผ๋กœ์˜ ์ ‘๊ทผ์ด ํ†ต์ œ๋˜์ง€ ์•Š์•„ ๊ฐœ๋ฐœ์ž๋“ค์ด ๊ฐœ๋ฐœ์‹œ์Šคํ…œ์„ ๊ฒฝ์œ ํ•˜์—ฌ ๋ถˆํ•„์š”ํ•˜๊ฒŒ ์šด์˜์‹œ์Šคํ…œ ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.8.4", + "Name": "์‹œํ—˜ ๋ฐ์ดํ„ฐ ๋ณด์•ˆ", + "Description": "์‹œ์Šคํ…œ ์‹œํ—˜ ๊ณผ์ •์—์„œ ์šด์˜๋ฐ์ดํ„ฐ์˜ ์œ ์ถœ์„ ์˜ˆ๋ฐฉํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์‹œํ—˜ ๋ฐ์ดํ„ฐ์˜ ์ƒ์„ฑ๊ณผ ์ด์šฉ ๋ฐ ๊ด€๋ฆฌ, ํŒŒ๊ธฐ, ๊ธฐ์ˆ ์  ๋ณดํ˜ธ์กฐ์น˜์— ๊ด€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_no_secrets_in_variables" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Section": "2.8.4 ์‹œํ—˜ ๋ฐ์ดํ„ฐ ๋ณด์•ˆ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐœ๋ฐœ ๋ฐ ์‹œํ—˜ ๊ณผ์ •์—์„œ ์‹ค์ œ ์šด์˜ ๋ฐ์ดํ„ฐ์˜ ์‚ฌ์šฉ์„ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ถˆ๊ฐ€ํ”ผํ•˜๊ฒŒ ์šด์˜๋ฐ์ดํ„ฐ๋ฅผ ์‹œํ—˜ ํ™˜๊ฒฝ์—์„œ ์‚ฌ์šฉํ•  ๊ฒฝ์šฐ ์ฑ…์ž„์ž ์Šน์ธ, ์ ‘๊ทผ ๋ฐ ์œ ์ถœ ๋ชจ๋‹ˆํ„ฐ๋ง, ์‹œํ—˜ ํ›„ ๋ฐ์ดํ„ฐ ์‚ญ์ œ ๋“ฑ์˜ ํ†ต์ œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์‹œํ—˜๋ฐ์ดํ„ฐ ํ˜„ํ™ฉ", + "์‹œํ—˜๋ฐ์ดํ„ฐ ์ƒ์„ฑ ๊ทœ์น™", + "์šด์˜๋ฐ์ดํ„ฐ๋ฅผ ์‹œํ—˜ํ™˜๊ฒฝ์— ์‚ฌ์šฉํ•œ ๊ฒฝ์šฐ, ๊ด€๋ จ ์Šน์ธ ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ๋ฐœ ์„œ๋ฒ„์—์„œ ์‚ฌ์šฉํ•  ์‹œํ—˜ ๋ฐ์ดํ„ฐ ์ƒ์„ฑ์— ๋Œ€ํ•œ ๊ตฌ์ฒด์  ๊ธฐ์ค€ ๋ฐ ์ ˆ์ฐจ๊ฐ€ ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋ฐ ์ฑ…์ž„์ž ์Šน์ธ ์—†์ด ์‹ค ์šด์˜๋ฐ์ดํ„ฐ๋ฅผ ๊ฐ€๊ณตํ•˜์ง€ ์•Š๊ณ  ์‹œํ—˜ ๋ฐ์ดํ„ฐ๋กœ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ถˆ๊ฐ€ํ”ผํ•œ ์‚ฌ์œ ๋กœ ์‚ฌ์ „ ์Šน์ธ์„ ๋ฐ›์•„ ์‹ค ์šด์˜๋ฐ์ดํ„ฐ๋ฅผ ์‹œํ—˜ ์šฉ๋„๋กœ ์‚ฌ์šฉํ•˜๋ฉด์„œ, ํ…Œ์ŠคํŠธ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ๋Œ€ํ•˜์—ฌ ์šด์˜ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์™€ ๋™์ผํ•œ ์ˆ˜์ค€์˜ ์ ‘๊ทผํ†ต์ œ๋ฅผ ์ ์šฉํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์‹ค ์šด์˜๋ฐ์ดํ„ฐ๋ฅผ ํ…Œ์ŠคํŠธ ์šฉ๋„๋กœ ์‚ฌ์šฉํ•œ ํ›„ ํ…Œ์ŠคํŠธ๊ฐ€ ์™„๋ฃŒ๋˜์—ˆ์Œ์—๋„ ์‹ค ์šด์˜๋ฐ์ดํ„ฐ๋ฅผ ํ…Œ์ŠคํŠธ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์—์„œ ์‚ญ์ œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.8.5", + "Name": "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๊ด€๋ฆฌ", + "Description": "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ์€ ์ธ๊ฐ€๋œ ์‚ฌ์šฉ์ž๋งŒ์ด ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ฆฌํ•˜๊ณ , ์šด์˜ํ™˜๊ฒฝ์— ๋ณด๊ด€ํ•˜์ง€ ์•Š๋Š” ๊ฒƒ์„ ์›์น™์œผ๋กœ ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "ecr_repositories_not_publicly_accessible", + "codeartifact_packages_external_public_publishing_disabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Section": "2.8.5 ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๊ด€๋ฆฌ", + "AuditChecklist": [ + "๋น„์ธ๊ฐ€์ž์— ์˜ํ•œ ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ์ ‘๊ทผ์„ ํ†ต์ œํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ์€ ์žฅ์•  ๋“ฑ ๋น„์ƒ์‹œ๋ฅผ ๋Œ€๋น„ํ•˜์—ฌ ์šด์˜ํ™˜๊ฒฝ์ด ์•„๋‹Œ ๊ณณ์— ์•ˆ์ „ํ•˜๊ฒŒ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ์— ๋Œ€ํ•œ ๋ณ€๊ฒฝ์ด๋ ฅ์„ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "SVN ๋“ฑ ํ˜•์ƒ๊ด€๋ฆฌ์‹œ์Šคํ…œ ์šด์˜ ํ˜„ํ™ฉ(์ ‘๊ทผ๊ถŒํ•œ์ž ๋ชฉ๋ก ๋“ฑ)", + "์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๋ณ€๊ฒฝ ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋ณ„๋„์˜ ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๋ฐฑ์—… ๋ฐ ํ˜•์ƒ๊ด€๋ฆฌ์‹œ์Šคํ…œ์ด ๊ตฌ์ถ•๋˜์–ด ์žˆ์ง€ ์•Š์œผ๋ฉฐ, ์ด์ „ ๋ฒ„์ „์˜ ์†Œ์Šค ์ฝ”๋“œ๋ฅผ ์šด์˜ ์„œ๋ฒ„ ๋˜๋Š” ๊ฐœ๋ฐœ์ž PC์— ์Šน์ธ ๋ฐ ์ด๋ ฅ๊ด€๋ฆฌ ์—†์ด ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ํ˜•์ƒ๊ด€๋ฆฌ์‹œ์Šคํ…œ์„ ๊ตฌ์ถ•ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜ ํ˜•์ƒ๊ด€๋ฆฌ์‹œ์Šคํ…œ ๋˜๋Š” ํ˜•์ƒ๊ด€๋ฆฌ์‹œ์Šคํ…œ์— ์ €์žฅ๋œ ์†Œ์Šค์ฝ”๋“œ์— ๋Œ€ํ•œ ์ ‘๊ทผ์ œํ•œ, ์ ‘๊ทผ ๋ฐ ๋ณ€๊ฒฝ์ด๋ ฅ์ด ์ ์ ˆํžˆ ๊ด€๋ฆฌ๋˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ๊ทœ์ •์—๋Š” ํ˜•์ƒ๊ด€๋ฆฌ์‹œ์Šคํ…œ์„ ํ†ตํ•˜์—ฌ ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ ๋ฒ„์ „๊ด€๋ฆฌ๋ฅผ ํ•˜๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์ตœ์‹  ๋ฒ„์ „์˜ ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ์€ ๊ฐœ๋ฐœ์ž PC์—๋งŒ ๋ณด๊ด€๋˜์–ด ์žˆ๊ณ  ์ด์— ๋Œ€ํ•œ ๋ณ„๋„์˜ ๋ฐฑ์—…์ด ์ˆ˜ํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.8.6", + "Name": "์šด์˜ํ™˜๊ฒฝ ์ด๊ด€", + "Description": "์‹ ๊ทœ ๋„์ž…ยท๊ฐœ๋ฐœ ๋˜๋Š” ๋ณ€๊ฒฝ๋œ ์‹œ์Šคํ…œ์„ ์šด์˜ํ™˜๊ฒฝ์œผ๋กœ ์ด๊ด€ํ•  ๋•Œ๋Š” ํ†ต์ œ๋œ ์ ˆ์ฐจ๋ฅผ ๋”ฐ๋ผ์•ผ ํ•˜๊ณ , ์‹คํ–‰์ฝ”๋“œ๋Š” ์‹œํ—˜ ๋ฐ ์‚ฌ์šฉ์ž ์ธ์ˆ˜ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์‹คํ–‰๋˜์–ด์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.8. ์ •๋ณด์‹œ์Šคํ…œ ๋„์ž… ๋ฐ ๊ฐœ๋ฐœ ๋ณด์•ˆ", + "Section": "2.8.6 ์šด์˜ํ™˜๊ฒฝ ์ด๊ด€", + "AuditChecklist": [ + "์‹ ๊ทœ ๋„์ž…ยท๊ฐœ๋ฐœ ๋ฐ ๋ณ€๊ฒฝ๋œ ์‹œ์Šคํ…œ์„ ์šด์˜ํ™˜๊ฒฝ์œผ๋กœ ์•ˆ์ „ํ•˜๊ฒŒ ์ด๊ด€ํ•˜๊ธฐ ์œ„ํ•œ ํ†ต์ œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์šด์˜ํ™˜๊ฒฝ์œผ๋กœ ์ด๊ด€ ์‹œ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ๋Š” ๋ฌธ์ œ์— ๋Œ€ํ•œ ๋Œ€์‘ ๋ฐฉ์•ˆ์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์šด์˜ํ™˜๊ฒฝ์—๋Š” ์„œ๋น„์Šค ์‹คํ–‰์— ํ•„์š”ํ•œ ํŒŒ์ผ๋งŒ์„ ์„ค์น˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ด๊ด€ ์ ˆ์ฐจ", + "์ด๊ด€ ๋‚ด์—ญ(์‹ ์ฒญยท์Šน์ธ, ์‹œํ—˜, ์ด๊ด€ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ๋ฐœยท๋ณ€๊ฒฝ์ด ์™„๋ฃŒ๋œ ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ์„ ์šด์˜ํ™˜๊ฒฝ์œผ๋กœ ์ด๊ด€ ์‹œ ๊ฒ€ํ† ยท์Šน์ธํ•˜๋Š” ์ ˆ์ฐจ๊ฐ€ ๋งˆ๋ จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์šด์˜์„œ๋ฒ„์— ์„œ๋น„์Šค ์‹คํ–‰์— ๋ถˆํ•„์š”ํ•œ ํŒŒ์ผ(์†Œ์Šค์ฝ”๋“œ ๋˜๋Š” ๋ฐฐํฌ๋ชจ๋“ˆ, ๋ฐฑ์—…๋ณธ, ๊ฐœ๋ฐœ ๊ด€๋ จ ๋ฌธ์„œ, ๋งค๋‰ด์–ผ ๋“ฑ)์ด ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ์ง€์นจ์— ์šด์˜ํ™˜๊ฒฝ ์ด๊ด€ ์‹œ ์•ˆ์ „ํ•œ ์ด๊ด€ยท๋ณต๊ตฌ๋ฅผ ์œ„ํ•˜์—ฌ ๋ณ€๊ฒฝ์ž‘์—… ์š”์ฒญ์„œ ๋ฐ ๊ฒฐ๊ณผ์„œ๋ฅผ ์ž‘์„ฑํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ด€๋ จ ๋ฌธ์„œ๊ฐ€ ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ๋ชจ๋ฐ”์ผ ์•ฑ์„ ์•ฑ๋งˆ์ผ“์— ๋ฐฐํฌํ•˜๋Š” ๊ฒฝ์šฐ ๋‚ด๋ถ€ ๊ฒ€ํ†  ๋ฐ ์Šน์ธ์„ ๋ฐ›๋„๋ก ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ฐœ๋ฐœ์ž๊ฐ€ ํ•ด๋‹น ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜์ง€ ์•Š๊ณ  ์ž„์˜๋กœ ์•ฑ๋งˆ์ผ“์— ๋ฐฐํฌํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.1", + "Name": "๋ณ€๊ฒฝ๊ด€๋ฆฌ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์ž์‚ฐ์˜ ๋ชจ๋“  ๋ณ€๊ฒฝ๋‚ด์—ญ์„ ๊ด€๋ฆฌํ•  ์ˆ˜ ์žˆ๋„๋ก ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ๋ณ€๊ฒฝ ์ „ ์‹œ์Šคํ…œ์˜ ์„ฑ๋Šฅ ๋ฐ ๋ณด์•ˆ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_older_90_days", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "config_recorder_all_regions_enabled", + "cloudtrail_cloudwatch_logging_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.1 ๋ณ€๊ฒฝ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์ž์‚ฐ(ํ•˜๋“œ์›จ์–ด, ์šด์˜์ฒด์ œ, ์ƒ์šฉ ์†Œํ”„ํŠธ์›จ์–ด ํŒจํ‚ค์ง€ ๋“ฑ) ๋ณ€๊ฒฝ์— ๊ด€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์ž์‚ฐ ๋ณ€๊ฒฝ์„ ์ˆ˜ํ–‰ํ•˜๊ธฐ ์ „ ์„ฑ๋Šฅ ๋ฐ ๋ณด์•ˆ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "๋ณ€๊ฒฝ๊ด€๋ฆฌ ์ ˆ์ฐจ", + "๋ณ€๊ฒฝ๊ด€๋ฆฌ ์ˆ˜ํ–‰ ๋‚ด์—ญ(์‹ ์ฒญยท์Šน์ธ, ๋ณ€๊ฒฝ ๋‚ด์—ญ ๋“ฑ)", + "๋ณ€๊ฒฝ์— ๋”ฐ๋ฅธ ์˜ํ–ฅ๋ถ„์„ ๊ฒฐ๊ณผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ตœ๊ทผ DMZ ๊ตฌ๊ฐ„ ์ด์ค‘ํ™”์— ๋”ฐ๋ฅธ ๋ณ€๊ฒฝ ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•˜์˜€์œผ๋‚˜, ๋ณ€๊ฒฝ ํ›„ ๋ฐœ์ƒํ•  ์ˆ˜ ์žˆ๋Š” ๋ณด์•ˆ์œ„ํ—˜์„ฑ ๋ฐ ์„ฑ๋Šฅ ํ‰๊ฐ€์— ๋Œ€ํ•œ ์ˆ˜ํ–‰ยท์Šน์ธ ์ฆ๊ฑฐ์ž๋ฃŒ๊ฐ€ ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ตœ๊ทผ ๋„คํŠธ์›Œํฌ ๋ณ€๊ฒฝ ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•˜์˜€์œผ๋‚˜ ๊ด€๋ จ ๊ฒ€ํ†  ๋ฐ ๊ณต์ง€๊ฐ€ ์ถฉ๋ถ„ํžˆ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์•„ ๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„ ๋ฐ ์ผ๋ถ€ ์ ‘๊ทผํ†ต์ œ์‹œ์Šคํ…œ(์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ์ œ์–ด์‹œ์Šคํ…œ ๋“ฑ)์˜ ์ ‘๊ทผํ†ต์ œ ๋ฆฌ์ŠคํŠธ(ACL)์— ์ ์ ˆํžˆ ๋ฐ˜์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ณ€๊ฒฝ๊ด€๋ฆฌ์‹œ์Šคํ…œ์„ ๊ตฌ์ถ•ํ•˜์—ฌ ์ •๋ณด์‹œ์Šคํ…œ ์ž…๊ณ  ๋˜๋Š” ๋ณ€๊ฒฝ ์‹œ ์„ฑ๋Šฅ ๋ฐ ๋ณด์•ˆ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ ๋ฐํ˜‘์˜ํ•˜๊ณ  ๊ด€๋ จ ์ด๋ ฅ์„ ๊ด€๋ฆฌํ•˜๋„๋ก ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ํ•ด๋‹น ์‹œ์Šคํ…œ์„ ํ†ตํ•˜์ง€ ์•Š๊ณ ๋„ ์‹œ์Šคํ…œ ๋ณ€๊ฒฝ์ด ๊ฐ€๋Šฅํ•˜๋ฉฐ, ๊ด€๋ จ ๋ณ€๊ฒฝ์‚ฌํ•ญ์ด ์ ์ ˆํžˆ ๊ฒ€ํ† ๋˜์ง€ ์•Š๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.2", + "Name": "์„ฑ๋Šฅ ๋ฐ ์žฅ์• ๊ด€๋ฆฌ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐ€์šฉ์„ฑ ๋ณด์žฅ์„ ์œ„ํ•˜์—ฌ ์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰ ์š”๊ตฌ์‚ฌํ•ญ์„ ์ •์˜ํ•˜๊ณ  ํ˜„ํ™ฉ์„ ์ง€์†์ ์œผ๋กœ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์žฅ์•  ๋ฐœ์ƒ ์‹œ ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•˜๊ธฐ ์œ„ํ•œ ํƒ์ง€ยท๊ธฐ๋กยท๋ถ„์„ยท๋ณต๊ตฌยท๋ณด๊ณ  ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "kms_cmk_not_deleted_unintentionally", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "s3_bucket_no_mfa_delete", + "s3_bucket_cross_region_replication", + "documentdb_cluster_cloudwatch_log_export", + "documentdb_cluster_deletion_protection", + "config_recorder_all_regions_enabled", + "cognito_user_pool_deletion_protection_enabled", + "neptune_cluster_multi_az", + "neptune_cluster_deletion_protection", + "directoryservice_directory_monitor_notifications", + "directoryservice_ldap_certificate_expiration", + "elb_is_in_multiple_az", + "elb_cross_zone_load_balancing_enabled", + "cloudtrail_bucket_requires_mfa_delete", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_multi_region_enabled", + "iam_no_expired_server_certificates_stored", + "networkfirewall_deletion_protection", + "kafka_cluster_enhanced_monitoring_enabled", + "vpc_subnet_different_az", + "trustedadvisor_premium_support_plan_subscribed", + "trustedadvisor_errors_and_warnings", + "dms_instance_multi_az_enabled", + "autoscaling_group_multiple_az", + "elbv2_is_in_multiple_az", + "elbv2_deletion_protection", + "cloudformation_stacks_termination_protection_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "rds_instance_multi_az", + "rds_cluster_backtrack_enabled", + "rds_instance_enhanced_monitoring_enabled", + "rds_instance_deletion_protection", + "rds_instance_certificate_expiration", + "rds_cluster_deletion_protection", + "rds_cluster_multi_az", + "acm_certificates_expiration_check", + "route53_domains_transferlock_enabled", + "ec2_instance_detailed_monitoring_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.2 ์„ฑ๋Šฅ ๋ฐ ์žฅ์• ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐ€์šฉ์„ฑ ๋ณด์žฅ์„ ์œ„ํ•˜์—ฌ ์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰์„ ์ง€์†์ ์œผ๋กœ ๋ชจ๋‹ˆํ„ฐ๋งํ•  ์ˆ˜ ์žˆ๋Š” ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ ์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰ ์š”๊ตฌ์‚ฌํ•ญ(์ž„๊ณ„์น˜)์„ ์ดˆ๊ณผํ•˜๋Š” ๊ฒฝ์šฐ์— ๋Œ€ํ•œ ๋Œ€์‘์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ ์žฅ์• ๋ฅผ ์ฆ‰์‹œ ์ธ์ง€ํ•˜๊ณ  ๋Œ€์‘ํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์žฅ์•  ๋ฐœ์ƒ ์‹œ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์กฐ์น˜ํ•˜๊ณ  ์žฅ์• ์กฐ์น˜๋ณด๊ณ ์„œ ๋“ฑ์„ ํ†ตํ•˜์—ฌ ์žฅ์• ์กฐ์น˜๋‚ด์—ญ์„ ๊ธฐ๋กํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‹ฌ๊ฐ๋„๊ฐ€ ๋†’์€ ์žฅ์• ์˜ ๊ฒฝ์šฐ ์›์ธ๋ถ„์„์„ ํ†ตํ•œ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰ ๋ชจ๋‹ˆํ„ฐ๋ง ์ ˆ์ฐจ", + "์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰ ๋ชจ๋‹ˆํ„ฐ๋ง ์ฆ๊ฑฐ์ž๋ฃŒ(๋‚ด๋ถ€๋ณด๊ณ  ๊ฒฐ๊ณผ ๋“ฑ)", + "์žฅ์• ๋Œ€์‘ ์ ˆ์ฐจ", + "์žฅ์• ์กฐ์น˜๋ณด๊ณ ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์„ฑ๋Šฅ ๋ฐ ์šฉ๋Ÿ‰ ๊ด€๋ฆฌ๋ฅผ ์œ„ํ•œ ๋Œ€์ƒ๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ(์ž„๊ณ„์น˜ ๋“ฑ)์„ ์ •์˜ํ•˜๊ณ  ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜ ์ •๊ธฐ ์ ๊ฒ€๋ณด๊ณ ์„œ ๋“ฑ์— ๊ธฐ๋กํ•˜๊ณ  ์žˆ์ง€ ์•Š์•„ ํ˜„ํ™ฉ์„ ํŒŒ์•…ํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์„ฑ๋Šฅ ๋˜๋Š” ์šฉ๋Ÿ‰ ๊ธฐ์ค€์„ ์ดˆ๊ณผํ•˜์˜€์œผ๋‚˜ ๊ด€๋ จ ๊ฒ€ํ†  ๋ฐ ํ›„์†์กฐ์น˜๋ฐฉ์•ˆ ์ˆ˜๋ฆฝยท์ดํ–‰์ด ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ „์‚ฐ์žฅ๋น„ ์žฅ์• ๋Œ€์‘์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ์œผ๋‚˜ ๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ ๋ฐ ์™ธ์ฃผ์—…์ฒด ๋ณ€๊ฒฝ ๋“ฑ์˜ ๋‚ดยท์™ธ๋ถ€ ํ™˜๊ฒฝ๋ณ€ํ™”๊ฐ€ ์ ์ ˆํžˆ ๋ฐ˜์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์žฅ์• ์ฒ˜๋ฆฌ์ ˆ์ฐจ์™€ ์žฅ์• ์œ ํ˜•๋ณ„ ์กฐ์น˜๋ฐฉ๋ฒ• ๊ฐ„ ์ผ๊ด€์„ฑ์ด ์—†๊ฑฐ๋‚˜ ์˜ˆ์ƒ์†Œ์š”์‹œ๊ฐ„ ์‚ฐ์ •์— ๋Œ€ํ•œ ๊ทผ๊ฑฐ๊ฐ€ ๋ถ€์กฑํ•˜์—ฌ ์‹ ์†ยท์ •ํ™•ํ•˜๊ณ  ์ฒด๊ณ„์ ์ธ ๋Œ€์‘์ด ์–ด๋ ค์šด ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.3", + "Name": "๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ๊ด€๋ฆฌ", + "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ๊ฐ€์šฉ์„ฑ๊ณผ ๋ฐ์ดํ„ฐ ๋ฌด๊ฒฐ์„ฑ์„ ์œ ์ง€ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ฐฑ์—… ๋Œ€์ƒ, ์ฃผ๊ธฐ, ๋ฐฉ๋ฒ•, ๋ณด๊ด€์žฅ์†Œ, ๋ณด๊ด€๊ธฐ๊ฐ„, ์†Œ์‚ฐ ๋“ฑ์˜ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ์•„์šธ๋Ÿฌ ์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์ ์‹œ์— ๋ณต๊ตฌํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "s3_access_point_public_access_block", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_versioning", + "s3_bucket_kms_encryption", + "s3_bucket_public_write_acl", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_cross_region_replication", + "s3_bucket_default_encryption", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_public_snapshot", + "lightsail_instance_automated_snapshots", + "neptune_cluster_backup_enabled", + "neptune_cluster_public_snapshot", + "ecr_repositories_lifecycle_policy_enabled", + "dynamodb_tables_pitr_enabled", + "directoryservice_directory_snapshots_limit", + "redshift_cluster_automated_snapshot", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "backup_reportplans_exist", + "backup_vaults_exist", + "backup_vaults_encrypted", + "backup_plans_exist", + "elasticache_redis_cluster_backup_enabled", + "rds_cluster_copy_tags_to_snapshots", + "rds_instance_copy_tags_to_snapshots", + "rds_cluster_backtrack_enabled", + "rds_snapshots_public_access", + "rds_instance_backup_enabled", + "efs_have_backup_enabled", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_ebs_public_snapshot", + "ec2_ebs_volume_snapshots_exists", + "ec2_ebs_snapshots_encrypted", + "ec2_ami_public" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.3 ๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ๊ด€๋ฆฌ", + "AuditChecklist": [ + "๋ฐฑ์—… ๋Œ€์ƒ, ์ฃผ๊ธฐ, ๋ฐฉ๋ฒ•, ์ ˆ์ฐจ ๋“ฑ์ด ํฌํ•จ๋œ ๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฐฑ์—…๋œ ์ •๋ณด์˜ ์™„์ „์„ฑ๊ณผ ์ •ํ™•์„ฑ, ๋ณต๊ตฌ์ ˆ์ฐจ์˜ ์ ์ ˆ์„ฑ์„ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ •๊ธฐ์ ์œผ๋กœ ๋ณต๊ตฌ ํ…Œ์ŠคํŠธ๋ฅผ ์‹ค์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ค‘์š”์ •๋ณด๊ฐ€ ์ €์žฅ๋œ ๋ฐฑ์—…๋งค์ฒด์˜ ๊ฒฝ์šฐ ์žฌํ•ดยท์žฌ๋‚œ์— ๋Œ€์ฒ˜ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ฐฑ์—…๋งค์ฒด๋ฅผ ๋ฌผ๋ฆฌ์ ์œผ๋กœ ๋–จ์–ด์ง„ ์žฅ์†Œ์— ์†Œ์‚ฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜ ์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ11์กฐ(์žฌํ•ดยท์žฌ๋‚œ ๋Œ€๋น„ ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ ์ ˆ์ฐจ", + "๋ณต๊ตฌํ…Œ์ŠคํŠธ ๊ฒฐ๊ณผ", + "์†Œ์‚ฐ๋ฐฑ์—… ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋ฐฑ์—… ๋Œ€์ƒ, ์ฃผ๊ธฐ, ๋ฐฉ๋ฒ•, ์ ˆ์ฐจ ๋“ฑ์ด ํฌํ•จ๋œ ๋ฐฑ์—… ๋ฐ ๋ณต๊ตฌ ์ ˆ์ฐจ๊ฐ€ ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ฐฑ์—…์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ์œผ๋‚˜ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์— ๋”ฐ๋ผ ์žฅ๊ธฐ๊ฐ„(6๊ฐœ์›”, 3๋…„, 5๋…„ ๋“ฑ) ๋ณด๊ด€์ด ํ•„์š”ํ•œ ๋ฐฑ์—… ๋Œ€์ƒ ์ •๋ณด๊ฐ€ ๋ฐฑ์—… ์ •์ฑ…์— ๋”ฐ๋ผ ๋ณด๊ด€๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ƒ์œ„ ์ง€์นจ ๋˜๋Š” ๋‚ด๋ถ€ ์ง€์นจ์— ๋”ฐ๋ผ ๋ณ„๋„๋กœ ๋ฐฑ์—…ํ•˜์—ฌ ๊ด€๋ฆฌํ•˜๋„๋ก ๋ช…์‹œ๋œ ์ผ๋ถ€ ์‹œ์Šคํ…œ(๋ณด์•ˆ์‹œ์Šคํ…œ ์ •์ฑ… ๋ฐ ๋กœ๊ทธ ๋“ฑ)์— ๋Œ€ํ•œ ๋ฐฑ์—…์ด ์ดํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ƒ์œ„ ์ง€์นจ ๋˜๋Š” ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ์ฃผ๊ธฐ์ ์œผ๋กœ ๋ฐฑ์—…๋งค์ฒด์— ๋Œ€ํ•œ ๋ณต๊ตฌ ํ…Œ์ŠคํŠธ๋ฅผ ์ˆ˜ํ–‰ํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜ ๋ณต๊ตฌํ…Œ์ŠคํŠธ๋ฅผ ์žฅ๊ธฐ๊ฐ„ ์‹ค์‹œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.4", + "Name": "๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ๊ด€๋ฆฌ", + "Description": "์„œ๋ฒ„, ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ๋ณด์•ˆ์‹œ์Šคํ…œ, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์‚ฌ์šฉ์ž ์ ‘์†๊ธฐ๋ก, ์‹œ์Šคํ…œ๋กœ๊ทธ, ๊ถŒํ•œ๋ถ€์—ฌ ๋‚ด์—ญ ๋“ฑ์˜ ๋กœ๊ทธ์œ ํ˜•, ๋ณด์กด๊ธฐ๊ฐ„, ๋ณด์กด๋ฐฉ๋ฒ• ๋“ฑ์„ ์ •ํ•˜๊ณ  ์œ„ยท๋ณ€์กฐ, ๋„๋‚œ, ๋ถ„์‹ค๋˜์ง€ ์•Š๋„๋ก ์•ˆ์ „ํ•˜๊ฒŒ ๋ณด์กดยท๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "eventbridge_bus_exposed", + "eventbridge_bus_cross_account_access", + "eventbridge_schema_registry_cross_account_access", + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "glue_development_endpoints_cloudwatch_logs_encryption_enabled", + "glue_etl_jobs_cloudwatch_logs_encryption_enabled", + "s3_access_point_public_access_block", + "s3_bucket_server_access_logging_enabled", + "s3_bucket_kms_encryption", + "s3_bucket_public_write_acl", + "s3_bucket_policy_public_write_access", + "s3_bucket_public_access", + "s3_bucket_public_list_acl", + "s3_bucket_default_encryption", + "s3_account_level_public_access_blocks", + "s3_bucket_level_public_access_block", + "documentdb_cluster_cloudwatch_log_export", + "macie_is_enabled", + "inspector2_is_enabled", + "config_recorder_all_regions_enabled", + "cloudfront_distributions_logging_enabled", + "wafv2_webacl_logging_enabled", + "opensearch_service_domains_audit_logging_enabled", + "opensearch_service_domains_cloudwatch_logging_enabled", + "directoryservice_directory_log_forwarding_enabled", + "directoryservice_directory_monitor_notifications", + "elb_logging_enabled", + "redshift_cluster_audit_logging", + "cloudtrail_insights_exist", + "cloudtrail_logs_s3_bucket_access_logging_enabled", + "cloudtrail_logs_s3_bucket_is_not_publicly_accessible", + "cloudtrail_multi_region_enabled_logging_management_events", + "cloudtrail_s3_dataevents_read_enabled", + "cloudtrail_log_file_validation_enabled", + "cloudtrail_s3_dataevents_write_enabled", + "cloudtrail_cloudwatch_logging_enabled", + "cloudtrail_multi_region_enabled", + "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled", + "iam_inline_policy_no_full_access_to_cloudtrail", + "iam_securityaudit_role_created", + "eks_control_plane_logging_all_types_enabled", + "apigatewayv2_api_access_logging_enabled", + "kafka_cluster_enhanced_monitoring_enabled", + "vpc_flow_logs_enabled", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "trustedadvisor_premium_support_plan_subscribed", + "elbv2_logging_enabled", + "securityhub_enabled", + "rds_instance_enhanced_monitoring_enabled", + "rds_snapshots_public_access", + "rds_snapshots_encrypted", + "rds_instance_integration_cloudwatch_logs", + "apigateway_restapi_logging_enabled", + "efs_not_publicly_accessible", + "acm_certificates_transparency_logs_enabled", + "route53_public_hosted_zones_cloudwatch_logging_enabled", + "ec2_instance_detailed_monitoring_enabled", + "ec2_ebs_snapshot_account_block_public_access", + "ec2_instance_managed_by_ssm", + "ec2_ebs_public_snapshot", + "ec2_ebs_snapshots_encrypted", + "ec2_client_vpn_endpoint_connection_logging_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.4 ๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์„œ๋ฒ„, ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ๋ณด์•ˆ์‹œ์Šคํ…œ, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ ๋“ฑ ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋กœ๊ทธ๊ด€๋ฆฌ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ด์— ๋”ฐ๋ผ ํ•„์š”ํ•œ ๋กœ๊ทธ๋ฅผ ์ƒ์„ฑํ•˜์—ฌ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ์˜ ๋กœ๊ทธ๊ธฐ๋ก์€ ์œ„ยท๋ณ€์กฐ ๋ฐ ๋„๋‚œ, ๋ถ„์‹ค๋˜์ง€ ์•Š๋„๋ก ์•ˆ์ „ํ•˜๊ฒŒ ๋ณด๊ด€ํ•˜๊ณ  ๋กœ๊ทธ๊ธฐ๋ก์— ๋Œ€ํ•œ ์ ‘๊ทผ๊ถŒํ•œ์€ ์ตœ์†Œํ™”ํ•˜์—ฌ ๋ถ€์—ฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์ ‘์†๊ธฐ๋ก์€ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ์ค€์ˆ˜ํ•  ์ˆ˜ ์žˆ๋„๋ก ํ•„์š”ํ•œ ํ•ญ๋ชฉ์„ ๋ชจ๋‘ ํฌํ•จํ•˜์—ฌ ์ผ์ •๊ธฐ๊ฐ„ ์•ˆ์ „ํ•˜๊ฒŒ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ8์กฐ(์ ‘์†๊ธฐ๋ก์˜ ๋ณด๊ด€ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "๋กœ๊ทธ๊ด€๋ฆฌ ์ ˆ์ฐจ", + "๋กœ๊ทธ๊ธฐ๋ก ๋‚ด์—ญ", + "๋กœ๊ทธ ์ €์žฅ์žฅ์น˜์— ๋Œ€ํ•œ ์ ‘๊ทผํ†ต์ œ ๋‚ด์—ญ", + "๊ฐœ์ธ์ •๋ณด ์ ‘์†๊ธฐ๋ก ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋กœ๊ทธ ๊ธฐ๋ก ๋Œ€์ƒ, ๋ฐฉ๋ฒ•, ๋ณด์กด๊ธฐ๊ฐ„, ๊ฒ€ํ†  ์ฃผ๊ธฐ, ๋‹ด๋‹น์ž ๋“ฑ์— ๋Œ€ํ•œ ์„ธ๋ถ€ ๊ธฐ์ค€ ๋ฐ ์ ˆ์ฐจ๊ฐ€ ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ณด์•ˆ ์ด๋ฒคํŠธ ๋กœ๊ทธ, ์‘์šฉํ”„๋กœ๊ทธ๋žจ ๋ฐ ์„œ๋น„์Šค ๋กœ๊ทธ(์œˆ๋„์šฐ 2008 ์„œ๋ฒ„ ์ด์ƒ) ๋“ฑ ์ค‘์š” ๋กœ๊ทธ์— ๋Œ€ํ•œ ์ตœ๋Œ€ ํฌ๊ธฐ๋ฅผ ์ถฉ๋ถ„ํ•˜๊ฒŒ ์„ค์ •ํ•˜์ง€ ์•Š์•„ ๋‚ด๋ถ€ ๊ธฐ์ค€์— ์ •ํ•œ ๊ธฐ๊ฐ„ ๋™์•ˆ ๊ธฐ๋กยท๋ณด๊ด€๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ค‘์š” Linux/UNIX ๊ณ„์—ด ์„œ๋ฒ„์— ๋Œ€ํ•œ ๋กœ๊ทธ ๊ธฐ๋ก์„ ๋ณ„๋„๋กœ ๋ฐฑ์—…ํ•˜๊ฑฐ๋‚˜ ์ ์ ˆํžˆ ๋ณดํ˜ธํ•˜์ง€ ์•Š์•„ ์‚ฌ์šฉ์ž์˜ ๋ช…๋ น ์‹คํ–‰ ๊ธฐ๋ก ๋ฐ ์ ‘์† ์ด๋ ฅ ๋“ฑ์„ ์ž„์˜๋กœ ์‚ญ์ œํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ์ ‘์†ํ•œ ๊ธฐ๋ก์„ ํ™•์ธํ•œ ๊ฒฐ๊ณผ ์ ‘์†์ž์˜ ๊ณ„์ •, ์ ‘์† ์ผ์‹œ, ์ ‘์†์ž IP์ฃผ์†Œ ์ •๋ณด๋Š” ๋‚จ๊ธฐ๊ณ  ์žˆ์œผ๋‚˜, ์ฒ˜๋ฆฌํ•œ ์ •๋ณด์ฃผ์ฒด ์ •๋ณด ๋ฐ ์ˆ˜ํ–‰์—…๋ฌด(์กฐํšŒ, ๋ณ€๊ฒฝ, ์‚ญ์ œ, ๋‹ค์šด๋กœ๋“œ ๋“ฑ)์™€ ๊ด€๋ จ๋œ ์ •๋ณด๋ฅผ ๋‚จ๊ธฐ๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๋กœ๊ทธ ์„œ๋ฒ„์˜ ์šฉ๋Ÿ‰์˜ ์ถฉ๋ถ„ํ•˜์ง€ ์•Š์•„์„œ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ์ ‘์†๊ธฐ๋ก์ด 2๊ฐœ์›” ๋ฐ–์— ๋‚จ์•„ ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๊ฐ€ ์ •๋ณด์ฃผ์ฒด 10๋งŒ ๋ช…์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž ์ ‘์†๊ธฐ๋ก์„ 1๋…„๊ฐ„๋งŒ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.5", + "Name": "๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ์ ๊ฒ€", + "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ์ •์ƒ์ ์ธ ์‚ฌ์šฉ์„ ๋ณด์žฅํ•˜๊ณ  ์‚ฌ์šฉ์ž ์˜คยท๋‚จ์šฉ(๋น„์ธ๊ฐ€์ ‘์†, ๊ณผ๋‹ค์กฐํšŒ ๋“ฑ)์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ ‘๊ทผ ๋ฐ ์‚ฌ์šฉ์— ๋Œ€ํ•œ ๋กœ๊ทธ ๊ฒ€ํ† ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๋ฉฐ, ๋ฌธ์ œ ๋ฐœ์ƒ ์‹œ ์‚ฌํ›„์กฐ์น˜๋ฅผ ์ ์‹œ์— ์ˆ˜ํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "inspector2_active_findings_exist", + "cognito_user_pool_client_prevent_user_existence_errors", + "accessanalyzer_enabled_without_findings", + "cloudtrail_insights_exist", + "cloudtrail_threat_detection_enumeration", + "cloudtrail_threat_detection_privilege_escalation", + "guardduty_no_high_severity_findings", + "trustedadvisor_errors_and_warnings" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.5 ๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก ์ ๊ฒ€", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ ๊ด€๋ จ ์˜ค๋ฅ˜, ์˜คยท๋‚จ์šฉ(๋น„์ธ๊ฐ€์ ‘์†, ๊ณผ๋‹ค์กฐํšŒ ๋“ฑ), ๋ถ€์ •ํ–‰์œ„ ๋“ฑ ์ด์ƒ์ง•ํ›„๋ฅผ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋กœ๊ทธ ๊ฒ€ํ†  ์ฃผ๊ธฐ, ๋Œ€์ƒ, ๋ฐฉ๋ฒ• ๋“ฑ์„ ํฌํ•จํ•œ ๋กœ๊ทธ ๊ฒ€ํ†  ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋กœ๊ทธ ๊ฒ€ํ†  ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ๊ฒฐ๊ณผ๋ฅผ ์ฑ…์ž„์ž์—๊ฒŒ ๋ณด๊ณ ํ•˜๊ณ  ์ด์ƒ์ง•ํ›„ ๋ฐœ๊ฒฌ ์‹œ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ๋Œ€์‘ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ์ ‘์†๊ธฐ๋ก์€ ๊ด€๋ จ ๋ฒ•๋ น์—์„œ ์ •ํ•œ ์ฃผ๊ธฐ์— ๋”ฐ๋ผ ์ •๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ8์กฐ(์ ‘์†๊ธฐ๋ก์˜ ๋ณด๊ด€ ๋ฐ ์ ๊ฒ€)" + ], + "AuditEvidence": [ + "๋กœ๊ทธ ๊ฒ€ํ†  ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ์ ˆ์ฐจ", + "๋กœ๊ทธ ๊ฒ€ํ†  ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ๊ฒฐ๊ณผ(๊ฒ€ํ†  ๋‚ด์—ญ, ๋ณด๊ณ ์„œ ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ์ ‘์†๊ธฐ๋ก ์ ๊ฒ€ ๋‚ด์—ญ", + "๊ฐœ์ธ์ •๋ณด ๋‹ค์šด๋กœ๋“œ ์‹œ ์‚ฌ์œ  ํ™•์ธ ๊ธฐ์ค€ ๋ฐ ๊ฒฐ๊ณผ", + "์ด์ƒ์ง•ํ›„ ๋ฐœ๊ฒฌ ์‹œ ๋Œ€์‘ ์ฆ๊ฑฐ์ž๋ฃŒ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ค‘์š” ์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š” ์ •๋ณด์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์ด์ƒ์ ‘์†(ํœด์ผ ์ƒˆ๋ฒฝ ์ ‘์†, ์šฐํšŒ๊ฒฝ๋กœ ์ ‘์† ๋“ฑ) ๋˜๋Š” ์ด์ƒํ–‰์œ„(๋Œ€๋Ÿ‰ ๋ฐ์ดํ„ฐ ์กฐํšŒ ๋˜๋Š” ์†Œ๋Ÿ‰ ๋ฐ์ดํ„ฐ์˜ ์ง€์†์ ยท์—ฐ์†์  ์กฐํšŒ ๋“ฑ)์— ๋Œ€ํ•œ ๋ชจ๋‹ˆํ„ฐ๋ง ๋ฐ ๊ฒฝ๊ณ ยท์•Œ๋ฆผ ์ •์ฑ…(๊ธฐ์ค€)์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ์ง€์นจ ๋˜๋Š” ์‹œ์Šคํ…œ ๋“ฑ์— ์ ‘๊ทผ ๋ฐ ์‚ฌ์šฉ์— ๋Œ€ํ•œ ์ฃผ๊ธฐ์ ์ธ ์ ๊ฒ€ยท๋ชจ๋‹ˆํ„ฐ๋ง ๊ธฐ์ค€์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ์œผ๋‚˜ ์‹ค์ œ ์ด์ƒ์ ‘์† ๋ฐ ์ด์ƒํ–‰์œ„์— ๋Œ€ํ•œ ๊ฒ€ํ†  ๋‚ด์—ญ์ด ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๊ฐ€ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์˜ ์ ‘์†๊ธฐ๋ก ์ ๊ฒ€ ์ฃผ๊ธฐ๋ฅผ ๋ถ„๊ธฐ 1ํšŒ๋กœ ์ •ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž์˜ ๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์—๋Š” 1,000๋ช… ์ด์ƒ์˜ ์ •๋ณด์ฃผ์ฒด์— ๋Œ€ํ•œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋‹ค์šด๋กœ๋“œํ•œ ๊ฒฝ์šฐ์—๋Š” ์‚ฌ์œ ๋ฅผ ํ™•์ธํ•˜๋„๋ก ๊ธฐ์ค€์ด ์ฑ…์ •๋˜์–ด ์žˆ๋Š” ์ƒํƒœ์—์„œ 1,000๊ฑด ์ด์ƒ์˜ ๊ฐœ์ธ์ •๋ณด ๋‹ค์šด๋กœ๋“œ๊ฐ€ ๋ฐœ์ƒํ•˜์˜€์œผ๋‚˜ ๊ทธ ์‚ฌ์œ ๋ฅผ ํ™•์ธํ•˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.6", + "Name": "์‹œ๊ฐ„ ๋™๊ธฐํ™”", + "Description": "๋กœ๊ทธ ๋ฐ ์ ‘์†๊ธฐ๋ก์˜ ์ •ํ™•์„ฑ์„ ๋ณด์žฅํ•˜๊ณ  ์‹ ๋ขฐ์„ฑ ์žˆ๋Š” ๋กœ๊ทธ๋ถ„์„์„ ์œ„ํ•˜์—ฌ ๊ด€๋ จ ์ •๋ณด์‹œ์Šคํ…œ์˜ ์‹œ๊ฐ์„ ํ‘œ์ค€์‹œ๊ฐ์œผ๋กœ ๋™๊ธฐํ™”ํ•˜๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.6 ์‹œ๊ฐ„ ๋™๊ธฐํ™”", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ์˜ ์‹œ๊ฐ„์„ ํ‘œ์ค€์‹œ๊ฐ„์œผ๋กœ ๋™๊ธฐํ™”ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‹œ๊ฐ„ ๋™๊ธฐํ™”๊ฐ€ ์ •์ƒ์ ์œผ๋กœ ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ๋Š”์ง€ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์‹œ๊ฐ„ ๋™๊ธฐํ™” ์„ค์ •", + "์ฃผ์š” ์‹œ์Šคํ…œ ์‹œ๊ฐ„ ๋™๊ธฐํ™” ์ฆ๊ฑฐ์ž๋ฃŒ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ผ๋ถ€ ์ค‘์š” ์‹œ์Šคํ…œ(๋ณด์•ˆ์‹œ์Šคํ…œ, CCTV ๋“ฑ)์˜ ์‹œ๊ฐ์ด ํ‘œ์ค€์‹œ์™€ ๋™๊ธฐํ™”๋˜์–ด ์žˆ์ง€ ์•Š์œผ๋ฉฐ, ๊ด€๋ จ ๋™๊ธฐํ™” ์—ฌ๋ถ€์— ๋Œ€ํ•œ ์ฃผ๊ธฐ์  ์ ๊ฒ€์ด ์ดํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ NTP ์„œ๋ฒ„์™€ ์‹œ๊ฐ์„ ๋™๊ธฐํ™”ํ•˜๋„๋ก ์„ค์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜ ์ผ๋ถ€ ์‹œ์Šคํ…œ์˜ ์‹œ๊ฐ์ด ๋™๊ธฐํ™”๋˜์ง€ ์•Š๊ณ  ์žˆ๊ณ , ์ด์— ๋Œ€ํ•œ ์›์ธ๋ถ„์„ ๋ฐ ๋Œ€์‘์ด ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.9.7", + "Name": "์ •๋ณด์ž์‚ฐ์˜ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐ", + "Description": "์ •๋ณด์ž์‚ฐ์˜ ์žฌ์‚ฌ์šฉ๊ณผ ํ๊ธฐ ๊ณผ์ •์—์„œ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๊ฐ€ ๋ณต๊ตฌยท์žฌ์ƒ๋˜์ง€ ์•Š๋„๋ก ์•ˆ์ „ํ•œ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.9. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ์šด์˜๊ด€๋ฆฌ", + "Section": "2.9.7 ์ •๋ณด์ž์‚ฐ์˜ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐ", + "AuditChecklist": [ + "์ •๋ณด์ž์‚ฐ์˜ ์•ˆ์ „ํ•œ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐ์— ๋Œ€ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ž์‚ฐ ๋ฐ ์ €์žฅ๋งค์ฒด๋ฅผ ์žฌ์‚ฌ์šฉ ๋ฐ ํ๊ธฐํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ๋ณต๊ตฌ๋˜์ง€ ์•Š๋Š” ๋ฐฉ๋ฒ•์œผ๋กœ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ž์ฒด์ ์œผ๋กœ ์ •๋ณด์ž์‚ฐ ๋ฐ ์ €์žฅ๋งค์ฒด๋ฅผ ํ๊ธฐํ•  ๊ฒฝ์šฐ ๊ด€๋ฆฌ๋Œ€์žฅ์„ ํ†ตํ•˜์—ฌ ํ๊ธฐ์ด๋ ฅ์„ ๋‚จ๊ธฐ๊ณ  ํ๊ธฐํ™•์ธ ์ฆ์ ์„ ํ•จ๊ป˜ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์™ธ๋ถ€์—…์ฒด๋ฅผ ํ†ตํ•˜์—ฌ ์ •๋ณด์ž์‚ฐ ๋ฐ ์ €์žฅ๋งค์ฒด๋ฅผ ํ๊ธฐํ•  ๊ฒฝ์šฐ ํ๊ธฐ ์ ˆ์ฐจ๋ฅผ ๊ณ„์•ฝ์„œ์— ๋ช…์‹œํ•˜๊ณ  ์™„์ „ํžˆ ํ๊ธฐํ•˜์˜€๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์‹œ์Šคํ…œ, PC ๋“ฑ ์œ ์ง€๋ณด์ˆ˜, ์ˆ˜๋ฆฌ ๊ณผ์ •์—์„œ ์ €์žฅ๋งค์ฒด ๊ต์ฒด, ๋ณต๊ตฌ ๋“ฑ ๋ฐœ์ƒ ์‹œ ์ €์žฅ๋งค์ฒด ๋‚ด ์ •๋ณด๋ฅผ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•œ ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ21์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ13์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ)" + ], + "AuditEvidence": [ + "์ •๋ณด์ž์‚ฐ ํ๊ธฐ ๋ฐ ์žฌ์‚ฌ์šฉ ์ ˆ์ฐจ", + "์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ๋Œ€์žฅ", + "์ •๋ณด์ž์‚ฐ ๋ฐ ์ €์žฅ๋งค์ฒด ํ๊ธฐ ์ฆ๊ฑฐ์ž๋ฃŒ", + "์ •๋ณด์ž์‚ฐ ๋ฐ ์ €์žฅ๋งค์ฒด ํ๊ธฐ ๊ด€๋ จ ์œ„ํƒ๊ณ„์•ฝ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด์ทจ๊ธ‰์ž PC๋ฅผ ์žฌ์‚ฌ์šฉํ•  ๊ฒฝ์šฐ ๋ฐ์ดํ„ฐ ์‚ญ์ œํ”„๋กœ๊ทธ๋žจ์„ ์ด์šฉํ•˜์—ฌ ์™„์ „์‚ญ์ œ ํ•˜๋„๋ก ์ •์ฑ… ๋ฐ ์ ˆ์ฐจ๊ฐ€ ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์œผ๋‚˜, ์‹ค์ œ๋กœ๋Š” ์™„์ „์‚ญ์ œ ์กฐ์น˜ ์—†์ด ์žฌ์‚ฌ์šฉํ•˜๊ฑฐ๋‚˜ ๊ธฐ๋ณธ ํฌ๋งท๋งŒ ํ•˜๊ณ  ์žฌ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๋“ฑ ๊ด€๋ จ ์ ˆ์ฐจ๊ฐ€ ์ดํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์™ธ๋ถ€์—…์ฒด๋ฅผ ํ†ตํ•˜์—ฌ ์ €์žฅ๋งค์ฒด๋ฅผ ํ๊ธฐํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ณ„์•ฝ ๋‚ด์šฉ์ƒ ์•ˆ์ „ํ•œ ํ๊ธฐ ์ ˆ์ฐจ ๋ฐ ๋ณดํ˜ธ๋Œ€์ฑ…์— ๋Œ€ํ•œ ๋‚ด์šฉ์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๊ณ  ํ๊ธฐ ์ดํ–‰ ์ฆ๊ฑฐ์ž๋ฃŒ ํ™•์ธ ๋ฐ ์‹ค์‚ฌ ๋“ฑ์˜ ๊ด€๋ฆฌยท๊ฐ๋…์ด ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ํ๊ธฐ๋œ HDD์˜ ์ผ๋ จ๋ฒˆํ˜ธ๊ฐ€ ์•„๋‹Œ ์‹œ์Šคํ…œ๋ช…์„ ๊ธฐ๋กํ•˜๊ฑฐ๋‚˜ ํ๊ธฐ ๋Œ€์žฅ์„ ์ž‘์„ฑํ•˜์ง€ ์•Š์•„ ํ๊ธฐ ์ด๋ ฅ ๋ฐ ์ถ”์ ํ•  ์ˆ˜ ์žˆ๋Š” ์ฆ๊ฑฐ์ž๋ฃŒ๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ํšŒ์ˆ˜ํ•œ ํ๊ธฐ ๋Œ€์ƒ ํ•˜๋“œ๋””์Šคํฌ๊ฐ€ ์™„์ „์‚ญ์ œ ๋˜์ง€ ์•Š์€ ์ƒํƒœ๋กœ ์ž ๊ธˆ์žฅ์น˜๊ฐ€ ๋˜์ง€ ์•Š์€ ์žฅ์†Œ์— ๋ฐฉ์น˜๋˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.1", + "Name": "๋ณด์•ˆ์‹œ์Šคํ…œ ์šด์˜", + "Description": "๋ณด์•ˆ์‹œ์Šคํ…œ ์œ ํ˜•๋ณ„๋กœ ๊ด€๋ฆฌ์ž ์ง€์ •, ์ตœ์‹  ์ •์ฑ… ์—…๋ฐ์ดํŠธ, ๋ฃฐ์…‹ ๋ณ€๊ฒฝ, ์ด๋ฒคํŠธ ๋ชจ๋‹ˆํ„ฐ๋ง ๋“ฑ์˜ ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ๋ณด์•ˆ์‹œ์Šคํ…œ๋ณ„ ์ •์ฑ…์ ์šฉ ํ˜„ํ™ฉ์„ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "organizations_delegated_administrators", + "shield_advanced_protection_in_classic_load_balancers", + "shield_advanced_protection_in_route53_hosted_zones", + "shield_advanced_protection_in_cloudfront_distributions", + "shield_advanced_protection_in_global_accelerators", + "shield_advanced_protection_in_associated_elastic_ips", + "shield_advanced_protection_in_internet_facing_load_balancers", + "ssm_managed_compliant_patching", + "secretsmanager_automatic_rotation_enabled", + "kms_cmk_are_used", + "kms_key_not_publicly_accessible", + "kms_cmk_rotation_enabled", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "macie_is_enabled", + "inspector2_is_enabled", + "inspector2_active_findings_exist", + "config_recorder_all_regions_enabled", + "cognito_user_pool_waf_acl_attached", + "fms_policy_compliant", + "ssmincidents_enabled_with_plans", + "cloudfront_distributions_using_waf", + "wafv2_webacl_logging_enabled", + "guardduty_no_high_severity_findings", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "trustedadvisor_errors_and_warnings", + "elbv2_waf_acl_attached", + "securityhub_enabled", + "apigateway_restapi_waf_acl_attached", + "ec2_instance_port_ldap_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_securitygroup_from_launch_wizard", + "ec2_securitygroup_not_used", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_networkacl_allow_ingress_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.1 ๋ณด์•ˆ์‹œ์Šคํ…œ ์šด์˜", + "AuditChecklist": [ + "์กฐ์ง์—์„œ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š” ๋ณด์•ˆ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์šด์˜์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์•ˆ์‹œ์Šคํ…œ ๊ด€๋ฆฌ์ž ๋“ฑ ์ ‘๊ทผ์ด ํ—ˆ์šฉ๋œ ์ธ์›์„ ์ตœ์†Œํ™”ํ•˜๊ณ  ๋น„์ธ๊ฐ€์ž์˜ ์ ‘๊ทผ์„ ์—„๊ฒฉํ•˜๊ฒŒ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์•ˆ์‹œ์Šคํ…œ๋ณ„๋กœ ์ •์ฑ…์˜ ์‹ ๊ทœ ๋“ฑ๋ก, ๋ณ€๊ฒฝ, ์‚ญ์ œ ๋“ฑ์„ ์œ„ํ•œ ๊ณต์‹์ ์ธ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์•ˆ์‹œ์Šคํ…œ์˜ ์˜ˆ์™ธ ์ •์ฑ… ๋“ฑ๋ก์— ๋Œ€ํ•˜์—ฌ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ์œผ๋ฉฐ, ์˜ˆ์™ธ ์ •์ฑ… ์‚ฌ์šฉ์ž์— ๋Œ€ํ•˜์—ฌ ์ตœ์†Œํ•œ์˜ ๊ถŒํ•œ์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์•ˆ์‹œ์Šคํ…œ์— ์„ค์ •๋œ ์ •์ฑ…์˜ ํƒ€๋‹น์„ฑ ์—ฌ๋ถ€๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋ถˆ๋ฒ•์ ์ธ ์ ‘๊ทผ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ ๋ฐฉ์ง€๋ฅผ ์œ„ํ•˜์—ฌ ๊ด€๋ จ ๋ฒ•๋ น์—์„œ ์ •ํ•œ ๊ธฐ๋Šฅ์„ ์ˆ˜ํ–‰ํ•˜๋Š” ๋ณด์•ˆ์‹œ์Šคํ…œ์„ ์„ค์น˜ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "๋ณด์•ˆ์‹œ์Šคํ…œ ๊ตฌ์„ฑ", + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ", + "๋ณด์•ˆ์‹œ์Šคํ…œ ์šด์˜์ ˆ์ฐจ", + "๋ฐฉํ™”๋ฒฝ ์ •์ฑ…", + "๋ฐฉํ™”๋ฒฝ ์ •์ฑ… ์„ค์ •ยท๋ณ€๊ฒฝ ์š”์ฒญ์„œ", + "๋ณด์•ˆ์‹œ์Šคํ…œ ์˜ˆ์™ธ์ž ๋ชฉ๋ก", + "๋ณด์•ˆ์‹œ์Šคํ…œ๋ณ„ ๊ด€๋ฆฌ ํ™”๋ฉด(๋ฐฉํ™”๋ฒฝ, IPS, ์„œ๋ฒ„์ ‘๊ทผ์ œ์–ด, DLP, DRM ๋“ฑ)", + "๋ณด์•ˆ์‹œ์Šคํ…œ ์ •์ฑ… ๊ฒ€ํ†  ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ ๋ณด์•ˆ์ •์ฑ…์— ๋Œ€ํ•œ ์ •๊ธฐ ๊ฒ€ํ† ๊ฐ€ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์•„ ๋ถˆํ•„์š”ํ•˜๊ฑฐ๋‚˜ ๊ณผ๋„ํ•˜๊ฒŒ ํ—ˆ์šฉ๋œ ์ •์ฑ…์ด ๋‹ค์ˆ˜ ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ณด์•ˆ์‹œ์Šคํ…œ ๋ณด์•ˆ์ •์ฑ…์˜ ์‹ ์ฒญ, ๋ณ€๊ฒฝ, ์‚ญ์ œ, ์ฃผ๊ธฐ์  ๊ฒ€ํ† ์— ๋Œ€ํ•œ ์ ˆ์ฐจ ๋ฐ ๊ธฐ์ค€์ด ์—†๊ฑฐ๋‚˜, ์ ˆ์ฐจ๋Š” ์žˆ์œผ๋‚˜ ์ด๋ฅผ ์ค€์ˆ˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ณด์•ˆ์‹œ์Šคํ…œ์˜ ๊ด€๋ฆฌ์ž ์ง€์ • ๋ฐ ๊ถŒํ•œ ๋ถ€์—ฌ ํ˜„ํ™ฉ์— ๋Œ€ํ•œ ๊ด€๋ฆฌ๊ฐ๋…์ด ์ ์ ˆํžˆ ์ดํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ์ •๋ณด๋ณดํ˜ธ๋‹ด๋‹น์ž๊ฐ€ ๋ณด์•ˆ์‹œ์Šคํ…œ์˜ ๋ณด์•ˆ์ •์ฑ… ๋ณ€๊ฒฝ ์ด๋ ฅ์„ ๊ธฐ๋กยท๋ณด๊ด€ํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ •์ฑ…๊ด€๋ฆฌ๋Œ€์žฅ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ž‘์„ฑํ•˜์ง€ ์•Š๊ณ  ์žˆ๊ฑฐ๋‚˜ ์ •์ฑ…๊ด€๋ฆฌ๋Œ€์žฅ์— ๊ธฐ๋ก๋œ ๋ณด์•ˆ์ •์ฑ…๊ณผ ์‹ค์ œ ์šด์˜ ์ค‘์ธ ์‹œ์Šคํ…œ์˜ ๋ณด์•ˆ์ •์ฑ…์ด ์ƒ์ดํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.2", + "Name": "ํด๋ผ์šฐ๋“œ ๋ณด์•ˆ", + "Description": "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ์ด์šฉ ์‹œ ์„œ๋น„์Šค ์œ ํ˜•(SaaS, PaaS, IaaS ๋“ฑ)์— ๋”ฐ๋ฅธ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ, ์„ค์ • ์˜ค๋ฅ˜ ๋“ฑ์— ๋”ฐ๋ผ ์ค‘์š”์ •๋ณด์™€ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ์œ ยท๋…ธ์ถœ๋˜์ง€ ์•Š๋„๋ก ๊ด€๋ฆฌ์ž ์ ‘๊ทผ ๋ฐ ๋ณด์•ˆ ์„ค์ • ๋“ฑ์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.2 ํด๋ผ์šฐ๋“œ ๋ณด์•ˆ", + "AuditChecklist": [ + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ์ œ๊ณต์ž์™€ ์ •๋ณด๋ณดํ˜ธ ๋ฐ ๊ฐœ์ธ์ •๋ณด๋ณดํ˜ธ์— ๋Œ€ํ•œ ์ฑ…์ž„๊ณผ ์—ญํ• ์„ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์ด๋ฅผ ๊ณ„์•ฝ์„œ(SLA ๋“ฑ)์— ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ์ด์šฉ ์‹œ ์„œ๋น„์Šค ์œ ํ˜•์— ๋”ฐ๋ฅธ ๋ณด์•ˆ์œ„ํ—˜์„ ํ‰๊ฐ€ํ•˜์—ฌ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ, ์„ค์ •์˜ค๋ฅ˜ ๋“ฑ์„ ๋ฐฉ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ณด์•ˆ ๊ตฌ์„ฑ ๋ฐ ์„ค์ • ๊ธฐ์ค€, ๋ณด์•ˆ์„ค์ • ๋ณ€๊ฒฝ ๋ฐ ์Šน์ธ ์ ˆ์ฐจ, ์•ˆ์ „ํ•œ ์ ‘์†๋ฐฉ๋ฒ•, ๊ถŒํ•œ ์ฒด๊ณ„ ๋“ฑ ๋ณด์•ˆ ํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๊ด€๋ฆฌ์ž ๊ถŒํ•œ์€ ์—ญํ• ์— ๋”ฐ๋ผ ์ตœ์†Œํ™”ํ•˜์—ฌ ๋ถ€์—ฌํ•˜๊ณ  ๊ด€๋ฆฌ์ž ๊ถŒํ•œ์— ๋Œ€ํ•œ ๋น„์ธ๊ฐ€ ์ ‘๊ทผ, ๊ถŒํ•œ ์˜คยท๋‚จ์šฉ ๋“ฑ์„ ๋ฐฉ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ฐ•ํ™”๋œ ์ธ์ฆ, ์•”ํ˜ธํ™”, ์ ‘๊ทผํ†ต์ œ, ๊ฐ์‚ฌ๊ธฐ๋ก ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค์˜ ๋ณด์•ˆ ์„ค์ • ๋ณ€๊ฒฝ, ์šด์˜ ํ˜„ํ™ฉ ๋“ฑ์„ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ณ  ๊ทธ ์ ์ ˆ์„ฑ์„ ์ •๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๊ด€๋ จ ๊ณ„์•ฝ์„œ ๋ฐ SLA", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ์œ„ํ—˜๋ถ„์„ ๊ฒฐ๊ณผ", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๋ณด์•ˆํ†ต์ œ ์ •์ฑ…", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๊ด€๋ฆฌ์ž ๊ถŒํ•œ ๋ถ€์—ฌ ํ˜„ํ™ฉ", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๊ตฌ์„ฑ๋„", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๋ณด์•ˆ์„ค์ • ํ˜„ํ™ฉ", + "ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๋ณด์•ˆ์„ค์ • ์ ์ •์„ฑ ๊ฒ€ํ†  ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค ๊ณ„์•ฝ์„œ ๋‚ด์— ๋ณด์•ˆ์— ๋Œ€ํ•œ ์ฑ…์ž„ ๋ฐ ์—ญํ•  ๋“ฑ์— ๋Œ€ํ•œ ์‚ฌํ•ญ์ด ํฌํ•จ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค์˜ ๋ณด์•ˆ์„ค์ •์„ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์ด ์—…๋ฌด์ƒ ๋ฐ˜๋“œ์‹œ ํ•„์š”ํ•˜์ง€ ์•Š์€ ์ง์›๋“ค์—๊ฒŒ ๊ณผ๋„ํ•˜๊ฒŒ ๋ถ€์—ฌ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ํด๋ผ์šฐ๋“œ ๋‚ด ์‚ฌ์„ค ๋„คํŠธ์›Œํฌ์˜ ์ ‘๊ทผํ†ต์ œ ๋ฃฐ(Rule) ๋ณ€๊ฒฝ ์‹œ ๋ณด์•ˆ์ฑ…์ž„์ž ์Šน์ธ์„ ๋ฐ›๋„๋ก ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์Šน์ธ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜์ง€ ์•Š๊ณ  ๋“ฑ๋กยท๋ณ€๊ฒฝ๋œ ์ ‘๊ทผ์ œ์–ด ๋ฃฐ์ด ๋‹ค์ˆ˜ ๋ฐœ๊ฒฌ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค์˜ ๋ณด์•ˆ์„ค์ • ์˜ค๋ฅ˜๋กœ ๋‚ด๋ถ€ ๋กœ๊ทธ ํŒŒ์ผ์ด ์ธํ„ฐ๋„ท์„ ํ†ตํ•˜์—ฌ ๊ณต๊ฐœ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.3", + "Name": "๊ณต๊ฐœ์„œ๋ฒ„ ๋ณด์•ˆ", + "Description": "์™ธ๋ถ€ ๋„คํŠธ์›Œํฌ์— ๊ณต๊ฐœ๋˜๋Š” ์„œ๋ฒ„์˜ ๊ฒฝ์šฐ ๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ์™€ ๋ถ„๋ฆฌํ•˜๊ณ  ์ทจ์•ฝ์  ์ ๊ฒ€, ์ ‘๊ทผํ†ต์ œ, ์ธ์ฆ, ์ •๋ณด ์ˆ˜์ง‘ยท์ €์žฅยท๊ณต๊ฐœ ์ ˆ์ฐจ ๋“ฑ ๊ฐ•ํ™”๋œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "ssm_document_secrets", + "ssm_managed_compliant_patching", + "inspector2_active_findings_exist", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "cloudfront_distributions_using_waf", + "lightsail_instance_public", + "lightsail_database_public", + "lightsail_static_ip_unused", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "awslambda_function_url_public", + "awslambda_function_url_cors_policy", + "awslambda_function_inside_vpc", + "awslambda_function_not_publicly_accessible", + "networkfirewall_in_all_vpc", + "apigatewayv2_api_authorizers_enabled", + "kafka_cluster_mutual_tls_authentication_enabled", + "vpc_subnet_separate_private_public", + "autoscaling_find_secrets_ec2_launch_configuration", + "elbv2_waf_acl_attached", + "elbv2_desync_mitigation_mode", + "elbv2_insecure_ssl_ciphers", + "elbv2_ssl_listeners", + "apigateway_restapi_public", + "apigateway_restapi_waf_acl_attached", + "apigateway_restapi_client_certificate_enabled", + "apigateway_restapi_authorizers_enabled", + "apigateway_restapi_public_with_authorizer", + "acm_certificates_expiration_check", + "route53_domains_privacy_protection_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_any_port", + "ec2_instance_port_kerberos_exposed_to_internet", + "ec2_instance_secrets_user_data", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_cassandra_7199_9160_8888", + "ec2_securitygroup_default_restrict_traffic", + "ec2_instance_port_cifs_exposed_to_internet", + "ec2_instance_port_kafka_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_oracle_1521_2483", + "ec2_instance_port_mysql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_kafka_9092", + "ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018", + "ec2_instance_port_ssh_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_postgres_5432", + "ec2_instance_port_rdp_exposed_to_internet", + "ec2_instance_internet_facing_with_instance_profile", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_redis_6379", + "ec2_securitygroup_allow_wide_open_public_ipv4", + "ec2_instance_port_cassandra_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_telnet_23", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_sql_server_1433_1434", + "ec2_instance_port_memcached_exposed_to_internet", + "ec2_networkacl_allow_ingress_any_port", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_mysql_3306", + "ec2_networkacl_allow_ingress_tcp_port_3389", + "ec2_instance_port_postgresql_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21", + "ec2_securitygroup_with_many_ingress_egress_rules", + "ec2_instance_port_oracle_exposed_to_internet", + "ec2_launch_template_no_secrets", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_elasticsearch_kibana_9200_9300_5601", + "ec2_instance_imdsv2_enabled", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22", + "ec2_instance_port_elasticsearch_kibana_exposed_to_internet", + "ec2_instance_port_redis_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_3389", + "ec2_instance_port_sqlserver_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_memcached_11211", + "ec2_instance_port_ftp_exposed_to_internet", + "ec2_networkacl_allow_ingress_tcp_port_22", + "ec2_instance_port_mongodb_exposed_to_internet", + "ec2_securitygroup_allow_ingress_from_internet_to_all_ports", + "ec2_securitygroup_allow_ingress_from_internet_to_high_risk_tcp_ports", + "ec2_instance_port_telnet_exposed_to_internet" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.3 ๊ณต๊ฐœ์„œ๋ฒ„ ๋ณด์•ˆ", + "AuditChecklist": [ + "๊ณต๊ฐœ์„œ๋ฒ„๋ฅผ ์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ์ด์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ฐœ์„œ๋ฒ„๋Š” ๋‚ด๋ถ€ ๋„คํŠธ์›Œํฌ์™€ ๋ถ„๋ฆฌ๋œ DMZ ์˜์—ญ์— ์„ค์น˜ํ•˜๊ณ  ์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ ๋“ฑ ๋ณด์•ˆ์‹œ์Šคํ…œ์„ ํ†ตํ•˜์—ฌ ๋ณดํ˜ธํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ฐœ์„œ๋ฒ„์— ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ๊ฒŒ์‹œํ•˜๊ฑฐ๋‚˜ ์ €์žฅํ•˜์—ฌ์•ผ ํ•  ๊ฒฝ์šฐ ์ฑ…์ž„์ž ์Šน์ธ ๋“ฑ ํ—ˆ๊ฐ€ ๋ฐ ๊ฒŒ์‹œ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์กฐ์ง์˜ ์ค‘์š”์ •๋ณด๊ฐ€ ์›น์‚ฌ์ดํŠธ ๋ฐ ์›น์„œ๋ฒ„๋ฅผ ํ†ตํ•˜์—ฌ ๋…ธ์ถœ๋˜๊ณ  ์žˆ๋Š”์ง€ ์—ฌ๋ถ€๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ™•์ธํ•˜์—ฌ ์ค‘์š”์ •๋ณด ๋…ธ์ถœ์„ ์ธ์ง€ํ•œ ๊ฒฝ์šฐ ์ด๋ฅผ ์ฆ‰์‹œ ์ฐจ๋‹จํ•˜๋Š” ๋“ฑ์˜ ์กฐ์น˜๋ฅผ ์ทจํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "๋„คํŠธ์›Œํฌ ๊ตฌ์„ฑ๋„", + "์›น์‚ฌ์ดํŠธ ์ •๋ณด๊ณต๊ฐœ ์ ˆ์ฐจ ๋ฐ ๋‚ด์—ญ(์‹ ์ฒญยท์Šน์ธยท๊ฒŒ์‹œ ์ด๋ ฅ ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด ๋…ธ์ถœ ์—ฌ๋ถ€ ์ ๊ฒ€ ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ธํ„ฐ๋„ท์— ๊ณต๊ฐœ๋œ ์›น์‚ฌ์ดํŠธ์˜ ์ทจ์•ฝ์ ์œผ๋กœ ์ธํ•˜์—ฌ ๊ตฌ๊ธ€ ๊ฒ€์ƒ‰์„ ํ†ตํ•˜์—ฌ ์—ด๋žŒ ๊ถŒํ•œ์ด ์—†๋Š” ํƒ€์ธ์˜ ๊ฐœ์ธ์ •๋ณด์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์›น์‚ฌ์ดํŠธ์— ๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ฒŒ์‹œํ•˜๋Š” ๊ฒฝ์šฐ ์Šน์ธ ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜๋„๋ก ๋‚ด๋ถ€ ๊ทœ์ •์ด ๋งˆ๋ จ๋˜์–ด ์žˆ์œผ๋‚˜, ์ด๋ฅผ ์ค€์ˆ˜ํ•˜์ง€ ์•Š๊ณ  ๊ฐœ์ธ์ •๋ณด๊ฐ€ ๊ฒŒ์‹œ๋œ ์‚ฌ๋ก€๊ฐ€ ๋‹ค์ˆ˜ ์กด์žฌํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฒŒ์‹œํŒ ๋“ฑ์˜ ์›น ์‘์šฉํ”„๋กœ๊ทธ๋žจ์—์„œ ํƒ€์ธ์ด ์ž‘์„ฑํ•œ ๊ธ€์„ ์ž„์˜๋กœ ์ˆ˜์ •ยท์‚ญ์ œํ•˜๊ฑฐ๋‚˜ ๋น„๋ฐ€๋ฒˆํ˜ธ๋กœ ๋ณดํ˜ธ๋œ ๊ธ€์„ ์—ด๋žŒํ•  ์ˆ˜ ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.4", + "Name": "์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ๋ณด์•ˆ", + "Description": "์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ์„œ๋น„์Šค ์ œ๊ณต ์‹œ ์ •๋ณด์œ ์ถœ์ด๋‚˜ ๋ฐ์ดํ„ฐ ์กฐ์ž‘ยท์‚ฌ๊ธฐ ๋“ฑ์˜ ์นจํ•ด์‚ฌ๊ณ  ์˜ˆ๋ฐฉ์„ ์œ„ํ•˜์—ฌ ์ธ์ฆยท์•”ํ˜ธํ™” ๋“ฑ์˜ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ , ๊ฒฐ์ œ์‹œ์Šคํ…œ ๋“ฑ ์™ธ๋ถ€ ์‹œ์Šคํ…œ๊ณผ ์—ฐ๊ณ„ํ•  ๊ฒฝ์šฐ ์•ˆ์ „์„ฑ์„ ์ ๊ฒ€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.4 ์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ๋ณด์•ˆ", + "AuditChecklist": [ + "์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ๊ฑฐ๋ž˜์˜ ์•ˆ์ „์„ฑ๊ณผ ์‹ ๋ขฐ์„ฑ ํ™•๋ณด๋ฅผ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ์„œ๋น„์Šค ์ œ๊ณต์„ ์œ„ํ•˜์—ฌ ๊ฒฐ์ œ์‹œ์Šคํ…œ ๋“ฑ ์™ธ๋ถ€ ์‹œ์Šคํ…œ๊ณผ ์—ฐ๊ณ„ํ•˜๋Š” ๊ฒฝ์šฐ ์†ก์ˆ˜์‹ ๋˜๋Š” ๊ด€๋ จ ์ •๋ณด์˜ ๋ณดํ˜ธ๋ฅผ ์œ„ํ•œ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์•ˆ์ „์„ฑ์„ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ „์ž๊ฑฐ๋ž˜ ๋ฐ ํ•€ํ…Œํฌ ์„œ๋น„์Šค ๋ณดํ˜ธ๋Œ€์ฑ…", + "๊ฒฐ์ œ์‹œ์Šคํ…œ ์—ฐ๊ณ„ ์‹œ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ†  ๊ฒฐ๊ณผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ „์ž๊ฒฐ์ œ๋Œ€ํ–‰์—…์ฒด์™€ ์œ„ํƒ ๊ณ„์•ฝ์„ ๋งบ๊ณ  ์—ฐ๊ณ„๋ฅผ ํ•˜์˜€์œผ๋‚˜, ์ ์ ˆํ•œ ์ธ์ฆ ๋ฐ ์ ‘๊ทผ์ œํ•œ ์—†์ด ํŠน์ • URL์„ ํ†ตํ•˜์—ฌ ๊ฒฐ์ œ ๊ด€๋ จ ์ •๋ณด๊ฐ€ ๋ชจ๋‘ ํ‰๋ฌธ์œผ๋กœ ์ „์†ก๋˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ „์ž๊ฒฐ์ œ๋Œ€ํ–‰์—…์ฒด์™€ ์™ธ๋ถ€ ์—ฐ๊ณ„ ์‹œ์Šคํ…œ์ด ์ „์šฉ๋ง์œผ๋กœ ์—ฐ๊ฒฐ๋˜์–ด ์žˆ์œผ๋‚˜, ํ•ด๋‹น ์—ฐ๊ณ„ ์‹œ์Šคํ…œ์—์„œ ๋‚ด๋ถ€ ์—…๋ฌด ์‹œ์Šคํ…œ์œผ๋กœ์˜ ์ ‘๊ทผ์ด ์นจ์ž…์ฐจ๋‹จ์‹œ์Šคํ…œ ๋“ฑ์œผ๋กœ ์ ์ ˆํžˆ ํ†ต์ œ๋˜์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€ ์ง€์นจ์—๋Š” ์™ธ๋ถ€ ํ•€ํ…Œํฌ ์„œ๋น„์Šค ์—ฐ๊ณ„ ์‹œ ์ •๋ณด๋ณดํ˜ธํŒ€์˜ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ† ๋ฅผ ๋ฐ›๋„๋ก ๋˜์–ด ์žˆ์œผ๋‚˜, ์ตœ๊ทผ์— ์‹ ๊ทœ ํ•€ํ…Œํฌ ์„œ๋น„์Šค๋ฅผ ์—ฐ๊ณ„ํ•˜๋ฉด์„œ ์ผ์ •์ƒ ์ด์œ ๋กœ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ† ๋ฅผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.5", + "Name": "์ •๋ณด์ „์†ก ๋ณด์•ˆ", + "Description": "๋‹ค๋ฅธ ์กฐ์ง์— ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ์ „์†กํ•  ๊ฒฝ์šฐ ์•ˆ์ „ํ•œ ์ „์†ก ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์กฐ์ง ๊ฐ„ ํ•ฉ์˜๋ฅผ ํ†ตํ•˜์—ฌ ๊ด€๋ฆฌ ์ฑ…์ž„, ์ „์†ก๋ฐฉ๋ฒ•, ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์œ„ํ•œ ๊ธฐ์ˆ ์  ๋ณดํ˜ธ์กฐ์น˜ ๋“ฑ์„ ํ˜‘์•ฝํ•˜๊ณ  ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "glue_database_connections_ssl_enabled", + "s3_bucket_secure_transport_policy", + "sns_subscription_not_using_http_endpoints", + "cloudfront_distributions_https_enabled", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "opensearch_service_domains_https_communications_enforced", + "opensearch_service_domains_node_to_node_encryption_enabled", + "directoryservice_radius_server_security_protocol", + "elb_insecure_ssl_ciphers", + "elb_ssl_listeners", + "kafka_cluster_mutual_tls_authentication_enabled", + "kafka_cluster_in_transit_encryption_enabled", + "elbv2_insecure_ssl_ciphers", + "elbv2_ssl_listeners", + "elasticache_redis_cluster_in_transit_encryption_enabled", + "rds_instance_transport_encrypted", + "apigateway_restapi_client_certificate_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.5 ์ •๋ณด์ „์†ก ๋ณด์•ˆ", + "AuditChecklist": [ + "์™ธ๋ถ€ ์กฐ์ง์— ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ์ „์†กํ•  ๊ฒฝ์šฐ ์•ˆ์ „ํ•œ ์ „์†ก ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด์ƒ ์กฐ์ง ๊ฐ„ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๋ฅผ ์ƒํ˜ธ๊ตํ™˜ํ•˜๋Š” ๊ฒฝ์šฐ ์•ˆ์ „ํ•œ ์ „์†ก์„ ์œ„ํ•œ ํ˜‘์•ฝ์ฒด๊ฒฐ ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์ •๋ณด์ „์†ก ํ˜‘์•ฝ์„œ ๋˜๋Š” ๊ณ„์•ฝ์„œ", + "์ •๋ณด์ „์†ก ๊ธฐ์ˆ ํ‘œ์ค€", + "์ •๋ณด์ „์†ก ๊ด€๋ จ ๊ตฌ์„ฑ๋„, ์ธํ„ฐํŽ˜์ด์Šค ์ •์˜์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋Œ€์™ธ ๊ธฐ๊ด€๊ณผ ์—ฐ๊ณ„ ์‹œ ์ „์šฉ๋ง ๋˜๋Š” VPN์„ ์ ์šฉํ•˜๊ณ  ์ค‘๊ณ„์„œ๋ฒ„์™€ ์ธ์ฆ์„œ ์ ์šฉ ๋“ฑ์„ ํ†ตํ•˜์—ฌ ์•ˆ์ „ํ•˜๊ฒŒ ์ •๋ณด๋ฅผ ์ „์†กํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์™ธ๋ถ€ ๊ธฐ๊ด€๋ณ„ ์—ฐ๊ณ„ ์‹œ๊ธฐ, ๋ฐฉ์‹, ๋‹ด๋‹น์ž ๋ฐ ์ฑ…์ž„์ž, ์—ฐ๊ณ„ ์ •๋ณด, ๋ฒ•์  ๊ทผ๊ฑฐ ๋“ฑ์— ๋Œ€ํ•œ ํ˜„ํ™ฉ๊ด€๋ฆฌ๊ฐ€ ์ ์ ˆํžˆ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ค‘๊ณ„๊ณผ์ •์—์„œ์˜ ์•”ํ˜ธ ํ•ด์ œ ๊ตฌ๊ฐ„ ๋˜๋Š” ์ทจ์•ฝํ•œ ์•”ํ˜ธํ™” ์•Œ๊ณ ๋ฆฌ์ฆ˜(DES, 3DES) ์‚ฌ์šฉ ๋“ฑ์— ๋Œ€ํ•œ ๋ณด์•ˆ์„ฑ ๊ฒ€ํ† , ๋ณด์•ˆํ‘œ์ค€ ๋ฐ ์กฐ์น˜๋ฐฉ์•ˆ ์ˆ˜๋ฆฝ ๋“ฑ์— ๋Œ€ํ•œ ํ˜‘์˜๊ฐ€ ์ดํ–‰๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.6", + "Name": "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ๊ธฐ ๋ณด์•ˆ", + "Description": "PC, ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ ๋“ฑ ๋‹จ๋ง๊ธฐ๊ธฐ๋ฅผ ์—…๋ฌด ๋ชฉ์ ์œผ๋กœ ๋„คํŠธ์›Œํฌ์— ์—ฐ๊ฒฐํ•  ๊ฒฝ์šฐ ๊ธฐ๊ธฐ ์ธ์ฆ ๋ฐ ์Šน์ธ, ์ ‘๊ทผ ๋ฒ”์œ„, ๊ธฐ๊ธฐ ๋ณด์•ˆ์„ค์ • ๋“ฑ์˜ ์ ‘๊ทผํ†ต์ œ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "workspaces_vpc_2private_1public_subnets_nat", + "workspaces_volume_encryption_enabled", + "appstream_fleet_maximum_session_duration", + "appstream_fleet_default_internet_access_disabled", + "appstream_fleet_session_idle_disconnect_timeout", + "appstream_fleet_session_disconnect_timeout" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.6 ์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ๊ธฐ ๋ณด์•ˆ", + "AuditChecklist": [ + "PC, ๋…ธํŠธ๋ถ, ๊ฐ€์ƒPC, ํƒœ๋ธ”๋ฆฟ ๋“ฑ ์—…๋ฌด์— ์‚ฌ์šฉ๋˜๋Š” ๋‹จ๋ง๊ธฐ์— ๋Œ€ํ•˜์—ฌ ๊ธฐ๊ธฐ์ธ์ฆ, ์Šน์ธ, ์ ‘๊ทผ๋ฒ”์œ„ ์„ค์ •, ๊ธฐ๊ธฐ ๋ณด์•ˆ์„ค์ • ๋“ฑ์˜ ๋ณด์•ˆ ํ†ต์ œ ์ •์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ๋ฅผ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด๊ฐ€ ์œ ์ถœ๋˜๋Š” ๊ฒƒ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ž๋ฃŒ๊ณต์œ ํ”„๋กœ๊ทธ๋žจ ์‚ฌ์šฉ ๊ธˆ์ง€, ๊ณต์œ ์„ค์ • ์ œํ•œ, ๋ฌด์„ ๋ง ์ด์šฉ ํ†ต์ œ ๋“ฑ์˜ ์ •์ฑ…์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด์šฉ ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ์˜ ๋ถ„์‹ค, ๋„๋‚œ ๋“ฑ์œผ๋กœ ์ธํ•œ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด์˜ ์œ ยท๋…ธ์ถœ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ณด์•ˆ๋Œ€์ฑ…์„ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ๊ธฐ์— ๋Œ€ํ•œ ์ ‘๊ทผํ†ต์ œ ๋Œ€์ฑ…์˜ ์ ์ ˆ์„ฑ์— ๋Œ€ํ•˜์—ฌ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๋ณด์•ˆํ†ต์ œ ์ง€์นจ ๋ฐ ์ ˆ์ฐจ", + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๋“ฑ๋กํ˜„ํ™ฉ", + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๋ณด์•ˆ์„ค์ •", + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๊ธฐ๊ธฐ์ธ์ฆ ๋ฐ ์Šน์ธ ์ด๋ ฅ", + "์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๋ณด์•ˆ์ ๊ฒ€ ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์—…๋ฌด์ ์ธ ๋ชฉ์ ์œผ๋กœ ๋…ธํŠธ๋ถ, ํƒœ๋ธ”๋ฆฟPC ๋“ฑ ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ๋ฅผ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์—…๋ฌด์šฉ ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ์— ๋Œ€ํ•œ ํ—ˆ์šฉ ๊ธฐ์ค€, ์‚ฌ์šฉ ๋ฒ”์œ„, ์Šน์ธ ์ ˆ์ฐจ, ์ธ์ฆ ๋ฐฉ๋ฒ• ๋“ฑ์— ๋Œ€ํ•œ ์ •์ฑ…์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ ๋ณด์•ˆ๊ด€๋ฆฌ ์ง€์นจ์—์„œ๋Š” ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ์˜ ์—…๋ฌด์šฉ ์‚ฌ์šฉ์„ ์›์น™์ ์œผ๋กœ ๊ธˆ์ง€ํ•˜๊ณ  ํ•„์š”์‹œ ์Šน์ธ ์ ˆ์ฐจ๋ฅผ ํ†ตํ•˜์—ฌ ์ œํ•œ๋œ ๊ธฐ๊ฐ„ ๋™์•ˆ ํ—ˆ๊ฐ€๋œ ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ๋งŒ ์‚ฌ์šฉํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ํ—ˆ๊ฐ€๋œ ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ๊ฐ€ ์‹๋ณ„ยท๊ด€๋ฆฌ๋˜์ง€ ์•Š๊ณ  ์Šน์ธ๋˜์ง€ ์•Š์€ ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ์—์„œ๋„ ๋‚ด๋ถ€ ์ •๋ณด์‹œ์Šคํ…œ ์ ‘์†์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด์— ์ด์šฉ๋˜๋Š” ๋ชจ๋ฐ”์ผ ๊ธฐ๊ธฐ์— ๋Œ€ํ•˜์—ฌ ๋น„๋ฐ€๋ฒˆํ˜ธ ์„ค์ • ๋“ฑ ๋„๋‚œยท๋ถ„์‹ค์— ๋Œ€ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์ด ์ ์šฉ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋‚ด๋ถ€ ๊ทœ์ •์—์„œ๋Š” ์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ์˜ ๊ณต์œ ํด๋” ์‚ฌ์šฉ์„ ๊ธˆ์ง€ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ์ฃผ๊ธฐ์ ์ธ ์ ๊ฒ€์ด ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์•„ ๋‹ค์ˆ˜์˜ ์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ์—์„œ ๊ณผ๋„ํ•˜๊ฒŒ ๊ณต์œ ํด๋”๋ฅผ ์„ค์ •ํ•˜์—ฌ ์‚ฌ์šฉํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.7", + "Name": "๋ณด์กฐ์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ", + "Description": "๋ณด์กฐ์ €์žฅ๋งค์ฒด๋ฅผ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ๋˜๋Š” ์ค‘์š”์ •๋ณด์˜ ์œ ์ถœ์ด ๋ฐœ์ƒํ•˜๊ฑฐ๋‚˜ ์•…์„ฑ์ฝ”๋“œ๊ฐ€ ๊ฐ์—ผ๋˜์ง€ ์•Š๋„๋ก ๊ด€๋ฆฌ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ๊ฐœ์ธ์ •๋ณด ๋˜๋Š” ์ค‘์š”์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ๋ณด์กฐ์ €์žฅ ๋งค์ฒด๋Š” ์•ˆ์ „ํ•œ ์žฅ์†Œ์— ๋ณด๊ด€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.7 ๋ณด์กฐ์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์™ธ์žฅํ•˜๋“œ, USB๋ฉ”๋ชจ๋ฆฌ, CD ๋“ฑ ๋ณด์กฐ์ €์žฅ๋งค์ฒด ์ทจ๊ธ‰(์‚ฌ์šฉ), ๋ณด๊ด€, ํ๊ธฐ, ์žฌ์‚ฌ์šฉ์— ๋Œ€ํ•œ ์ •์ฑ… ๋ฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์กฐ์ €์žฅ๋งค์ฒด ๋ณด์œ ํ˜„ํ™ฉ, ์‚ฌ์šฉ ๋ฐ ๊ด€๋ฆฌ์‹คํƒœ๋ฅผ ์ฃผ๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ์š” ์ •๋ณด์‹œ์Šคํ…œ์ด ์œ„์น˜ํ•œ ํ†ต์ œ๊ตฌ์—ญ, ์ค‘์š” ์ œํ•œ๊ตฌ์—ญ ๋“ฑ์—์„œ ๋ณด์กฐ์ €์žฅ๋งค์ฒด ์‚ฌ์šฉ์„ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์กฐ์ €์žฅ๋งค์ฒด๋ฅผ ํ†ตํ•œ ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ ๋ฐ ์ค‘์š”์ •๋ณด ์œ ์ถœ ๋ฐฉ์ง€๋ฅผ ์œ„ํ•œ ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ๋˜๋Š” ์ค‘์š”์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ๋ณด์กฐ์ €์žฅ๋งค์ฒด๋ฅผ ์ž ๊ธˆ์žฅ์น˜๊ฐ€ ์žˆ๋Š” ์•ˆ์ „ํ•œ ์žฅ์†Œ์— ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ10์กฐ(๋ฌผ๋ฆฌ์  ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "๋ณด์กฐ์ €์žฅ๋งค์ฒด(USB, CD ๋“ฑ) ์ฐจ๋‹จ ์ •์ฑ…", + "๋ณด์กฐ์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ๋Œ€์žฅ", + "๋ณด์กฐ์ €์žฅ๋งค์ฒด ์‹คํƒœ์ ๊ฒ€ ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํ†ต์ œ๊ตฌ์—ญ์ธ ์„œ๋ฒ„์‹ค์—์„œ์˜ ๋ณด์กฐ์ €์žฅ๋งค์ฒด ์‚ฌ์šฉ์„ ์ œํ•œํ•˜๋Š” ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์˜ˆ์™ธ ์Šน์ธ ์ ˆ์ฐจ๋ฅผ ์ค€์ˆ˜ํ•˜์ง€ ์•Š๊ณ  ๋ณด์กฐ์ €์žฅ๋งค์ฒด๋ฅผ ์‚ฌ์šฉํ•œ ์ด๋ ฅ์ด ๋‹ค์ˆ˜ ํ™•์ธ๋˜์—ˆ์œผ๋ฉฐ, ๋ณด์กฐ์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ์‹คํƒœ์— ๋Œ€ํ•œ ์ฃผ๊ธฐ์  ์ ๊ฒ€์ด ์‹ค์‹œ๋˜์ง€ ์•Š์•„ ๋ณด์กฐ์ €์žฅ๋งค์ฒด ๊ด€๋ฆฌ๋Œ€์žฅ์˜ ํ˜„ํ–‰ํ™”๊ฐ€ ๋ฏธํกํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด๊ฐ€ ํฌํ•จ๋œ ๋ณด์กฐ์ €์žฅ๋งค์ฒด๋ฅผ ์ž ๊ธˆ์žฅ์น˜๊ฐ€ ์žˆ๋Š” ์•ˆ์ „ํ•œ ์žฅ์†Œ์— ๋ณด๊ด€ํ•˜์ง€ ์•Š๊ณ  ์‚ฌ๋ฌด์‹ค ์„œ๋ž ๋“ฑ์— ๋ฐฉ์น˜ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ณด์กฐ์ €์žฅ๋งค์ฒด ํ†ต์ œ ์†”๋ฃจ์…˜์„ ๋„์ž…ยท์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ผ๋ถ€ ์‚ฌ์šฉ์ž์— ๋Œ€ํ•˜์—ฌ ์ ์ ˆํ•œ ์Šน์ธ ์ ˆ์ฐจ ์—†์ด ์˜ˆ์™ธ์ฒ˜๋ฆฌ๋˜์–ด ์“ฐ๊ธฐ ๋“ฑ์ด ํ—ˆ์šฉ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ „์‚ฐ์‹ค์— ์œ„์น˜ํ•œ ์ผ๋ถ€ ๊ณต์šฉ PC ๋ฐ ์ „์‚ฐ์žฅ๋น„์—์„œ ์ผ๋ฐ˜ USB๋ฉ”๋ชจ๋ฆฌ์— ๋Œ€ํ•œ ์“ฐ๊ธฐ๊ฐ€ ๊ฐ€๋Šฅํ•œ ์ƒํ™ฉ์ด๋‚˜ ๋งค์ฒด ๋ฐ˜์ž… ๋ฐ ์‚ฌ์šฉ ์ œํ•œ, ์‚ฌ์šฉ์ด๋ ฅ ๊ธฐ๋ก ๋ฐ ๊ฒ€ํ†  ๋“ฑ ํ†ต์ œ๊ฐ€ ์ ์šฉ๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.8", + "Name": "ํŒจ์น˜๊ด€๋ฆฌ", + "Description": "์†Œํ”„ํŠธ์›จ์–ด, ์šด์˜์ฒด์ œ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ์˜ ์ทจ์•ฝ์ ์œผ๋กœ ์ธํ•œ ์นจํ•ด์‚ฌ๊ณ ๋ฅผ ์˜ˆ๋ฐฉํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ตœ์‹  ํŒจ์น˜๋ฅผ ์ ์šฉํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋‹ค๋งŒ ์„œ๋น„์Šค ์˜ํ–ฅ์„ ๊ฒ€ํ† ํ•˜์—ฌ ์ตœ์‹  ํŒจ์น˜ ์ ์šฉ์ด ์–ด๋ ค์šธ ๊ฒฝ์šฐ ๋ณ„๋„์˜ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜์—ฌ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "ssm_managed_compliant_patching", + "cloudfront_distributions_using_deprecated_ssl_protocols", + "opensearch_service_domains_updated_to_the_latest_service_software_version", + "redshift_cluster_automatic_upgrades", + "awslambda_function_using_supported_runtimes", + "eks_cluster_uses_a_supported_version", + "kafka_cluster_uses_latest_version", + "dms_instance_minor_version_upgrade_enabled", + "elasticache_redis_cluster_auto_minor_version_upgrades", + "rds_instance_deprecated_engine_version", + "rds_cluster_minor_version_upgrade_enabled", + "rds_instance_minor_version_upgrade_enabled", + "ec2_instance_account_imdsv2_enabled", + "ec2_instance_older_than_specific_days" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.8 ํŒจ์น˜๊ด€๋ฆฌ", + "AuditChecklist": [ + "์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ, PC ๋“ฑ ์ž์‚ฐ๋ณ„ ํŠน์„ฑ ๋ฐ ์ค‘์š”๋„์— ๋”ฐ๋ผ ์šด์˜์ฒด์ œ(OS)์™€ ์†Œํ”„ํŠธ์›จ์–ด์˜ ํŒจ์น˜๊ด€๋ฆฌ ์ •์ฑ… ๋ฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ์š” ์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ์˜ ๊ฒฝ์šฐ ์„ค์น˜๋œ OS, ์†Œํ”„ํŠธ์›จ์–ด ํŒจ์น˜ ์ ์šฉ ํ˜„ํ™ฉ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์„œ๋น„์Šค ์˜ํ–ฅ๋„ ๋“ฑ์— ๋”ฐ๋ผ ์ทจ์•ฝ์ ์„ ์กฐ์น˜ํ•˜๊ธฐ ์œ„ํ•œ ์ตœ์‹ ์˜ ํŒจ์น˜ ์ ์šฉ์ด ์–ด๋ ค์šด ๊ฒฝ์šฐ ๋ณด์™„๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ์š” ์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ์˜ ๊ฒฝ์šฐ ๊ณต๊ฐœ ์ธํ„ฐ๋„ท ์ ‘์†์„ ํ†ตํ•œ ํŒจ์น˜๋ฅผ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "ํŒจ์น˜๊ด€๋ฆฌ์‹œ์Šคํ…œ์„ ํ™œ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ์ ‘๊ทผํ†ต์ œ ๋“ฑ ์ถฉ๋ถ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ9์กฐ(์•…์„ฑํ”„๋กœ๊ทธ๋žจ ๋“ฑ ๋ฐฉ์ง€)" + ], + "AuditEvidence": [ + "ํŒจ์น˜ ์ ์šฉ ๊ด€๋ฆฌ ์ •์ฑ…ยท์ ˆ์ฐจ", + "์‹œ์Šคํ…œ๋ณ„ ํŒจ์น˜ ์ ์šฉ ํ˜„ํ™ฉ", + "ํŒจ์น˜ ์ ์šฉ ๊ด€๋ จ ์˜ํ–ฅ๋„ ๋ถ„์„ ๊ฒฐ๊ณผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ผ๋ถ€ ์‹œ์Šคํ…œ์—์„œ ํƒ€๋‹นํ•œ ์‚ฌ์œ ๋‚˜ ์ฑ…์ž„์ž ์Šน์ธ ์—†์ด OSํŒจ์น˜๊ฐ€ ์žฅ๊ธฐ๊ฐ„ ์ ์šฉ๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ผ๋ถ€ ์‹œ์Šคํ…œ์— ์„œ๋น„์Šค ์ง€์›์ด ์ข…๋ฃŒ(EOS)๋œ OS๋ฒ„์ „์„ ์‚ฌ์šฉ ์ค‘์ด๋‚˜, ์ด์— ๋”ฐ๋ฅธ ๋Œ€์‘๊ณ„ํš์ด๋‚˜ ๋ณด์™„๋Œ€์ฑ…์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ƒ์šฉ ์†Œํ”„ํŠธ์›จ์–ด ๋ฐ OS์— ๋Œ€ํ•ด์„œ๋Š” ์ตœ์‹  ํŒจ์น˜๊ฐ€ ์ ์šฉ๋˜๊ณ  ์žˆ์œผ๋‚˜, ์˜คํ”ˆ์†Œ์Šค ํ”„๋กœ๊ทธ๋žจ(openssl, openssh, Apache ๋“ฑ)์— ๋Œ€ํ•ด์„œ๋Š” ์ตœ์‹  ํŒจ์น˜๋ฅผ ํ™•์ธํ•˜๊ณ  ์ ์šฉํ•˜๋Š” ์ ˆ์ฐจ ๋ฐ ๋‹ด๋‹น์ž๊ฐ€ ์ง€์ •๋˜์–ด ์žˆ์ง€ ์•Š์•„ ์ตœ์‹  ๋ณด์•ˆํŒจ์น˜๊ฐ€ ์ ์šฉ๋˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.10.9", + "Name": "์•…์„ฑ์ฝ”๋“œ ํ†ต์ œ", + "Description": "๋ฐ”์ด๋Ÿฌ์Šคยท์›œยทํŠธ๋กœ์ด๋ชฉ๋งˆยท๋žœ์„ฌ์›จ์–ด ๋“ฑ์˜ ์•…์„ฑ์ฝ”๋“œ๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด ๋ฐ ์ค‘์š”์ •๋ณด, ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ์—…๋ฌด์šฉ ๋‹จ๋ง๊ธฐ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์•…์„ฑ์ฝ”๋“œ ์˜ˆ๋ฐฉยทํƒ์ง€ยท๋Œ€์‘ ๋“ฑ์˜ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.10. ์‹œ์Šคํ…œ ๋ฐ ์„œ๋น„์Šค ๋ณด์•ˆ๊ด€๋ฆฌ", + "Section": "2.10.9 ์•…์„ฑ์ฝ”๋“œ ํ†ต์ œ", + "AuditChecklist": [ + "๋ฐ”์ด๋Ÿฌ์Šค, ์›œ, ํŠธ๋กœ์ด๋ชฉ๋งˆ, ๋žœ์„ฌ์›จ์–ด ๋“ฑ์˜ ์•…์„ฑ์ฝ”๋“œ๋กœ๋ถ€ํ„ฐ ์ •๋ณด์‹œ์Šคํ…œ ๋ฐ ์—…๋ฌด์šฉ๋‹จ๋ง๊ธฐ ๋“ฑ์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฐฑ์‹  ์†Œํ”„ํŠธ์›จ์–ด ๋“ฑ ๋ณด์•ˆํ”„๋กœ๊ทธ๋žจ์„ ํ†ตํ•˜์—ฌ ์ตœ์‹  ์•…์„ฑ์ฝ”๋“œ ์˜ˆ๋ฐฉยทํƒ์ง€ ํ™œ๋™์„ ์ง€์†์ ์œผ๋กœ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฐฑ์‹  ์†Œํ”„ํŠธ์›จ์–ด ๋“ฑ ๋ณด์•ˆํ”„๋กœ๊ทธ๋žจ์€ ์ตœ์‹ ์˜ ์ƒํƒœ๋กœ ์œ ์ง€ํ•˜๊ณ  ํ•„์š”์‹œ ๊ธด๊ธ‰ ๋ณด์•ˆ ์—…๋ฐ์ดํŠธ๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ ๋ฐœ๊ฒฌ ์‹œ ์•…์„ฑ์ฝ”๋“œ ํ™•์‚ฐ ๋ฐ ํ”ผํ•ด ์ตœ์†Œํ™” ๋“ฑ์˜ ๋Œ€์‘์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ9์กฐ(์•…์„ฑํ”„๋กœ๊ทธ๋žจ ๋“ฑ ๋ฐฉ์ง€)" + ], + "AuditEvidence": [ + "์•…์„ฑํ”„๋กœ๊ทธ๋žจ ๋Œ€์‘ ์ง€์นจยท์ ˆ์ฐจยท๋งค๋‰ด์–ผ", + "๋ฐฑ์‹ ํ”„๋กœ๊ทธ๋žจ ์„ค์น˜ ํ˜„ํ™ฉ", + "๋ฐฑ์‹ ํ”„๋กœ๊ทธ๋žจ ์„ค์ • ํ™”๋ฉด", + "์•…์„ฑํ”„๋กœ๊ทธ๋žจ ๋Œ€์‘ ์ด๋ ฅ(๋Œ€์‘ ๋ณด๊ณ ์„œ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ผ๋ถ€ PC ๋ฐ ์„œ๋ฒ„์— ๋ฐฑ์‹ ์ด ์„ค์น˜๋˜์–ด ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜, ๋ฐฑ์‹  ์—”์ง„์ด ์žฅ๊ธฐ๊ฐ„ ์ตœ์‹  ๋ฒ„์ „์œผ๋กœ ์—…๋ฐ์ดํŠธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ฐฑ์‹  ํ”„๋กœ๊ทธ๋žจ์˜ ํ™˜๊ฒฝ์„ค์ •(์‹ค์‹œ๊ฐ„ ๊ฒ€์‚ฌ, ์˜ˆ์•ฝ๊ฒ€์‚ฌ, ์—…๋ฐ์ดํŠธ ์„ค์ • ๋“ฑ)์„ ์ด์šฉ์ž๊ฐ€ ์ž„์˜๋กœ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ์Œ์—๋„ ๊ทธ์— ๋”ฐ๋ฅธ ์ถ”๊ฐ€ ๋ณดํ˜ธ๋Œ€์ฑ…์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ฐฑ์‹  ์ค‘์•™๊ด€๋ฆฌ์‹œ์Šคํ…œ์— ์ ‘๊ทผํ†ต์ œ ๋“ฑ ๋ณดํ˜ธ๋Œ€์ฑ…์ด ๋ฏธ๋น„ํ•˜์—ฌ ์ค‘์•™๊ด€๋ฆฌ์‹œ์Šคํ…œ์„ ํ†ตํ•œ ์นจํ•ด์‚ฌ๊ณ ๋ฐœ์ƒ ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ๋Š” ๊ฒฝ์šฐ ๋˜๋Š” ๋ฐฑ์‹  ํŒจํ„ด์— ๋Œ€ํ•œ ๋ฌด๊ฒฐ์„ฑ ๊ฒ€์ฆ์„ ํ•˜์ง€ ์•Š์•„ ์•…์˜์ ์ธ ์‚ฌ์šฉ์ž์— ์˜ํ•œ ์•…์„ฑ์ฝ”๋“œ ์ „ํŒŒ ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ผ๋ถ€ ๋‚ด๋ถ€๋ง PC ๋ฐ ์„œ๋ฒ„์—์„œ ๋‹ค์ˆ˜์˜ ์•…์„ฑ์ฝ”๋“œ ๊ฐ์—ผ์ด๋ ฅ์ด ํ™•์ธ๋˜์—ˆ์œผ๋‚˜, ๊ฐ์—ผ ํ˜„ํ™ฉ, ๊ฐ์—ผ ๊ฒฝ๋กœ ๋ฐ ์›์ธ ๋ถ„์„, ๊ทธ์— ๋”ฐ๋ฅธ ์กฐ์น˜๋‚ด์—ญ ๋“ฑ์ด ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.11.1", + "Name": "์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘์ฒด๊ณ„ ๊ตฌ์ถ•", + "Description": "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ ๋“ฑ์„ ์˜ˆ๋ฐฉํ•˜๊ณ  ์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์‹ ์†ํ•˜๊ณ  ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋‚ดยท์™ธ๋ถ€ ์นจํ•ด์‹œ๋„์˜ ํƒ์ง€ยท๋Œ€์‘ยท๋ถ„์„ ๋ฐ ๊ณต์œ ๋ฅผ ์œ„ํ•œ ์ฒด๊ณ„์™€ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ , ๊ด€๋ จ ์™ธ๋ถ€๊ธฐ๊ด€ ๋ฐ ์ „๋ฌธ๊ฐ€๋“ค๊ณผ ํ˜‘์กฐ์ฒด๊ณ„๋ฅผ ๊ตฌ์ถ•ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Section": "2.11.1 ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘์ฒด๊ณ„ ๊ตฌ์ถ•", + "AuditChecklist": [ + "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ ๋ฅผ ์˜ˆ๋ฐฉํ•˜๊ณ  ์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์‹ ์†ํ•˜๊ณ  ํšจ๊ณผ์ ์œผ๋กœ ๋Œ€์‘ํ•˜๊ธฐ ์œ„ํ•œ ์ฒด๊ณ„์™€ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ณด์•ˆ๊ด€์ œ์„œ๋น„์Šค ๋“ฑ ์™ธ๋ถ€ ๊ธฐ๊ด€์„ ํ†ตํ•˜์—ฌ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘์ฒด๊ณ„๋ฅผ ๊ตฌ์ถ•ยท์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘์ ˆ์ฐจ์˜ ์„ธ๋ถ€์‚ฌํ•ญ์„ ๊ณ„์•ฝ์„œ์— ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์นจํ•ด์‚ฌ๊ณ ์˜ ๋ชจ๋‹ˆํ„ฐ๋ง, ๋Œ€์‘ ๋ฐ ์ฒ˜๋ฆฌ๋ฅผ ์œ„ํ•˜์—ฌ ์™ธ๋ถ€์ „๋ฌธ๊ฐ€, ์ „๋ฌธ์—…์ฒด, ์ „๋ฌธ๊ธฐ๊ด€ ๋“ฑ๊ณผ์˜ ํ˜‘์กฐ์ฒด๊ณ„๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ34์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์œ ์ถœ ๋“ฑ์˜ ํ†ต์ง€ยท์‹ ๊ณ )", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ48์กฐ์˜3(์นจํ•ด์‚ฌ๊ณ ์˜ ์‹ ๊ณ  ๋“ฑ), ์ œ48์กฐ์˜4(์นจํ•ด์‚ฌ๊ณ ์˜ ์›์ธ๋ถ„์„ ๋“ฑ)" + ], + "AuditEvidence": [ + "์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์ง€์นจยท์ ˆ์ฐจยท๋งค๋‰ด์–ผ", + "์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์กฐ์ง๋„ ๋ฐ ๋น„์ƒ์—ฐ๋ฝ๋ง", + "๋ณด์•ˆ๊ด€์ œ์„œ๋น„์Šค ๊ณ„์•ฝ์„œ(SLA ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์นจํ•ด์‚ฌ๊ณ ์— ๋Œ€๋น„ํ•œ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์กฐ์ง ๋ฐ ๋Œ€์‘ ์ ˆ์ฐจ๋ฅผ ๋ช…ํ™•ํžˆ ์ •์˜ํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋‚ด๋ถ€ ์ง€์นจ ๋ฐ ์ ˆ์ฐจ์— ์นจํ•ด์‚ฌ๊ณ  ๋‹จ๊ณ„๋ณ„(์‚ฌ๊ณ  ์ „, ์ธ์ง€, ์ฒ˜๋ฆฌ, ๋ณต๊ตฌ, ๋ณด๊ณ  ๋“ฑ) ๋Œ€์‘ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜์—ฌ ๋ช…์‹œํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์นจํ•ด์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ์‚ฌ๊ณ  ์œ ํ˜• ๋ฐ ์‹ฌ๊ฐ๋„์— ๋”ฐ๋ฅธ ์‹ ๊ณ ยทํ†ต์ง€ ์ ˆ์ฐจ, ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌ ์ ˆ์ฐจ์˜ ์ผ๋ถ€ ๋˜๋Š” ์ „๋ถ€๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์กฐ์ง๋„ ๋ฐ ๋น„์ƒ์—ฐ๋ฝ๋ง ๋“ฑ์„ ํ˜„ํ–‰ํ™”ํ•˜์ง€ ์•Š๊ณ  ์žˆ๊ฑฐ๋‚˜, ๋‹ด๋‹น์ž๋ณ„ ์—ญํ• ๊ณผ ์ฑ…์ž„์ด ๋ช…ํ™•ํžˆ ์ •์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์นจํ•ด์‚ฌ๊ณ  ์‹ ๊ณ ยทํ†ต์ง€ ๋ฐ ๋Œ€์‘ ํ˜‘์กฐ๋ฅผ ์œ„ํ•œ ๋Œ€์™ธ๊ธฐ๊ด€ ์—ฐ๋ฝ์ฒ˜์— ๊ธฐ๊ด€๋ช…, ํ™ˆํŽ˜์ด์ง€, ์—ฐ๋ฝ์ฒ˜ ๋“ฑ์ด ์ž˜๋ชป ๋ช…์‹œ๋˜์–ด ์žˆ๊ฑฐ๋‚˜, ์ผ๋ถ€ ๊ธฐ๊ด€ ๊ด€๋ จ ์ •๋ณด๊ฐ€ ๋ˆ„๋ฝ ๋˜๋Š” ํ˜„ํ–‰ํ™”๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์™ธ๋ถ€ ๋ณด์•ˆ๊ด€์ œ ์ „๋ฌธ์—…์ฒด ๋“ฑ ์œ ๊ด€๊ธฐ๊ด€์— ์นจํ•ด์‚ฌ๊ณ  ํƒ์ง€ ๋ฐ ๋Œ€์‘์„ ์œ„ํƒํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘์— ๋Œ€ํ•œ ์ƒํ˜ธ ๊ฐ„ ๊ด€๋ จ ์—ญํ•  ๋ฐ ์ฑ…์ž„ ๋ฒ”์œ„๊ฐ€ ๊ณ„์•ฝ์„œ๋‚˜ SLA์— ๋ช…ํ™•ํ•˜๊ฒŒ ์ •์˜๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜์˜€์œผ๋‚˜, ๊ฐœ์ธ์ •๋ณด ์นจํ•ด ์‹ ๊ณ  ๊ธฐ์ค€, ์‹œ์  ๋“ฑ์ด ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ์ค€์ˆ˜ํ•˜์ง€ ๋ชปํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.11.2", + "Name": "์ทจ์•ฝ์  ์ ๊ฒ€ ๋ฐ ์กฐ์น˜", + "Description": "์ •๋ณด์‹œ์Šคํ…œ์˜ ์ทจ์•ฝ์ ์ด ๋…ธ์ถœ๋˜์–ด ์žˆ๋Š”์ง€๋ฅผ ํ™•์ธํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ •๊ธฐ์ ์œผ๋กœ ์ทจ์•ฝ์  ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•˜๊ณ , ๋ฐœ๊ฒฌ๋œ ์ทจ์•ฝ์ ์— ๋Œ€ํ•ด์„œ๋Š” ์‹ ์†ํ•˜๊ฒŒ ์กฐ์น˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์ ์˜ ๋ฐœ์ƒ ์—ฌ๋ถ€๋ฅผ ์ง€์†์ ์œผ๋กœ ํŒŒ์•…ํ•˜๊ณ , ์ •๋ณด์‹œ์Šคํ…œ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ ์กฐ์น˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "codebuild_project_no_secrets_in_variables", + "codebuild_project_source_repo_url_no_sensitive_credentials", + "ssm_document_secrets", + "cloudwatch_log_group_no_secrets_in_logs", + "inspector2_is_enabled", + "inspector2_active_findings_exist", + "ecr_registry_scan_images_on_push_enabled", + "ecr_repositories_scan_images_on_push_enabled", + "ecr_repositories_scan_vulnerabilities_in_latest_image", + "ecs_task_definitions_no_environment_secrets", + "awslambda_function_no_secrets_in_code", + "awslambda_function_no_secrets_in_variables", + "autoscaling_find_secrets_ec2_launch_configuration", + "guardduty_no_high_severity_findings", + "guardduty_is_enabled", + "guardduty_centrally_managed", + "trustedadvisor_premium_support_plan_subscribed", + "trustedadvisor_errors_and_warnings", + "securityhub_enabled", + "cloudformation_stack_outputs_find_secrets", + "ec2_instance_secrets_user_data", + "ec2_launch_template_no_secrets", + "ec2_instance_imdsv2_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Section": "2.11.2 ์ทจ์•ฝ์  ์ ๊ฒ€ ๋ฐ ์กฐ์น˜", + "AuditChecklist": [ + "์ •๋ณด์‹œ์Šคํ…œ ์ทจ์•ฝ์  ์ ๊ฒ€ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ , ์ •๊ธฐ์ ์œผ๋กœ ์ ๊ฒ€์„ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฐœ๊ฒฌ๋œ ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ ์กฐ์น˜๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ , ๊ทธ ๊ฒฐ๊ณผ๋ฅผ ์ฑ…์ž„์ž์—๊ฒŒ ๋ณด๊ณ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ตœ์‹  ๋ณด์•ˆ์ทจ์•ฝ์  ๋ฐœ์ƒ ์—ฌ๋ถ€๋ฅผ ์ง€์†์ ์œผ๋กœ ํŒŒ์•…ํ•˜๊ณ , ์ •๋ณด์‹œ์Šคํ…œ์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ ์กฐ์น˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ทจ์•ฝ์  ์ ๊ฒ€ ์ด๋ ฅ์„ ๊ธฐ๋ก๊ด€๋ฆฌํ•˜์—ฌ ์ „๋…„๋„์— ๋„์ถœ๋œ ์ทจ์•ฝ์ ์ด ์žฌ๋ฐœ์ƒํ•˜๋Š” ๋“ฑ์˜ ๋ฌธ์ œ์ ์— ๋Œ€ํ•˜์—ฌ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ4์กฐ(๋‚ด๋ถ€ ๊ด€๋ฆฌ๊ณ„ํš์˜ ์ˆ˜๋ฆฝยท์‹œํ–‰ ๋ฐ ์ ๊ฒ€), ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "์ทจ์•ฝ์  ์ ๊ฒ€ ๊ณ„ํš์„œ", + "์ทจ์•ฝ์  ์ ๊ฒ€ ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ(์›น, ๋ชจ๋ฐ”์ผ ์•ฑ, ์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ์‹œ์Šคํ…œ, ๋ณด์•ˆ์‹œ์Šคํ…œ, DBMS ๋“ฑ)", + "์ทจ์•ฝ์  ์ ๊ฒ€ ์ด๋ ฅ", + "์ทจ์•ฝ์  ์กฐ์น˜๊ณ„ํš์„œ", + "์ทจ์•ฝ์  ์กฐ์น˜์™„๋ฃŒ๋ณด๊ณ ์„œ", + "๋ชจ์˜ํ•ดํ‚น ๊ณ„ํš์„œยท๊ฒฐ๊ณผ๋ณด๊ณ ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ๊ทœ์ •์— ์—ฐ 1ํšŒ ์ด์ƒ ์ฃผ์š” ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๊ธฐ์ˆ ์  ์ทจ์•ฝ์  ์ ๊ฒ€์„ ํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ฃผ์š” ์‹œ์Šคํ…œ ์ค‘ ์ผ๋ถ€๊ฐ€ ์ทจ์•ฝ์  ์ ๊ฒ€ ๋Œ€์ƒ์—์„œ ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ทจ์•ฝ์  ์ ๊ฒ€์—์„œ ๋ฐœ๊ฒฌ๋œ ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ ๋ณด์™„์กฐ์น˜๋ฅผ ์ดํ–‰ํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜, ๋‹จ๊ธฐ๊ฐ„ ๋‚ด์— ์กฐ์น˜ํ•  ์ˆ˜ ์—†๋Š” ์ทจ์•ฝ์ ์— ๋Œ€ํ•œ ํƒ€๋‹น์„ฑ ๊ฒ€ํ†  ๋ฐ ์Šน์ธ ์ด๋ ฅ์ด ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.11.3", + "Name": "์ด์ƒํ–‰์œ„ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง", + "Description": "๋‚ดยท์™ธ๋ถ€์— ์˜ํ•œ ์นจํ•ด์‹œ๋„, ๊ฐœ์ธ์ •๋ณด์œ ์ถœ ์‹œ๋„, ๋ถ€์ •ํ–‰์œ„ ๋“ฑ์„ ์‹ ์†ํ•˜๊ฒŒ ํƒ์ง€ยท๋Œ€์‘ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋„คํŠธ์›Œํฌ ๋ฐ ๋ฐ์ดํ„ฐ ํ๋ฆ„ ๋“ฑ์„ ์ˆ˜์ง‘ํ•˜์—ฌ ๋ถ„์„ํ•˜๋ฉฐ, ๋ชจ๋‹ˆํ„ฐ๋ง ๋ฐ ์ ๊ฒ€ ๊ฒฐ๊ณผ์— ๋”ฐ๋ฅธ ์‚ฌํ›„์กฐ์น˜๋Š” ์ ์‹œ์— ์ด๋ฃจ์–ด์ ธ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "cloudwatch_log_metric_filter_unauthorized_api_calls", + "cloudwatch_changes_to_network_route_tables_alarm_configured", + "cloudwatch_changes_to_network_gateways_alarm_configured", + "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes", + "cloudwatch_log_group_kms_encryption_enabled", + "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled", + "cloudwatch_cross_account_sharing_disabled", + "cloudwatch_log_group_retention_policy_specific_days_enabled", + "cloudwatch_changes_to_vpcs_alarm_configured", + "cloudwatch_log_group_no_secrets_in_logs", + "cloudwatch_log_metric_filter_aws_organizations_changes", + "cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk", + "cloudwatch_log_metric_filter_authentication_failures", + "cloudwatch_log_metric_filter_sign_in_without_mfa", + "cloudwatch_log_metric_filter_security_group_changes", + "cloudwatch_changes_to_network_acls_alarm_configured", + "cloudwatch_log_metric_filter_root_usage", + "cloudwatch_log_metric_filter_policy_changes", + "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled", + "cognito_user_pool_client_prevent_user_existence_errors", + "fms_policy_compliant", + "cloudtrail_insights_exist", + "cloudtrail_threat_detection_enumeration", + "networkfirewall_in_all_vpc", + "vpc_flow_logs_enabled", + "guardduty_no_high_severity_findings", + "trustedadvisor_errors_and_warnings", + "securityhub_enabled" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Section": "2.11.3 ์ด์ƒํ–‰์œ„ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง", + "AuditChecklist": [ + "๋‚ดยท์™ธ๋ถ€์— ์˜ํ•œ ์นจํ•ด์‹œ๋„, ๊ฐœ์ธ์ •๋ณด์œ ์ถœ ์‹œ๋„, ๋ถ€์ •ํ–‰์œ„ ๋“ฑ ์ด์ƒํ–‰์œ„๋ฅผ ํƒ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์ฃผ์š” ์ •๋ณด์‹œ์Šคํ…œ, ์‘์šฉํ”„๋กœ๊ทธ๋žจ, ๋„คํŠธ์›Œํฌ, ๋ณด์•ˆ์‹œ์Šคํ…œ ๋“ฑ์—์„œ ๋ฐœ์ƒํ•œ ๋„คํŠธ์›Œํฌ ํŠธ๋ž˜ํ”ฝ, ๋ฐ์ดํ„ฐ ํ๋ฆ„, ์ด๋ฒคํŠธ ๋กœ๊ทธ ๋“ฑ์„ ์ˆ˜์ง‘ํ•˜์—ฌ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋งํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์นจํ•ด์‹œ๋„, ๊ฐœ์ธ์ •๋ณด์œ ์ถœ์‹œ๋„, ๋ถ€์ •ํ–‰์œ„ ๋“ฑ์˜ ์—ฌ๋ถ€๋ฅผ ํŒ๋‹จํ•˜๊ธฐ ์œ„ํ•œ ๊ธฐ์ค€ ๋ฐ ์ž„๊ณ„์น˜๋ฅผ ์ •์˜ํ•˜๊ณ  ์ด์— ๋”ฐ๋ผ ์ด์ƒํ–‰์œ„์˜ ํŒ๋‹จ ๋ฐ ์กฐ์‚ฌ ๋“ฑ ํ›„์† ์กฐ์น˜๊ฐ€ ์ ์‹œ์— ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ6์กฐ(์ ‘๊ทผํ†ต์ œ)" + ], + "AuditEvidence": [ + "์ด์ƒํ–‰์œ„ ๋ถ„์„ ๋ฐ ๋ชจ๋‹ˆํ„ฐ๋ง ํ˜„ํ™ฉ", + "์ด์ƒํ–‰์œ„ ๋ฐœ๊ฒฌ ์‹œ ๋Œ€์‘ ์ฆ๊ฑฐ์ž๋ฃŒ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์™ธ๋ถ€๋กœ๋ถ€ํ„ฐ์˜ ์„œ๋ฒ„, ๋„คํŠธ์›Œํฌ, ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค, ๋ณด์•ˆ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์นจํ•ด ์‹œ๋„๋ฅผ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ํ•˜๋Š” ์ƒ์‹œ ๋˜๋Š” ์ •๊ธฐ์  ๋ชจ๋‹ˆํ„ฐ๋ง ์ฒด๊ณ„ ๋ฐ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์™ธ๋ถ€ ๋ณด์•ˆ๊ด€์ œ ์ „๋ฌธ์—…์ฒด ๋“ฑ ์™ธ๋ถ€ ๊ธฐ๊ด€์— ์นจํ•ด์‹œ๋„ ๋ชจ๋‹ˆํ„ฐ๋ง ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์œ„ํƒ์—…์ฒด๊ฐ€ ์ œ๊ณตํ•œ ๊ด€๋ จ ๋ณด๊ณ ์„œ๋ฅผ ๊ฒ€ํ† ํ•œ ์ด๋ ฅ์ด ํ™•์ธ๋˜์ง€ ์•Š๊ฑฐ๋‚˜, ์œ„ํƒ ๋Œ€์ƒ์—์„œ ์ œ์™ธ๋œ ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ์ž์ฒด ๋ชจ๋‹ˆํ„ฐ๋ง ์ฒด๊ณ„๋ฅผ ๊ฐ–์ถ”๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋‚ด๋ถ€์ ์œผ๋กœ ์ •์˜ํ•œ ์ž„๊ณ„์น˜๋ฅผ ์ดˆ๊ณผํ•˜๋Š” ์ด์ƒ ํŠธ๋ž˜ํ”ฝ์ด ์ง€์†์ ์œผ๋กœ ๋ฐœ๊ฒฌ๋˜๊ณ  ์žˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ๋Œ€์‘์กฐ์น˜๊ฐ€ ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.11.4", + "Name": "์‚ฌ๊ณ  ๋Œ€์‘ ํ›ˆ๋ จ ๋ฐ ๊ฐœ์„ ", + "Description": "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ๋ฅผ ์ž„์ง์›๊ณผ ์ดํ•ด๊ด€๊ณ„์ž๊ฐ€ ์ˆ™์ง€ํ•˜๋„๋ก ์‹œ๋‚˜๋ฆฌ์˜ค์— ๋”ฐ๋ฅธ ๋ชจ์˜ํ›ˆ๋ จ์„ ์—ฐ 1ํšŒ ์ด์ƒ ์‹ค์‹œํ•˜๊ณ  ํ›ˆ๋ จ๊ฒฐ๊ณผ๋ฅผ ๋ฐ˜์˜ํ•˜์—ฌ ๋Œ€์‘์ฒด๊ณ„๋ฅผ ๊ฐœ์„ ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "ssmincidents_enabled_with_plans" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Section": "2.11.4 ์‚ฌ๊ณ  ๋Œ€์‘ ํ›ˆ๋ จ ๋ฐ ๊ฐœ์„ ", + "AuditChecklist": [ + "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ์— ๊ด€ํ•œ ๋ชจ์˜ํ›ˆ๋ จ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์ด์— ๋”ฐ๋ผ ์—ฐ 1ํšŒ ์ด์ƒ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ›ˆ๋ จ์„ ์‹ค์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ํ›ˆ๋ จ ๊ฒฐ๊ณผ๋ฅผ ๋ฐ˜์˜ํ•˜์—ฌ ์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘์ฒด๊ณ„๋ฅผ ๊ฐœ์„ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘ ๋ชจ์˜ํ›ˆ๋ จ ๊ณ„ํš์„œ", + "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ  ๋Œ€์‘ ๋ชจ์˜ํ›ˆ๋ จ ๊ฒฐ๊ณผ์„œ", + "์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์นจํ•ด์‚ฌ๊ณ  ๋ชจ์˜ํ›ˆ๋ จ์„ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜ ๊ด€๋ จ ๊ณ„ํš์„œ ๋ฐ ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ๊ฐ€ ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์—ฐ๊ฐ„ ์นจํ•ด์‚ฌ๊ณ  ๋ชจ์˜ํ›ˆ๋ จ ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜์˜€์œผ๋‚˜ ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋˜๋Š” ์Šน์ธ ์—†์ด ํ•ด๋‹น ๊ธฐ๊ฐ„ ๋‚ด์— ์‹ค์‹œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ชจ์˜ํ›ˆ๋ จ์„ ๊ณ„ํšํ•˜์—ฌ ์‹ค์‹œํ•˜์˜€์œผ๋‚˜, ๊ด€๋ จ ๋‚ด๋ถ€ ์ง€์นจ์— ์ •ํ•œ ์ ˆ์ฐจ ๋ฐ ์„œ์‹์— ๋”ฐ๋ผ ์ˆ˜ํ–‰ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.11.5", + "Name": "์‚ฌ๊ณ  ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌ", + "Description": "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ ์ง•ํ›„๋‚˜ ๋ฐœ์ƒ์„ ์ธ์ง€ํ•œ ๋•Œ์—๋Š” ๋ฒ•์  ํ†ต์ง€ ๋ฐ ์‹ ๊ณ  ์˜๋ฌด๋ฅผ ์ค€์ˆ˜ํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์‹ ์†ํ•˜๊ฒŒ ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌํ•˜๊ณ  ์‚ฌ๊ณ ๋ถ„์„ ํ›„ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜์—ฌ ๋Œ€์‘์ฒด๊ณ„์— ๋ฐ˜์˜ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.11. ์‚ฌ๊ณ  ์˜ˆ๋ฐฉ ๋ฐ ๋Œ€์‘", + "Section": "2.11.5 ์‚ฌ๊ณ  ๋Œ€์‘ ๋ฐ ๋ณต๊ตฌ", + "AuditChecklist": [ + "์นจํ•ด์‚ฌ๊ณ  ๋ฐ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์˜ ์ง•ํ›„ ๋˜๋Š” ๋ฐœ์ƒ์„ ์ธ์ง€ํ•œ ๊ฒฝ์šฐ ์ •์˜๋œ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ์— ๋”ฐ๋ผ ์‹ ์†ํ•˜๊ฒŒ ๋Œ€์‘ ๋ฐ ๋ณด๊ณ ๊ฐ€ ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ์นจํ•ด์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ๊ด€๋ จ ๋ฒ•๋ น์— ๋”ฐ๋ผ ์ •๋ณด์ฃผ์ฒด ํ†ต์ง€ ๋ฐ ๊ด€๊ณ„๊ธฐ๊ด€ ์‹ ๊ณ  ์ ˆ์ฐจ๋ฅผ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์นจํ•ด์‚ฌ๊ณ ๊ฐ€ ์ข…๊ฒฐ๋œ ํ›„ ์‚ฌ๊ณ ์˜ ์›์ธ์„ ๋ถ„์„ํ•˜์—ฌ ๊ทธ ๊ฒฐ๊ณผ๋ฅผ ๋ณด๊ณ ํ•˜๊ณ  ๊ด€๋ จ ์กฐ์ง ๋ฐ ์ธ๋ ฅ๊ณผ ๊ณต์œ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์นจํ•ด์‚ฌ๊ณ  ๋ถ„์„์„ ํ†ตํ•˜์—ฌ ์–ป์€ ์ •๋ณด๋ฅผ ํ™œ์šฉํ•˜์—ฌ ์œ ์‚ฌ ์‚ฌ๊ณ ๊ฐ€ ์žฌ๋ฐœํ•˜์ง€ ์•Š๋„๋ก ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ํ•„์š”ํ•œ ๊ฒฝ์šฐ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘์ ˆ์ฐจ ๋“ฑ์„ ๋ณ€๊ฒฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ34์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์œ ์ถœ ๋“ฑ์˜ ํ†ต์ง€ยท์‹ ๊ณ )", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ48์กฐ์˜3(์นจํ•ด์‚ฌ๊ณ ์˜ ์‹ ๊ณ  ๋“ฑ), ์ œ48์กฐ์˜4(์นจํ•ด์‚ฌ๊ณ ์˜ ์›์ธ๋ถ„์„ ๋“ฑ)" + ], + "AuditEvidence": [ + "์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘ ์ ˆ์ฐจ", + "์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘๋ณด๊ณ ์„œ", + "์นจํ•ด์‚ฌ๊ณ  ๊ด€๋ฆฌ๋Œ€์žฅ", + "๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‹ ๊ณ ์„œ", + "๋น„์ƒ์—ฐ๋ฝ๋ง" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๋‚ด๋ถ€ ์นจํ•ด์‚ฌ๊ณ  ๋Œ€์‘์ง€์นจ์—๋Š” ์นจํ•ด์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ๋‚ด๋ถ€ ์ •๋ณด๋ณดํ˜ธ์œ„์›ํšŒ ๋ฐ ์ดํ•ด๊ด€๊ณ„ ๋ถ€์„œ์—๊ฒŒ ๋ณด๊ณ ํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์นจํ•ด์‚ฌ๊ณ  ๋ฐœ์ƒ ์‹œ ๋‹ด๋‹น ๋ถ€์„œ์—์„œ ์ž์ฒด์ ์œผ๋กœ ๋Œ€์‘ ์กฐ์น˜ ํ›„ ์ •๋ณด๋ณดํ˜ธ์œ„์›ํšŒ ๋ฐ ์ดํ•ด๊ด€๊ณ„ ๋ถ€์„œ์— ๋ณด๊ณ ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ตœ๊ทผ DDoS ๊ณต๊ฒฉ์œผ๋กœ ์˜์‹ฌ๋˜๋Š” ์นจํ•ด์‚ฌ๊ณ ๋กœ ์ธํ•˜์—ฌ ์„œ๋น„์Šค ์ผ๋ถ€๊ฐ€ ์ค‘๋‹จ๋œ ์‚ฌ๋ก€๊ฐ€ ์žˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•œ ์›์ธ๋ถ„์„ ๋ฐ ์žฌ๋ฐœ๋ฐฉ์ง€ ๋Œ€์ฑ…์ด ์ˆ˜๋ฆฝ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์™ธ๋ถ€ ํ•ดํ‚น์— ์˜ํ•ด ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์‚ฌ๊ณ ๊ฐ€ ๋ฐœ์ƒํ•˜์˜€์œผ๋‚˜, ์œ ์ถœ๋œ ๊ฐœ์ธ์ •๋ณด ๊ฑด์ˆ˜๊ฐ€ ์†Œ๋Ÿ‰์ด๋ผ๋Š” ์ด์œ ๋กœ 72์‹œ๊ฐ„ ์ด๋‚ด์— ํ†ต์ง€ ๋ฐ ์‹ ๊ณ ๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋‹ด๋‹น์ž์˜ ์‹ค์ˆ˜์— ์˜ํ•ด ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๊ฒŒ์‹œํŒ์„ ํ†ตํ•ด 1์ฒœ๋ช… ์ด์ƒ ์ •๋ณด์ฃผ์ฒด์— ๋Œ€ํ•œ ๊ฐœ์ธ์ •๋ณด ์œ ์ถœ์ด ๋ฐœ์ƒํ•˜์˜€์œผ๋‚˜, ํ•ด๋‹น ์ •๋ณด์ฃผ์ฒด์— ๋Œ€ํ•œ ์œ ์ถœ ํ†ต์ง€๊ฐ€ ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.12.1", + "Name": "์žฌํ•ดยท์žฌ๋‚œ ๋Œ€๋น„ ์•ˆ์ „์กฐ์น˜", + "Description": "์ž์—ฐ์žฌํ•ด, ํ†ต์‹ ยท์ „๋ ฅ ์žฅ์• , ํ•ดํ‚น ๋“ฑ ์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค ๋ฐ ์‹œ์Šคํ…œ์˜ ์šด์˜ ์—ฐ์†์„ฑ์„ ์œ„ํ˜‘ํ•  ์ˆ˜ ์žˆ๋Š” ์žฌํ•ด ์œ ํ˜•์„ ์‹๋ณ„ํ•˜๊ณ , ์œ ํ˜•๋ณ„ ์˜ˆ์ƒ ํ”ผํ•ด๊ทœ๋ชจ ๋ฐ ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ๊ฐ„, ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ์ ์„ ์ •์˜ํ•˜๊ณ  ๋ณต๊ตฌ ์ „๋žต ๋ฐ ๋Œ€์ฑ…, ๋น„์ƒ์‹œ ๋ณต๊ตฌ ์กฐ์ง, ๋น„์ƒ์—ฐ๋ฝ์ฒด๊ณ„, ๋ณต๊ตฌ ์ ˆ์ฐจ ๋“ฑ ์žฌํ•ด ๋ณต๊ตฌ์ฒด๊ณ„๋ฅผ ๊ตฌ์ถ•ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "kms_cmk_not_deleted_unintentionally", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_versioning", + "s3_bucket_cross_region_replication", + "s3_bucket_object_lock", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "lightsail_instance_automated_snapshots", + "neptune_cluster_multi_az", + "neptune_cluster_deletion_protection", + "dynamodb_tables_pitr_enabled", + "elb_is_in_multiple_az", + "elb_cross_zone_load_balancing_enabled", + "redshift_cluster_automated_snapshot", + "drs_job_exist", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "vpc_subnet_different_az", + "vpc_different_regions", + "dms_instance_multi_az_enabled", + "autoscaling_group_multiple_az", + "elbv2_is_in_multiple_az", + "elbv2_deletion_protection", + "backup_reportplans_exist", + "backup_plans_exist", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "rds_instance_multi_az", + "rds_instance_deletion_protection", + "rds_cluster_deletion_protection", + "rds_cluster_multi_az", + "rds_instance_backup_enabled", + "efs_have_backup_enabled", + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.12. ์žฌํ•ด ๋ณต๊ตฌ", + "Section": "2.12.1 ์žฌํ•ดยท์žฌ๋‚œ ๋Œ€๋น„ ์•ˆ์ „์กฐ์น˜", + "AuditChecklist": [ + "์กฐ์ง์˜ ํ•ต์‹ฌ ์„œ๋น„์Šค(์—…๋ฌด) ์—ฐ์†์„ฑ์„ ์œ„ํ˜‘ํ•  ์ˆ˜ ์žˆ๋Š” IT ์žฌํ•ด ์œ ํ˜•์„ ์‹๋ณ„ํ•˜๊ณ , ์œ ํ˜•๋ณ„ ํ”ผํ•ด๊ทœ๋ชจ ๋ฐ ์—…๋ฌด์— ๋ฏธ์น˜๋Š” ์˜ํ–ฅ์„ ๋ถ„์„ํ•˜์—ฌ ํ•ต์‹ฌ IT ์„œ๋น„์Šค(์—…๋ฌด) ๋ฐ ์‹œ์Šคํ…œ์„ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "ํ•ต์‹ฌ IT ์„œ๋น„์Šค ๋ฐ ์‹œ์Šคํ…œ์˜ ์ค‘์š”๋„ ๋ฐ ํŠน์„ฑ์— ๋”ฐ๋ฅธ ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ๊ฐ„, ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ์ ์„ ์ •์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์žฌํ•ดยท์žฌ๋‚œ ๋ฐœ์ƒ ์‹œ์—๋„ ํ•ต์‹ฌ ์„œ๋น„์Šค ๋ฐ ์‹œ์Šคํ…œ์˜ ์—ฐ์†์„ฑ์„ ๋ณด์žฅํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ณต๊ตฌ ์ „๋žต ๋ฐ ๋Œ€์ฑ…, ๋น„์ƒ์‹œ ๋ณต๊ตฌ ์กฐ์ง, ๋น„์ƒ์—ฐ๋ฝ์ฒด๊ณ„, ๋ณต๊ตฌ ์ ˆ์ฐจ ๋“ฑ ์žฌํ•ด ๋ณต๊ตฌ ๊ณ„ํš์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ29์กฐ(์•ˆ์ „์กฐ์น˜์˜๋ฌด)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ11์กฐ(์žฌํ•ดยท์žฌ๋‚œ ๋Œ€๋น„ ์•ˆ์ „์กฐ์น˜)" + ], + "AuditEvidence": [ + "IT ์žฌํ•ด ๋ณต๊ตฌ ์ง€์นจยท์ ˆ์ฐจ", + "IT ์žฌํ•ด ๋ณต๊ตฌ ๊ณ„ํš(RTO, RPO ์ •์˜ ํฌํ•จ)", + "๋น„์ƒ์—ฐ๋ฝ๋ง", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ ์œ„๊ธฐ๋Œ€์‘ ๋งค๋‰ด์–ผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : IT ์žฌํ•ด ๋ณต๊ตฌ ์ ˆ์ฐจ์„œ ๋‚ด์— IT ์žฌํ•ด ๋ณต๊ตฌ ์กฐ์ง ๋ฐ ์—ญํ•  ์ •์˜, ๋น„์ƒ์—ฐ๋ฝ์ฒด๊ณ„, ๋ณต๊ตฌ ์ ˆ์ฐจ ๋ฐ ๋ฐฉ๋ฒ• ๋“ฑ ์ค‘์š”ํ•œ ๋‚ด์šฉ์ด ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋น„์ƒ์‚ฌํƒœ ๋ฐœ์ƒ ์‹œ ์ •๋ณด์‹œ์Šคํ…œ์˜ ์—ฐ์†์„ฑ ํ™•๋ณด ๋ฐ ํ”ผํ•ด ์ตœ์†Œํ™”๋ฅผ ์œ„ํ•˜์—ฌ ๋ฐฑ์—…์„ผํ„ฐ๋ฅผ ๊ตฌ์ถ•ํ•˜์—ฌ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ด€๋ จ ์ •์ฑ…์— ๋ฐฑ์—…์„ผํ„ฐ๋ฅผ ํ™œ์šฉํ•œ ์žฌํ•ด ๋ณต๊ตฌ ์ ˆ์ฐจ ๋“ฑ์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š์•„ ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๋ฐ ๋ณต๊ตฌ๊ฐ€ ํšจ๊ณผ์ ์œผ๋กœ ์ง„ํ–‰๋˜๊ธฐ ์–ด๋ ค์šด ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์„œ๋น„์Šค ์šด์˜๊ณผ ๊ด€๋ จ๋œ ์ผ๋ถ€ ์ค‘์š” ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ๊ฐ„์ด ์ •์˜๋˜์–ด ์žˆ์ง€ ์•Š์œผ๋ฉฐ, ์ด์— ๋Œ€ํ•œ ์ ์ ˆํ•œ ๋ณต๊ตฌ ๋Œ€์ฑ…์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์žฌํ•ด ๋ณต๊ตฌ ๊ด€๋ จ ์ง€์นจ์„œ ๋“ฑ์— IT ์„œ๋น„์Šค ๋˜๋Š” ์‹œ์Šคํ…œ์— ๋Œ€ํ•œ ๋ณต๊ตฌ ์šฐ์„ ์ˆœ์œ„, ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ๊ฐ„, ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ์  ๋“ฑ์ด ์ •์˜๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ํ˜„์‹ค์  ๋Œ€์ฑ… ์—†์ด ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ๊ฐ„์„ ๊ณผ๋„ ๋˜๋Š” ๊ณผ์†Œํ•˜๊ฒŒ ์„ค์ •ํ•˜๊ณ  ์žˆ๊ฑฐ๋‚˜, ๋ณต๊ตฌ ๋ชฉํ‘œ์‹œ์ ๊ณผ ๋ฐฑ์—…์ •์ฑ…(๋Œ€์ƒ, ์ฃผ๊ธฐ ๋“ฑ)์ด ์ ์ ˆํžˆ ์—ฐ๊ณ„๋˜์ง€ ์•Š์•„ ๋ณต๊ตฌ ํšจ๊ณผ์„ฑ์„ ๋ณด์žฅํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "2.12.2", + "Name": "์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๋ฐ ๊ฐœ์„ ", + "Description": "์žฌํ•ด ๋ณต๊ตฌ ์ „๋žต ๋ฐ ๋Œ€์ฑ…์˜ ์ ์ •์„ฑ์„ ์ •๊ธฐ์ ์œผ๋กœ ์‹œํ—˜ํ•˜์—ฌ ์‹œํ—˜๊ฒฐ๊ณผ, ์ •๋ณด์‹œ์Šคํ…œ ํ™˜๊ฒฝ๋ณ€ํ™”, ๋ฒ•๊ทœ ๋“ฑ์— ๋”ฐ๋ฅธ ๋ณ€ํ™”๋ฅผ ๋ฐ˜์˜ํ•˜์—ฌ ๋ณต๊ตฌ์ „๋žต ๋ฐ ๋Œ€์ฑ…์„ ๋ณด์™„ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "kms_cmk_not_deleted_unintentionally", + "s3_bucket_lifecycle_enabled", + "s3_bucket_object_versioning", + "s3_bucket_cross_region_replication", + "s3_bucket_object_lock", + "documentdb_cluster_backup_enabled", + "documentdb_cluster_cloudwatch_log_export", + "lightsail_instance_automated_snapshots", + "neptune_cluster_multi_az", + "neptune_cluster_deletion_protection", + "dynamodb_tables_pitr_enabled", + "elb_is_in_multiple_az", + "elb_cross_zone_load_balancing_enabled", + "redshift_cluster_automated_snapshot", + "drs_job_exist", + "dlm_ebs_snapshot_lifecycle_policy_exists", + "vpc_subnet_different_az", + "vpc_different_regions", + "dms_instance_multi_az_enabled", + "autoscaling_group_multiple_az", + "elbv2_is_in_multiple_az", + "elbv2_deletion_protection", + "backup_reportplans_exist", + "backup_plans_exist", + "elasticache_redis_cluster_backup_enabled", + "elasticache_redis_cluster_multi_az_enabled", + "rds_instance_multi_az", + "rds_instance_deletion_protection", + "rds_cluster_deletion_protection", + "rds_cluster_multi_az", + "rds_instance_backup_enabled", + "efs_have_backup_enabled", + "ec2_ebs_volume_snapshots_exists" + ], + "Attributes": [ + { + "Domain": "2. ๋ณดํ˜ธ๋Œ€์ฑ… ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "2.12. ์žฌํ•ด ๋ณต๊ตฌ", + "Section": "2.12.2 ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๋ฐ ๊ฐœ์„ ", + "AuditChecklist": [ + "์ˆ˜๋ฆฝ๋œ IT ์žฌํ•ด ๋ณต๊ตฌ์ฒด๊ณ„์˜ ์‹คํšจ์„ฑ์„ ํŒ๋‹จํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜๊ณ„ํš์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์‹œํ—˜๊ฒฐ๊ณผ, ์ •๋ณด์‹œ์Šคํ…œ ํ™˜๊ฒฝ๋ณ€ํ™”, ๋ฒ•๋ฅ  ๋“ฑ์— ๋”ฐ๋ฅธ ๋ณ€ํ™”๋ฅผ ๋ฐ˜์˜ํ•  ์ˆ˜ ์žˆ๋„๋ก ๋ณต๊ตฌ์ „๋žต ๋ฐ ๋Œ€์ฑ…์„ ์ •๊ธฐ์ ์œผ๋กœ ๊ฒ€ํ† ยท๋ณด์™„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [], + "AuditEvidence": [ + "IT ์žฌํ•ด ๋ณต๊ตฌ ์ ˆ์ฐจ์„œ", + "IT ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๊ณ„ํš์„œ", + "IT ์žฌํ•ด ๋ณต๊ตฌ ์‹œํ—˜ ๊ฒฐ๊ณผ์„œ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์žฌํ•ด ๋ณต๊ตฌ ํ›ˆ๋ จ์„ ๊ณ„ํšยท์‹œํ–‰ํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜ ๊ด€๋ จ ๊ณ„ํš์„œ ๋ฐ ๊ฒฐ๊ณผ๋ณด๊ณ ์„œ๊ฐ€ ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์žฌํ•ด ๋ณต๊ตฌ ํ›ˆ๋ จ ๊ณ„ํš์„ ์ˆ˜๋ฆฝํ•˜์˜€์œผ๋‚˜, ํƒ€๋‹นํ•œ ์‚ฌ์œ  ๋˜๋Š” ์Šน์ธ ์—†์ด ๊ณ„ํš๋Œ€๋กœ ์‹ค์‹œํ•˜์ง€ ์•Š์•˜๊ฑฐ๋‚˜ ๊ด€๋ จ ๊ฒฐ๊ณผ๋ณด๊ณ ๊ฐ€ ํ™•์ธ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์žฌํ•ด ๋ณต๊ตฌ ํ›ˆ๋ จ์„ ๊ณ„ํšํ•˜์—ฌ ์‹ค์‹œํ•˜์˜€์œผ๋‚˜, ๋‚ด๋ถ€ ๊ด€๋ จ ์ง€์นจ์— ์ •ํ•œ ์ ˆ์ฐจ ๋ฐ ์„œ์‹์— ๋”ฐ๋ผ ์ดํ–‰๋˜์ง€ ์•Š์•„ ์ˆ˜๋ฆฝํ•œ ์žฌํ•ด ๋ณต๊ตฌ ์ ˆ์ฐจ์˜ ์ ์ •์„ฑ ๋ฐ ํšจ๊ณผ์„ฑ์„ ํ‰๊ฐ€ํ•˜๊ธฐ ์œ„ํ•œ ํ›ˆ๋ จ์œผ๋กœ ๋ณด๊ธฐ ์–ด๋ ค์šด ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.1.1", + "Name": "๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉ", + "Description": "๊ฐœ์ธ์ •๋ณด๋Š” ์ ๋ฒ•ํ•˜๊ณ  ์ •๋‹นํ•˜๊ฒŒ ์ˆ˜์ง‘ยท์ด์šฉํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜๋ฅผ ๊ทผ๊ฑฐ๋กœ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ์—๋Š” ์ ๋ฒ•ํ•œ ๋ฐฉ๋ฒ•์œผ๋กœ ์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜๋ฅผ ๋ฐ›์•„์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ์—๋Š” ๊ทธ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์˜ ๋™์˜๋ฅผ ๋ฐ›์•„์•ผ ํ•˜๋ฉฐ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์ด ๋™์˜ํ•˜์˜€๋Š”์ง€๋ฅผ ํ™•์ธํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.1 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด ๋™์˜, ๋ฒ•๋ น์ƒ ์˜๋ฌด์ค€์ˆ˜, ๊ณ„์•ฝ ์ฒด๊ฒฐยท์ดํ–‰ ๋“ฑ ์ ๋ฒ• ์š”๊ฑด์— ๋”ฐ๋ผ ์ˆ˜์ง‘ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ๋™์˜๋ฐฉ๋ฒ• ๋ฐ ์‹œ์ ์€ ์ ์ ˆํ•˜๊ฒŒ ๋˜์–ด ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ๊ด€๋ จ ๋‚ด์šฉ์„ ๋ช…ํ™•ํ•˜๊ฒŒ ๊ณ ์ง€ํ•˜๊ณ  ๋ฒ•๋ น์—์„œ ์ •ํ•œ ์ค‘์š”ํ•œ ๋‚ด์šฉ์— ๋Œ€ํ•ด ์•Œ์•„๋ณด๊ธฐ ์‰ฝ๊ฒŒ ํ‘œ์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•ด ์ˆ˜์ง‘ยท์ด์šฉยท์ œ๊ณต ๋“ฑ์˜ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์—๊ฒŒ ํ•„์š”ํ•œ ์‚ฌํ•ญ์— ๋Œ€ํ•˜์—ฌ ๊ณ ์ง€ํ•˜๊ณ  ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฒ•์ •๋Œ€๋ฆฌ์ธ์˜ ๋™์˜๋ฅผ ๋ฐ›๊ธฐ ์œ„ํ•˜์—ฌ ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ๊ฐœ์ธ์ •๋ณด๋งŒ์„ ์ˆ˜์ง‘ํ•˜๊ณ  ์žˆ์œผ๋ฉฐ, ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์ด ์ž๊ฒฉ ์š”๊ฑด์„ ๊ฐ–์ถ”๊ณ  ์žˆ๋Š”์ง€ ํ™•์ธํ•˜๋Š” ์ ˆ์ฐจ์™€ ๋ฐฉ๋ฒ•์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋งŒ 14์„ธ ๋ฏธ๋งŒ์˜ ์•„๋™์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์™€ ๊ด€๋ จํ•œ ์‚ฌํ•ญ ๋“ฑ์˜ ๊ณ ์ง€ ์‹œ ์ดํ•ดํ•˜๊ธฐ ์‰ฌ์šด ์–‘์‹๊ณผ ๋ช…ํ™•ํ•˜๊ณ  ์•Œ๊ธฐ ์‰ฌ์šด ์–ธ์–ด๋กœ ํ‘œํ˜„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด ๋ฐ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์—๊ฒŒ ๋™์˜๋ฅผ ๋ฐ›์€ ๊ธฐ๋ก์„ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜ ์—†์ด ์ฒ˜๋ฆฌํ•  ์ˆ˜ ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•ด์„œ๋Š” ๊ทธ ํ•ญ๋ชฉ๊ณผ ์ฒ˜๋ฆฌ์˜ ๋ฒ•์  ๊ทผ๊ฑฐ๋ฅผ ์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜๋ฅผ ๋ฐ›์•„ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์™€ ๊ตฌ๋ถ„ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๊ฑฐ๋‚˜ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜ ์—†์ด ๊ฐœ์ธ์ •๋ณด์˜ ์ถ”๊ฐ€์ ์ธ ์ด์šฉ ์‹œ ๋‹น์ดˆ ์ˆ˜์ง‘ ๋ชฉ์ ๊ณผ์˜ ๊ด€๋ จ์„ฑ, ์˜ˆ์ธก ๊ฐ€๋Šฅ์„ฑ, ์ด์ต ์นจํ•ด ์—ฌ๋ถ€, ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๋“ฑ์˜ ๊ณ ๋ ค์‚ฌํ•ญ์— ๋Œ€ํ•œ ํŒ๋‹จ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ , ์ถ”๊ฐ€์ ์ธ ์ด์šฉ์ด ์ง€์†์ ์œผ๋กœ ๋ฐœ์ƒํ•˜๋Š” ๊ฒฝ์šฐ ๊ณ ๋ ค์‚ฌํ•ญ์— ๋Œ€ํ•œ ํŒ๋‹จ๊ธฐ์ค€์„ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๊ณ  ์ด๋ฅผ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ15์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘ยท์ด์šฉ), ์ œ22์กฐ(๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ฐฉ๋ฒ•), ์ œ22์กฐ์˜2(์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ)", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋ฐฉ๋ฒ•์— ๊ด€ํ•œ ๊ณ ์‹œ" + ], + "AuditEvidence": [ + "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ๋ชจ๋ฐ”์ผ์•ฑ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ์ด๋ฒคํŠธ ์ฐธ์—ฌ ๋“ฑ)", + "์˜คํ”„๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํšŒ์›๊ฐ€์ž…์‹ ์ฒญ์„œ ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ๋™์˜ ๊ธฐ๋ก(ํšŒ์› ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋“ฑ)", + "๋ฒ•์ •๋Œ€๋ฆฌ์ธ ๋™์˜ ๊ธฐ๋ก", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ•์„ ์ ์šฉ๋ฐ›๋Š” ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๊ฐ€ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ๋™์˜ ์‹œ ๊ณ ์ง€ ์‚ฌํ•ญ์— สป๋™์˜ ๊ฑฐ๋ถ€ ๊ถŒ๋ฆฌ ๋ฐ ๋™์˜ ๊ฑฐ๋ถ€์— ๋”ฐ๋ฅธ ๋ถˆ์ด์ต ๋‚ด์šฉสผ์„ ๋ˆ„๋ฝํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ๋™์˜ ์‹œ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์„ ๊ตฌ์ฒด์ ์œผ๋กœ ๋ช…์‹œํ•˜์ง€ ์•Š๊ณ  สป~ ๋“ฑสผ๊ณผ ๊ฐ™์ด ํฌ๊ด„์ ์œผ๋กœ ์•ˆ๋‚ดํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์‡ผํ•‘๋ชฐ ํ™ˆํŽ˜์ด์ง€์—์„œ ํšŒ์›๊ฐ€์ž… ์‹œ ํšŒ์›๊ฐ€์ž…์— ํ•„์š”ํ•œ ๊ฐœ์ธ์ •๋ณด ์™ธ์— ์ถ”ํ›„ ๋ฌผํ’ˆ ๊ตฌ๋งค ์‹œ ํ•„์š”ํ•œ ๊ฒฐ์ œยท๋ฐฐ์†ก ์ •๋ณด๋ฅผ ๋ฏธ๋ฆฌ ํ•„์ˆ˜ ํ•ญ๋ชฉ์œผ๋กœ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : Q&A, ๊ฒŒ์‹œํŒ์„ ํ†ตํ•˜์—ฌ ๋น„ํšŒ์›์˜ ๊ฐœ์ธ์ •๋ณด(์ด๋ฆ„, ์ด๋ฉ”์ผ, ํœด๋Œ€ํฐ๋ฒˆํ˜ธ)๋ฅผ ์ˆ˜์ง‘ํ•˜๋ฉด์„œ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ๋™์˜ ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋ฉด์„œ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์˜ ๋™์˜๋ฅผ ๋ฐ›์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™์— ๋Œ€ํ•˜์—ฌ ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•˜๊ณ  ์žˆ์ง€ ์•Š์ง€๋งŒ, ํšŒ์›๊ฐ€์ž… ๋‹จ๊ณ„์—์„œ ์ž…๋ ฅ๋ฐ›๋Š” ์ƒ๋…„์›”์ผ์„ ํ†ตํ•˜์—ฌ ๋‚˜์ด ์ฒดํฌ๋ฅผ ํ•˜์ง€ ์•Š์•„ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ ๋™์˜ ์—†์ด ๊ฐ€์ž…๋œ ๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™ ํšŒ์›์ด ์กด์žฌํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 7 : ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์˜ ์ง„์œ„ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๋Š” ์ ˆ์ฐจ๊ฐ€ ๋ฏธํกํ•˜์—ฌ ๋ฏธ์„ฑ๋…„์ž ๋“ฑ ์•„๋™์˜ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์œผ๋กœ ๋ณด๊ธฐ ์–ด๋ ค์šด๋ฐ๋„ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ ๋™์˜๊ฐ€ ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 8 : ๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™์œผ๋กœ๋ถ€ํ„ฐ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ชฉ์ ์œผ๋กœ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์˜ ๊ฐœ์ธ์ •๋ณด(์ด๋ฆ„, ํœด๋Œ€ํฐ๋ฒˆํ˜ธ)๋ฅผ ์ˆ˜์ง‘ํ•œ ์ดํ›„ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ์˜ ๋™์˜๊ฐ€ ์žฅ๊ธฐ๊ฐ„ ํ™•์ธ๋˜์ง€ ์•Š์•˜์Œ์—๋„ ์ด๋ฅผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ๊ณ„์† ๋ณด์œ ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 9 : ๋ฒ•์ •๋Œ€๋ฆฌ์ธ ๋™์˜์— ๊ทผ๊ฑฐํ•˜์—ฌ ๋งŒ 14์„ธ ๋ฏธ๋งŒ ์•„๋™์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜์˜€์œผ๋‚˜, ๊ด€๋ จ ๊ธฐ๋ก์„ ๋ณด์กดํ•˜์ง€ ์•Š์•„ ๋ฒ•์ •๋Œ€๋ฆฌ์ธ ๋™์˜์™€ ๊ด€๋ จ๋œ ์‚ฌํ•ญ(๋ฒ•์ •๋Œ€๋ฆฌ์ธ ์ด๋ฆ„, ๋™์˜ ์ผ์‹œ ๋“ฑ)์„ ํ™•์ธํ•  ์ˆ˜ ์—†๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.1.2", + "Name": "๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์ œํ•œ", + "Description": "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ์ฒ˜๋ฆฌ ๋ชฉ์ ์— ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ๊ฐœ์ธ์ •๋ณด๋งŒ์„ ์ˆ˜์ง‘ํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์„ ํƒ์ ์œผ๋กœ ๋™์˜ํ•  ์ˆ˜ ์žˆ๋Š” ์‚ฌํ•ญ ๋“ฑ์— ๋™์˜ํ•˜์ง€ ์•„๋‹ˆํ•œ๋‹ค๋Š” ์ด์œ ๋กœ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค์˜ ์ œ๊ณต์„ ๊ฑฐ๋ถ€ํ•˜์ง€ ์•Š์•„์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.2 ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์ œํ•œ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ๋ชฉ์ ์— ํ•„์š”ํ•œ ๋ฒ”์œ„์—์„œ ์ตœ์†Œํ•œ์˜ ์ •๋ณด๋งŒ์„ ์ˆ˜์ง‘ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜๋ฅผ ๋ฐ›์•„ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ์ •๋ณด ์™ธ์˜ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘์—๋Š” ๋™์˜ํ•˜์ง€ ์•Š์„ ์ˆ˜ ์žˆ๋‹ค๋Š” ์‚ฌ์‹ค์„ ๊ตฌ์ฒด์ ์œผ๋กœ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด๊ฐ€ ์ˆ˜์ง‘ ๋ชฉ์ ์— ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ์ •๋ณด ์ด์™ธ์˜ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘์— ๋™์˜ํ•˜์ง€ ์•Š๋Š”๋‹ค๋Š” ์ด์œ ๋กœ ์„œ๋น„์Šค ๋˜๋Š” ์žฌํ™”์˜ ์ œ๊ณต์„ ๊ฑฐ๋ถ€ํ•˜์ง€ ์•Š๋„๋ก ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ16์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘์ œํ•œ), ์ œ22์กฐ(๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ฐฉ๋ฒ•)" + ], + "AuditEvidence": [ + "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ์ด๋ฒคํŠธ ์ฐธ์—ฌ ํ™”๋ฉด ๋“ฑ)", + "์˜คํ”„๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(๋ฉค๋ฒ„์‹ญ ๊ฐ€์ž…์‹ ์ฒญ์„œ ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ณ„์•ฝ์˜ ์ฒด๊ฒฐ ๋ฐ ์ดํ–‰์„ ๊ทผ๊ฑฐ๋กœ ์ •๋ณด์ฃผ์ฒด ๋™์˜ ์—†์ด ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋ฉด์„œ ๊ณ„์•ฝ์˜ ์ฒด๊ฒฐ ๋ฐ ์ดํ–‰์„ ์œ„ํ•ด ๋ฐ˜๋“œ์‹œ ํ•„์š”ํ•˜์ง€ ์•Š์€ ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ๊นŒ์ง€ ๊ณผ๋„ํ•˜๊ฒŒ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด์ฃผ์ฒด๋กœ๋ถ€ํ„ฐ ์„ ํƒ์‚ฌํ•ญ์— ๋Œ€ํ•œ ๋™์˜๋ฅผ ๋ฐ›์œผ๋ฉด์„œ ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘์—๋Š” ๋™์˜ํ•˜์ง€ ์•„๋‹ˆํ•  ์ˆ˜ ์žˆ๋‹ค๋Š” ์‚ฌ์‹ค์„ ๊ตฌ์ฒด์ ์œผ๋กœ ์•Œ๋ฆฌ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ํšŒ์›๊ฐ€์ž… ์–‘์‹์—์„œ ํ•„์ˆ˜์™€ ์„ ํƒ ์ •๋ณด๋ฅผ ๊ตฌ๋ถ„ํ•˜์—ฌ ๋ณ„๋„ ๋™์˜๋ฅผ ๋ฐ›๋„๋ก ๋˜์–ด ์žˆ์—ˆ์œผ๋‚˜, ์„ ํƒ์ •๋ณด์— ๋Œ€ํ•˜์—ฌ ๋™์˜ํ•˜์ง€ ์•Š์•„๋„ ํšŒ์›๊ฐ€์ž…์ด ๊ฐ€๋Šฅํ•จ์„ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ตฌ์ฒด์ ์œผ๋กœ ์•Œ๋ฆฌ์ง€ ์•Š์€ ๊ฒฝ์šฐ(๊ฐœ์ธ์ •๋ณด ์ž…๋ ฅ ์–‘์‹์— ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ๋ณ„๋กœ ํ•„์ˆ˜, ์„ ํƒ ์—ฌ๋ถ€๊ฐ€ ํ‘œ์‹œ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ ๋“ฑ)", + "์‚ฌ๋ก€ 4 : ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด์—์„œ ์„ ํƒ์‚ฌํ•ญ์— ๋Œ€ํ•˜์—ฌ ๋™์˜ํ•˜์ง€ ์•Š๊ฑฐ๋‚˜ ์„ ํƒ์ •๋ณด๋ฅผ ์ž…๋ ฅํ•˜์ง€ ์•Š์œผ๋ฉด ๋‹ค์Œ ๋‹จ๊ณ„๋กœ ๋„˜์–ด๊ฐ€์ง€ ์•Š๊ฑฐ๋‚˜ ํšŒ์›๊ฐ€์ž…์ด ์ฐจ๋‹จ๋˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ฑ„์šฉ ๊ณ„์•ฝ ์‹œ ์ฑ„์šฉ ์˜ˆ์ • ์ง๋ฌด์™€ ์ง์ ‘ ๊ด€๋ จ์ด ์—†๋Š” ๊ฐ€์กฑ์‚ฌํ•ญ ๋“ฑ ๊ณผ๋„ํ•œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.1.3", + "Name": "์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ฒ˜๋ฆฌ ์ œํ•œ", + "Description": "์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋Š” ๋ฒ•์  ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ๋ฅผ ์ œ์™ธํ•˜๊ณ ๋Š” ์ˆ˜์ง‘ยท์ด์šฉ ๋“ฑ ์ฒ˜๋ฆฌํ•  ์ˆ˜ ์—†์œผ๋ฉฐ, ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ์˜ ์ฒ˜๋ฆฌ๊ฐ€ ํ—ˆ์šฉ๋œ ๊ฒฝ์šฐ๋ผ ํ•˜๋”๋ผ๋„ ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๋“ฑ์—์„œ ๋Œ€์ฒด์ˆ˜๋‹จ์„ ์ œ๊ณตํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.3 ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ฒ˜๋ฆฌ ์ œํ•œ", + "AuditChecklist": [ + "์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋Š” ๋ช…ํ™•ํ•œ ๋ฒ•์  ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ์—๋งŒ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ์˜ ์ˆ˜์ง‘ ๊ทผ๊ฑฐ๊ฐ€ ๋˜๋Š” ๋ฒ•์กฐํ•ญ์„ ๊ตฌ์ฒด์ ์œผ๋กœ ์‹๋ณ„ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ฒ•์  ๊ทผ๊ฑฐ์— ๋”ฐ๋ผ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ์—๋„ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€๋ฅผ ํ†ตํ•˜์—ฌ ํšŒ์›์œผ๋กœ ๊ฐ€์ž…ํ•˜๋Š” ๋‹จ๊ณ„์—์„œ๋Š” ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ์•„๋‹ˆํ•˜๊ณ ๋„ ํšŒ์›์œผ๋กœ ๊ฐ€์ž…ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ24์กฐ์˜2(์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ฒ˜๋ฆฌ์˜ ์ œํ•œ)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ23์กฐ์˜2(์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ์˜ ์‚ฌ์šฉ ์ œํ•œ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ์ด๋ฒคํŠธ ์ฐธ์—ฌ, ๋ฉค๋ฒ„์‹ญ ๊ฐ€์ž…์‹ ์ฒญ์„œ ๋“ฑ)", + "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(๋ณธ์ธํ™•์ธ ๋“ฑ ๋Œ€์ฒด๊ฐ€์ž…์ˆ˜๋‹จ ์ œ๊ณต ํ™”๋ฉด)", + "์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ฒ˜๋ฆฌ ๊ทผ๊ฑฐ ์ฆ๊ฑฐ์ž๋ฃŒ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํ™ˆํŽ˜์ด์ง€ ๊ฐ€์ž…๊ณผ ๊ด€๋ จํ•˜์—ฌ ์‹ค๋ช…ํ™•์ธ ๋“ฑ ๋‹จ์ˆœ ํšŒ์›๊ด€๋ฆฌ ๋ชฉ์ ์„ ์œ„ํ•˜์—ฌ ์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜์— ๊ทผ๊ฑฐํ•˜์—ฌ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ˆ˜์ง‘ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณด์ฃผ์ฒด์˜ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์‹œํ–‰๊ทœ์น™์ด๋‚˜ ์ง€๋ฐฉ์ž์น˜๋‹จ์ฒด์˜ ์กฐ๋ก€์— ๊ทผ๊ฑฐํ•˜์—ฌ ์ˆ˜์ง‘ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋น„๋ฐ€๋ฒˆํ˜ธ ๋ถ„์‹ค ์‹œ ๋ณธ์ธํ™•์ธ ๋“ฑ์˜ ๋ชฉ์ ์œผ๋กœ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ๋’ค 6์ž๋ฆฌ๋ฅผ ์ˆ˜์ง‘ํ•˜์ง€๋งŒ, ๊ด€๋ จ๋œ ๋ฒ•์  ๊ทผ๊ฑฐ๊ฐ€ ์—†๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ฑ„์šฉ์ „ํ˜• ์ง„ํ–‰๋‹จ๊ณ„์—์„œ ๋ฒ•์  ๊ทผ๊ฑฐ ์—†์ด ์ž…์‚ฌ์ง€์›์ž์˜ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ˆ˜์ง‘ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ฝœ์„ผํ„ฐ์— ์ƒํ’ˆ, ์„œ๋น„์Šค ๊ด€๋ จ ๋ฌธ์˜ ์‹œ ๋ณธ์ธํ™•์ธ์„ ์œ„ํ•˜์—ฌ ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ˆ˜์ง‘ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ˆ˜์ง‘์˜ ๋ฒ•์  ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋‹ค๋Š” ์‚ฌ์œ ๋กœ ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ๋‹จ๊ณ„์—์„œ ๋Œ€์ฒด๊ฐ€์ž…์ˆ˜๋‹จ์„ ์ œ๊ณตํ•˜์ง€ ์•Š๊ณ  ์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ž…๋ ฅ๋ฐ›๋Š” ๋ณธ์ธํ™•์ธ ๋ฐ ํšŒ์›๊ฐ€์ž… ๋ฐฉ๋ฒ•๋งŒ์„ ์ œ๊ณตํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.1.4", + "Name": "๋ฏผ๊ฐ์ •๋ณด ๋ฐ ๊ณ ์œ ์‹๋ณ„์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ", + "Description": "๋ฏผ๊ฐ์ •๋ณด์™€ ๊ณ ์œ ์‹๋ณ„์ •๋ณด(์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ œ์™ธ)๋ฅผ ์ฒ˜๋ฆฌํ•˜๊ธฐ ์œ„ํ•ด์„œ๋Š” ๋ฒ•๋ น์—์„œ ๊ตฌ์ฒด์ ์œผ๋กœ ์ฒ˜๋ฆฌ๋ฅผ ์š”๊ตฌํ•˜๊ฑฐ๋‚˜ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ๋ฅผ ์ œ์™ธํ•˜๊ณ ๋Š” ์ •๋ณด์ฃผ์ฒด์˜ ๋ณ„๋„ ๋™์˜๋ฅผ ๋ฐ›์•„์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.4 ๋ฏผ๊ฐ์ •๋ณด ๋ฐ ๊ณ ์œ ์‹๋ณ„์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ", + "AuditChecklist": [ + "๋ฏผ๊ฐ์ •๋ณด๋Š” ์ •๋ณด์ฃผ์ฒด๋กœ๋ถ€ํ„ฐ ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜ ๊ด€๋ จ ๋ฒ•๋ น์— ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ์—๋งŒ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณ ์œ ์‹๋ณ„์ •๋ณด(์ฃผ๋ฏผ๋“ฑ๋ก๋ฒˆํ˜ธ ์ œ์™ธ)๋Š” ์ •๋ณด์ฃผ์ฒด๋กœ๋ถ€ํ„ฐ ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜ ๊ด€๋ จ ๋ฒ•๋ น์— ๊ตฌ์ฒด์ ์ธ ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ์—๋งŒ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•˜๋Š” ๊ณผ์ •์—์„œ ๊ณต๊ฐœ๋˜๋Š” ์ •๋ณด์— ์ •๋ณด์ฃผ์ฒด์˜ ๋ฏผ๊ฐ์ •๋ณด๊ฐ€ ํฌํ•จ๋จ์œผ๋กœ์จ ์‚ฌ์ƒํ™œ ์นจํ•ด์˜ ์œ„ํ—˜์„ฑ์ด ์žˆ๋‹ค๊ณ  ํŒ๋‹จํ•˜๋Š” ๋•Œ์—๋Š” ์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค์˜ ์ œ๊ณต ์ „์— ๋ฏผ๊ฐ์ •๋ณด์˜ ๊ณต๊ฐœ ๊ฐ€๋Šฅ์„ฑ ๋ฐ ๋น„๊ณต๊ฐœ๋ฅผ ์„ ํƒํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์•Œ์•„๋ณด๊ธฐ ์‰ฝ๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ23์กฐ(๋ฏผ๊ฐ์ •๋ณด์˜ ์ฒ˜๋ฆฌ์ œํ•œ), ์ œ24์กฐ(๊ณ ์œ ์‹๋ณ„์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ)" + ], + "AuditEvidence": [ + "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ์ด๋ฒคํŠธ ์ฐธ์—ฌ ๋“ฑ)", + "์˜คํ”„๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํšŒ์›๊ฐ€์ž…์‹ ์ฒญ์„œ ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์žฅ์• ์ธ์— ๋Œ€ํ•œ ์š”๊ธˆ๊ฐ๋ฉด ๋“ฑ ํ˜œํƒ ๋ถ€์—ฌ๋ฅผ ์œ„ํ•˜์—ฌ ์žฅ์•  ์—ฌ๋ถ€ ๋“ฑ ๊ฑด๊ฐ•์— ๊ด€ํ•œ ๋ฏผ๊ฐ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋ฉด์„œ ๋‹ค๋ฅธ ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์— ํฌํ•จํ•˜์—ฌ ์ผ๊ด„ ๋™์˜๋ฅผ ๋ฐ›์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ํšŒ์›๊ฐ€์ž… ์‹œ ์™ธ๊ตญ์ธ์— ํ•œํ•˜์—ฌ ์™ธ๊ตญ์ธ๋“ฑ๋ก๋ฒˆํ˜ธ๋ฅผ ์ˆ˜์ง‘ํ•˜๋ฉด์„œ ๋‹ค๋ฅธ ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์— ํฌํ•จํ•˜์—ฌ ์ผ๊ด„ ๋™์˜๋ฅผ ๋ฐ›์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ฏผ๊ฐ์ •๋ณด ๋˜๋Š” ๊ณ ์œ ์‹๋ณ„์ •๋ณด์˜ ์ˆ˜์ง‘์— ๋Œ€ํ•ด ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›์œผ๋ฉด์„œ ๊ณ ์ง€ํ•˜์—ฌ์•ผ ํ•  4๊ฐ€์ง€ ์‚ฌํ•ญ ์ค‘์— ์ผ๋ถ€๋ฅผ ๋ˆ„๋ฝํ•˜๊ฑฐ๋‚˜ ์ž˜๋ชป๋œ ๋‚ด์šฉ์œผ๋กœ ๊ณ ์ง€ํ•˜๋Š” ๊ฒฝ์šฐ(๋™์˜ ๊ฑฐ๋ถ€ ๊ถŒ๋ฆฌ ๋ฐ ๋™์˜ ๊ฑฐ๋ถ€์— ๋”ฐ๋ฅธ ๋ถˆ์ด์ต ์‚ฌํ•ญ์„ ๊ณ ์ง€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ ๋“ฑ)" + ] + } + ] + }, + { + "Id": "3.1.5", + "Name": "๊ฐœ์ธ์ •๋ณด ๊ฐ„์ ‘์ˆ˜์ง‘", + "Description": "์ •๋ณด์ฃผ์ฒด ์ด์™ธ๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๊ฑฐ๋‚˜ ์ œ3์ž๋กœ๋ถ€ํ„ฐ ์ œ๊ณต๋ฐ›๋Š” ๊ฒฝ์šฐ์—๋Š” ์—…๋ฌด์— ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๊ฑฐ๋‚˜ ์ œ๊ณต๋ฐ›์•„์•ผ ํ•˜๋ฉฐ, ๋ฒ•๋ น์— ๊ทผ๊ฑฐํ•˜๊ฑฐ๋‚˜ ์ •๋ณด์ฃผ์ฒด์˜ ์š”๊ตฌ๊ฐ€ ์žˆ์œผ๋ฉด ๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘ ์ถœ์ฒ˜, ์ฒ˜๋ฆฌ๋ชฉ์ , ์ฒ˜๋ฆฌ์ •์ง€์˜ ์š”๊ตฌ๊ถŒ๋ฆฌ๋ฅผ ์•Œ๋ ค์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.5 ๊ฐœ์ธ์ •๋ณด ๊ฐ„์ ‘์ˆ˜์ง‘", + "AuditChecklist": [ + "์ •๋ณด์ฃผ์ฒด ์ด์™ธ์˜ ์ œ3์ž๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต๋ฐ›๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘์— ๋Œ€ํ•œ ๋™์˜ํš๋“ ์ฑ…์ž„์ด ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณตํ•˜๋Š” ์ž์—๊ฒŒ ์žˆ์Œ์„ ๊ณ„์•ฝ์„ ํ†ตํ•˜์—ฌ ๋ช…์‹œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ฐœ๋œ ๋งค์ฒด ๋ฐ ์žฅ์†Œ์—์„œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด์˜ ๊ณต๊ฐœ ๋ชฉ์ ยท๋ฒ”์œ„ ๋ฐ ์‚ฌํšŒ ํ†ต๋…์ƒ ๋™์˜ ์˜์‚ฌ๊ฐ€ ์žˆ๋‹ค๊ณ  ์ธ์ •๋˜๋Š” ๋ฒ”์œ„ ๋‚ด์—์„œ๋งŒ ์ˆ˜์ง‘ยท์ด์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์„œ๋น„์Šค ๊ณ„์•ฝ ์ดํ–‰์„ ์œ„ํ•ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ๋กœ์„œ, ์„œ๋น„์Šค ์ œ๊ณต ๊ณผ์ •์—์„œ ์ž๋™์ˆ˜์ง‘์žฅ์น˜ ๋“ฑ์— ์˜ํ•˜์—ฌ ์ˆ˜์ง‘ยท์ƒ์„ฑํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์˜ ๊ฒฝ์šฐ์—๋„ ์ตœ์†Œ์ˆ˜์ง‘ ์›์น™์„ ์ ์šฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด ์ด์™ธ๋กœ๋ถ€ํ„ฐ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•ด ์ •๋ณด์ฃผ์ฒด์˜ ์š”๊ตฌ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ ์ฆ‰์‹œ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด ์ด์™ธ๋กœ๋ถ€ํ„ฐ ์ˆ˜์ง‘ํ•œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด์˜ ์ข…๋ฅ˜ยท๊ทœ๋ชจ ๋“ฑ์ด ๋ฒ•์  ์š”๊ฑด์— ํ•ด๋‹นํ•˜๋Š” ๊ฒฝ์šฐ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์ˆ˜์ง‘ ์ถœ์ฒ˜์— ๋Œ€ํ•ด ์•Œ๋ฆฐ ๊ธฐ๋ก์„ ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ ์‹œ๊นŒ์ง€ ๋ณด๊ด€ ๋ฐ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ16์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘ ์ œํ•œ), ์ œ19์กฐ(๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต๋ฐ›์€ ์ž์˜ ์ด์šฉยท์ œ๊ณต ์ œํ•œ), ์ œ20์กฐ(์ •๋ณด์ฃผ์ฒด ์ด์™ธ๋กœ๋ถ€ํ„ฐ ์ˆ˜์ง‘ํ•œ ๊ฐœ์ธ์ •๋ณด์˜ ์ˆ˜์ง‘ ์ถœ์ฒ˜ ๋“ฑ ํ†ต์ง€)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ๊ด€๋ จ ๊ณ„์•ฝ์„œ(์ œ๊ณตํ•˜๋Š” ์ž์™€์˜ ๊ณ„์•ฝ ์‚ฌํ•ญ)", + "๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘์ถœ์ฒ˜์— ๋Œ€ํ•œ ์ •๋ณด์ฃผ์ฒด ํ†ต์ง€ ๋‚ด์—ญ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€, SNS์— ๊ณต๊ฐœ๋œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๊ณ  ์žˆ๋Š” ์ƒํƒœ์—์„œ ์ •๋ณด์ฃผ์ฒด์˜ ์ˆ˜์ง‘ ์ถœ์ฒ˜ ์š”๊ตฌ์— ๋Œ€ํ•œ ์ฒ˜๋ฆฌ์ ˆ์ฐจ๊ฐ€ ์กด์žฌํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ17์กฐ์ œ1ํ•ญ์ œ1ํ˜ธ์— ๋”ฐ๋ผ ๋‹ค๋ฅธ ์‚ฌ์—…์ž๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต๋™์˜๋ฅผ ๊ทผ๊ฑฐ๋กœ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต๋ฐ›์•˜์œผ๋‚˜, ์ด์— ๋Œ€ํ•˜์—ฌ ํ•ด๋‹น ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ 3๊ฐœ์›” ๋‚ด์— ํ†ต์ง€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ(๋‹ค๋งŒ ์ œ๊ณต๋ฐ›์€ ์ž๊ฐ€ 5๋งŒ ๋ช… ์ด์ƒ ์ •๋ณด์ฃผ์ฒด์˜ ๋ฏผ๊ฐ์ •๋ณด ๋˜๋Š” ๊ณ ์œ ์‹๋ณ„์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๊ฑฐ๋‚˜ 100๋งŒ ๋ช… ์ด์ƒ ์ •๋ณด์ฃผ์ฒด์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ)", + "์‚ฌ๋ก€ 3 : ๋ฒ•์  ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹น๋˜์–ด ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์ถœ์ฒ˜๋ฅผ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ํ†ต์ง€ํ•˜๋ฉด์„œ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ๋ชฉ์  ๋˜๋Š” ๋™์˜๋ฅผ ์ฒ ํšŒํ•  ๊ถŒ๋ฆฌ๊ฐ€ ์žˆ๋‹ค๋Š” ์‚ฌ์‹ค ๋“ฑ ํ•„์ˆ˜ ํ†ต์ง€์‚ฌํ•ญ์„ ์ผ๋ถ€ ๋ˆ„๋ฝํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋ฒ•์  ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹น๋˜์–ด ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์ถœ์ฒ˜๋ฅผ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ํ†ต์ง€ํ•˜์˜€์œผ๋‚˜, ์ˆ˜์ง‘ ์ถœ์ฒ˜ ํ†ต์ง€์— ๊ด€ํ•œ ๊ธฐ๋ก์„ ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ ์‹œ๊นŒ์ง€ ๋ณด๊ด€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.1.6", + "Name": "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์„ค์น˜ยท์šด์˜", + "Description": "๊ณ ์ •ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ๊ณต๊ฐœ๋œ ์žฅ์†Œ์— ์„ค์น˜ยท์šด์˜ํ•˜๊ฑฐ๋‚˜ ์ด๋™ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ๊ณต๊ฐœ๋œ ์žฅ์†Œ์—์„œ ์—…๋ฌด๋ฅผ ๋ชฉ์ ์œผ๋กœ ์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ์„ค์น˜ ๋ชฉ์  ๋ฐ ์œ„์น˜์— ๋”ฐ๋ผ ๋ฒ•์  ์š”๊ตฌ์‚ฌํ•ญ์„ ์ค€์ˆ˜ํ•˜๊ณ , ์ ์ ˆํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.6 ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์„ค์น˜ยท์šด์˜", + "AuditChecklist": [ + "๊ณต๊ฐœ๋œ ์žฅ์†Œ์— ๊ณ ์ •ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ์„ค์น˜ยท์šด์˜ํ•  ๊ฒฝ์šฐ ๋ฒ•์  ํ—ˆ์šฉ ์š”๊ฑด์— ํ•ด๋‹นํ•˜๋Š”์ง€๋ฅผ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ณต๊ธฐ๊ด€ ๋“ฑ์ด ๊ณต๊ฐœ๋œ ์žฅ์†Œ์— ๊ณ ์ •ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ์„ค์น˜ยท์šด์˜ํ•˜๋ ค๋Š” ๊ฒฝ์šฐ ๊ณต์ฒญํšŒยท์„ค๋ช…ํšŒ ๊ฐœ์ตœ ๋“ฑ์˜ ๋ฒ•๋ น์— ๋”ฐ๋ฅธ ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์ณ ๊ด€๊ณ„ ์ „๋ฌธ๊ฐ€ ๋ฐ ์ดํ•ด๊ด€๊ณ„์ž์˜ ์˜๊ฒฌ์„ ์ˆ˜๋ ดํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณ ์ •ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์„ค์น˜ยท์šด์˜ ์‹œ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์‰ฝ๊ฒŒ ์ธ์‹ํ•  ์ˆ˜ ์žˆ๋„๋ก ์•ˆ๋‚ดํŒ ์„ค์น˜ ๋“ฑ ํ•„์š”ํ•œ ์กฐ์น˜๋ฅผ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด๋ฅผ ๋ชฉ์ ์œผ๋กœ ๊ณต๊ฐœ๋œ ์žฅ์†Œ์—์„œ ์ด๋™ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ์šด์˜ํ•˜๋Š” ๊ฒฝ์šฐ ๋ฒ•์  ํ—ˆ์šฉ ์š”๊ฑด์— ํ•ด๋‹นํ•˜๋Š”์ง€๋ฅผ ๊ฒ€ํ† ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์—…๋ฌด๋ฅผ ๋ชฉ์ ์œผ๋กœ ๊ณต๊ฐœ๋œ ์žฅ์†Œ์—์„œ ์ด๋™ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋กœ ์‚ฌ๋žŒ ๋˜๋Š” ๊ทธ ์‚ฌ๋žŒ๊ณผ ๊ด€๋ จ๋œ ์‚ฌ๋ฌผ์˜ ์˜์ƒ์„ ์ดฌ์˜ํ•˜๋Š” ๊ฒฝ์šฐ ๋ถˆ๋น›, ์†Œ๋ฆฌ, ์•ˆ๋‚ดํŒ ๋“ฑ์˜ ๋ฐฉ๋ฒ•์œผ๋กœ ์ดฌ์˜ ์‚ฌ์‹ค์„ ํ‘œ์‹œํ•˜๊ณ  ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ๋ฐ ์˜์ƒ์ •๋ณด์˜ ์•ˆ์ „ํ•œ ๊ด€๋ฆฌ๋ฅผ ์œ„ํ•œ ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์šด์˜ยท๊ด€๋ฆฌ ๋ฐฉ์นจ์„ ๋งˆ๋ จํ•˜์—ฌ ์‹œํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์˜์ƒ์ •๋ณด์˜ ๋ณด๊ด€ ๊ธฐ๊ฐ„์„ ์ •ํ•˜๊ณ  ์žˆ์œผ๋ฉฐ, ๋ณด๊ด€ ๊ธฐ๊ฐ„ ๋งŒ๋ฃŒ ์‹œ ์ง€์ฒด ์—†์ด ํŒŒ๊ธฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์„ค์น˜ยท์šด์˜์— ๊ด€ํ•œ ์‚ฌ๋ฌด๋ฅผ ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ ๊ด€๋ จ ์ ˆ์ฐจ ๋ฐ ์š”๊ฑด์— ๋”ฐ๋ผ ๊ณ„์•ฝ์„œ์— ๋ฐ˜์˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ25์กฐ(๊ณ ์ •ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ์˜ ์„ค์น˜ยท์šด์˜ ์ œํ•œ), ์ œ25์กฐ์˜2(์ด๋™ํ˜• ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ์˜ ์šด์˜ ์ œํ•œ)" + ], + "AuditEvidence": [ + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์šด์˜ ํ˜„ํ™ฉ", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์•ˆ๋‚ดํŒ", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์šด์˜ยท๊ด€๋ฆฌ๋ฐฉ์นจ", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ๊ด€๋ฆฌํ™”๋ฉด(๊ณ„์ •ยท๊ถŒํ•œ ๋‚ด์—ญ, ์˜์ƒ์ •๋ณด ๋ณด์กด๊ธฐ๊ฐ„ ๋“ฑ)", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์šด์˜ ์ˆ˜ํƒ์ž์™€์˜ ๊ณ„์•ฝ์„œ ๋ฐ ์ ๊ฒ€ ์ด๋ ฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์•ˆ๋‚ดํŒ์˜ ๊ณ ์ง€ ๋ฌธ๊ตฌ๊ฐ€ ์ผ๋ถ€ ๋ˆ„๋ฝ๋˜์–ด ์šด์˜๋˜๊ณ  ์žˆ๊ฑฐ๋‚˜, ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์šด์˜ ๋ฐ ๊ด€๋ฆฌ ๋ฐฉ์นจ์„ ์ˆ˜๋ฆฝยท์šด์˜ํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์šด์˜ยท๊ด€๋ฆฌ ๋ฐฉ์นจ์„ ์ˆ˜๋ฆฝ ์šด์˜ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๋ฐฉ์นจ ๋‚ด์šฉ๊ณผ ๋‹ฌ๋ฆฌ ๋ณด๊ด€๊ธฐ๊ฐ„์„ ์ค€์ˆ˜ํ•˜์ง€ ์•Š๊ณ  ์šด์˜๋˜๊ฑฐ๋‚˜, ์˜์ƒ์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์œ„ํ•œ ์ ‘๊ทผํ†ต์ œ ๋ฐ ๋กœ๊น… ๋“ฑ ๋ฐฉ์นจ์— ๊ธฐ์ˆ ํ•œ ์‚ฌํ•ญ์ด ์ค€์ˆ˜๋˜์ง€ ์•Š๋Š” ๋“ฑ ๊ด€๋ฆฌ๊ฐ€ ๋ฏธํกํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ์˜ ์„ค์น˜ยท์šด์˜ ์‚ฌ๋ฌด๋ฅผ ์™ธ๋ถ€์—…์ฒด์— ์œ„ํƒํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์˜์ƒ์ •๋ณด์˜ ๊ด€๋ฆฌ ํ˜„ํ™ฉ ์ ๊ฒ€์— ๊ด€ํ•œ ์‚ฌํ•ญ, ์†ํ•ด๋ฐฐ์ƒ ์ฑ…์ž„์— ๊ด€ํ•œ ์‚ฌํ•ญ ๋“ฑ ๋ฒ•๋ น์—์„œ ์š”๊ตฌํ•˜๋Š” ๋‚ด์šฉ์„ ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์—…๋ฌด ์œ„ํƒ ๊ณ„์•ฝ์„œ์— ๋ช…์‹œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ์˜ ์„ค์น˜ยท์šด์˜ ์‚ฌ๋ฌด๋ฅผ ์™ธ๋ถ€์—…์ฒด์— ์œ„ํƒํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ ์•ˆ๋‚ดํŒ์— ์ˆ˜ํƒ์ž์˜ ๋ช…์นญ๊ณผ ์—ฐ๋ฝ์ฒ˜๋ฅผ ๋ˆ„๋ฝํ•˜์—ฌ ๊ณ ์ง€ํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.1.7", + "Name": "๋งˆ์ผ€ํŒ… ๋ชฉ์ ์˜ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉ", + "Description": "์žฌํ™”๋‚˜ ์„œ๋น„์Šค์˜ ํ™๋ณด, ํŒ๋งค ๊ถŒ์œ , ๊ด‘๊ณ ์„ฑ ์ •๋ณด์ „์†ก ๋“ฑ ๋งˆ์ผ€ํŒ… ๋ชฉ์ ์œผ๋กœ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ ๋ฐ์ด์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ๋ชฉ์ ์„ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ๋ช…ํ™•ํ•˜๊ฒŒ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ณ ์ง€ํ•˜๊ณ  ๋™์˜๋ฅผ ๋ฐ›์•„์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.1. ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.1.7 ๋งˆ์ผ€ํŒ… ๋ชฉ์ ์˜ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉ", + "AuditChecklist": [ + "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์žฌํ™”๋‚˜ ์„œ๋น„์Šค๋ฅผ ํ™๋ณดํ•˜๊ฑฐ๋‚˜ ํŒ๋งค๋ฅผ ๊ถŒ์œ ํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์— ๋Œ€ํ•œ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์ด๋ฅผ ๋ช…ํ™•ํ•˜๊ฒŒ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์•Œ๋ฆฌ๊ณ  ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ „์ž์  ์ „์†ก๋งค์ฒด๋ฅผ ์ด์šฉํ•˜์—ฌ ์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด๋ฅผ ์ „์†กํ•˜๋Š” ๊ฒฝ์šฐ ์ˆ˜์‹ ์ž์˜ ๋ช…์‹œ์ ์ธ ์‚ฌ์ „ ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ์œผ๋ฉฐ, 2๋…„๋งˆ๋‹ค ์ •๊ธฐ์ ์œผ๋กœ ์ˆ˜์‹ ์ž์˜ ์ˆ˜์‹ ๋™์˜ ์—ฌ๋ถ€๋ฅผ ํ™•์ธํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ „์ž์  ์ „์†ก๋งค์ฒด๋ฅผ ์ด์šฉํ•œ ์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก์— ๋Œ€ํ•˜์—ฌ ์ˆ˜์‹ ์ž๊ฐ€ ์ˆ˜์‹ ๊ฑฐ๋ถ€์˜์‚ฌ๋ฅผ ํ‘œ์‹œํ•˜๊ฑฐ๋‚˜ ์‚ฌ์ „ ๋™์˜๋ฅผ ์ฒ ํšŒํ•œ ๊ฒฝ์šฐ ์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก์„ ์ค‘๋‹จํ•˜๋„๋ก ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด๋ฅผ ์ „์†กํ•˜๋Š” ๊ฒฝ์šฐ ์ „์†ก์ž์˜ ๋ช…์นญ, ์ˆ˜์‹ ๊ฑฐ๋ถ€ ๋ฐฉ๋ฒ• ๋“ฑ์„ ๊ตฌ์ฒด์ ์œผ๋กœ ๋ฐํžˆ๊ณ  ์žˆ์œผ๋ฉฐ, ์•ผ๊ฐ„์‹œ๊ฐ„์—๋Š” ์ „์†กํ•˜์ง€ ์•Š๋„๋ก ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ22์กฐ(๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ฐฉ๋ฒ•)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ50์กฐ(๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก ์ œํ•œ)" + ], + "AuditEvidence": [ + "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ๋ชจ๋ฐ”์ผ์•ฑ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ์ด๋ฒคํŠธ ์ฐธ์—ฌ ๋“ฑ)", + "์˜คํ”„๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹(ํšŒ์›๊ฐ€์ž…์‹ ์ฒญ์„œ ๋“ฑ)", + "๋งˆ์ผ€ํŒ… ๋™์˜ ๊ธฐ๋ก", + "๊ด‘๊ณ ์„ฑ ์ •๋ณด์ „์†ก ์ˆ˜์‹ ๋™์˜ ๊ธฐ๋ก ๋ฐ ์ˆ˜์‹ ๋™์˜ ์˜์‚ฌํ™•์ธ ๊ธฐ๋ก", + "๊ด‘๊ณ ์„ฑ ์ •๋ณด ๋ฐœ์†ก ์‹œ์Šคํ…œ ๊ด€๋ฆฌ์ž ํ™”๋ฉด(๋ฉ”์ผ, SMS, ์•ฑ ํ‘ธ์‹œ ๋“ฑ)", + "๊ด‘๊ณ ์„ฑ ์ •๋ณด ๋ฐœ์†ก ๋ฌธ๊ตฌ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : สปํ™๋ณด ๋ฐ ๋งˆ์ผ€ํŒ…สผ ๋ชฉ์ ์œผ๋กœ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ํ•˜๋ฉด์„œ สป๋ถ€๊ฐ€์„œ๋น„์Šค ์ œ๊ณตสผ, สป์ œํœด ์„œ๋น„์Šค ์ œ๊ณตสผ ๋“ฑ๊ณผ ๊ฐ™์ด ๋ชฉ์ ์„ ๋ชจํ˜ธํ•˜๊ฒŒ ์•ˆ๋‚ดํ•˜๋Š” ๊ฒฝ์šฐ ๋˜๋Š” ๋‹ค๋ฅธ ๋ชฉ์ ์œผ๋กœ ์ˆ˜์ง‘ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์™€ ๊ตฌ๋ถ„ํ•˜์ง€ ์•Š๊ณ  ํฌ๊ด„ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๋ชจ๋ฐ”์ผ ์•ฑ์—์„œ ๊ด‘๊ณ ์„ฑ ์ •๋ณด์ „์†ก(์•ฑ ํ‘ธ์‹œ)์— ๋Œ€ํ•˜์—ฌ ๊ฑฐ๋ถ€ ์˜์‚ฌ๋ฅผ ๋ฐํ˜”์œผ๋‚˜, ํ”„๋กœ๊ทธ๋žจ ์˜ค๋ฅ˜ ๋“ฑ์˜ ์ด์œ ๋กœ ๊ด‘๊ณ ์„ฑ ์•ฑ ํ‘ธ์‹œ๊ฐ€ ์ด๋ฃจ์–ด์ง€๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์˜จ๋ผ์ธ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด์—์„œ ๋ฌธ์ž, ์ด๋ฉ”์ผ์— ์˜ํ•œ ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ „์†ก์— ๋Œ€ํ•˜์—ฌ ๋””ํดํŠธ๋กœ ์ฒดํฌ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ด‘๊ณ ์„ฑ ์ •๋ณด ์ˆ˜์‹ ๋™์˜ ์—ฌ๋ถ€์— ๋Œ€ํ•˜์—ฌ 2๋…„๋งˆ๋‹ค ํ™•์ธํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์˜๋ฆฌ๋ชฉ์ ์˜ ๊ด‘๊ณ ์„ฑ ์ •๋ณด๋ฅผ ์ „์ž์šฐํŽธ์œผ๋กœ ์ „์†กํ•˜๋ฉด์„œ ์ œ๋ชฉ์ด ์‹œ์ž‘๋˜๋Š” ๋ถ€๋ถ„์— สป(๊ด‘๊ณ )สผ ํ‘œ์‹œ๋ฅผ ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.2.1", + "Name": "๊ฐœ์ธ์ •๋ณด ํ˜„ํ™ฉ๊ด€๋ฆฌ", + "Description": "์ˆ˜์ง‘ยท๋ณด์œ ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์˜ ํ•ญ๋ชฉ, ๋ณด์œ ๋Ÿ‰, ์ฒ˜๋ฆฌ ๋ชฉ์  ๋ฐ ๋ฐฉ๋ฒ•, ๋ณด์œ ๊ธฐ๊ฐ„ ๋“ฑ ํ˜„ํ™ฉ์„ ์ •๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ๊ณต๊ณต๊ธฐ๊ด€์˜ ๊ฒฝ์šฐ ์ด๋ฅผ ๋ฒ•๋ฅ ์—์„œ ์ •ํ•œ ๊ด€๊ณ„๊ธฐ๊ด€์˜ ์žฅ์—๊ฒŒ ๋“ฑ๋กํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "s3_bucket_lifecycle_enabled", + "macie_is_enabled" + ], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.2.1 ๊ฐœ์ธ์ •๋ณด ํ˜„ํ™ฉ๊ด€๋ฆฌ", + "AuditChecklist": [ + "์ˆ˜์ง‘ยท๋ณด์œ ํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด์˜ ํ•ญ๋ชฉ, ๋ณด์œ ๋Ÿ‰, ์ฒ˜๋ฆฌ ๋ชฉ์  ๋ฐ ๋ฐฉ๋ฒ•, ๋ณด์œ ๊ธฐ๊ฐ„ ๋“ฑ ํ˜„ํ™ฉ์„ ์ •๊ธฐ์ ์œผ๋กœ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ณต๊ธฐ๊ด€์ด ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์„ ์šด์šฉํ•˜๊ฑฐ๋‚˜ ๋ณ€๊ฒฝํ•˜๋Š” ๊ฒฝ์šฐ ๊ด€๋ จ๋œ ์‚ฌํ•ญ์„ ๋ฒ•๋ฅ ์—์„œ ์ •ํ•œ ๊ด€๊ณ„๊ธฐ๊ด€์˜ ์žฅ์—๊ฒŒ ๋“ฑ๋กํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ณต๊ธฐ๊ด€์€ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์˜ ๋ณด์œ  ํ˜„ํ™ฉ์„ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ32์กฐ(๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์˜ ๋“ฑ๋ก ๋ฐ ๊ณต๊ฐœ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ํ˜„ํ™ฉํ‘œ", + "๊ฐœ์ธ์ •๋ณด ํ๋ฆ„ํ‘œยทํ๋ฆ„๋„", + "๊ฐœ์ธ์ •๋ณดํŒŒ์ผ ๋“ฑ๋ก ํ˜„ํ™ฉ", + "๊ฐœ์ธ์ •๋ณดํŒŒ์ผ ๊ด€๋ฆฌ๋Œ€์žฅ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ด€ํ•œ ์‚ฌํ•ญ์„ ๊ธฐ๋กํ•œ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "๏ฝข์กฐ์„ธ๋ฒ”์ฒ˜๋ฒŒ๋ฒ•๏ฝฃ์— ๋”ฐ๋ฅธ ๋ฒ”์น™ํ–‰์œ„ ์กฐ์‚ฌ ๋ฐ ๏ฝข๊ด€์„ธ๋ฒ•๏ฝฃ์— ๋”ฐ๋ฅธ ๋ฒ”์น™ํ–‰์œ„ ์กฐ์‚ฌ์— ๊ด€ํ•œ ์‚ฌํ•ญ์„ ๊ธฐ๋กํ•œ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "์ผํšŒ์„ฑ์œผ๋กœ ์šด์˜๋˜๋Š” ํŒŒ์ผ ๋“ฑ ์ง€์†์ ์œผ๋กœ ๊ด€๋ฆฌํ•  ํ•„์š”๊ฐ€ ๋‚ฎ๋‹ค๊ณ  ์ธ์ •๋˜์–ด ๋Œ€ํ†ต๋ น๋ น์œผ๋กœ ์ •ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "ํšŒ์˜ ์ฐธ์„ ์ˆ˜๋‹น ์ง€๊ธ‰, ์ž๋ฃŒยท๋ฌผํ’ˆ์˜ ์†ก๋ถ€, ๊ธˆ์ „์˜ ์ •์‚ฐ ๋“ฑ ๋‹จ์ˆœ ์—…๋ฌด ์ˆ˜ํ–‰์„ ์œ„ํ•ด ์šด์˜๋˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ๋กœ์„œ ์ง€์†์  ๊ด€๋ฆฌ ํ•„์š”์„ฑ์ด ๋‚ฎ์€ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "๊ณต์ค‘์œ„์ƒ ๋“ฑ ๊ณต๊ณต์˜ ์•ˆ์ „๊ณผ ์•ˆ๋…•์„ ์œ„ํ•˜์—ฌ ๊ธด๊ธ‰ํžˆ ํ•„์š”ํ•œ ๊ฒฝ์šฐ๋กœ์„œ ์ผ์‹œ์ ์œผ๋กœ ์ฒ˜๋ฆฌ๋˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "๊ทธ ๋ฐ–์— ์ผํšŒ์  ์—…๋ฌด ์ฒ˜๋ฆฌ๋งŒ์„ ์œ„ํ•ด ์ˆ˜์ง‘๋œ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ๋กœ์„œ ์ €์žฅ๋˜๊ฑฐ๋‚˜ ๊ธฐ๋ก๋˜์ง€ ์•Š๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "๋‹ค๋ฅธ ๋ฒ•๋ น์— ๋”ฐ๋ผ ๋น„๋ฐ€๋กœ ๋ถ„๋ฅ˜๋œ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "๊ตญ๊ฐ€์•ˆ์ „๋ณด์žฅ๊ณผ ๊ด€๋ จ๋œ ์ •๋ณด ๋ถ„์„์„ ๋ชฉ์ ์œผ๋กœ ์ˆ˜์ง‘ ๋˜๋Š” ์ œ๊ณต ์š”์ฒญ๋˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ", + "์˜์ƒ์ •๋ณด์ฒ˜๋ฆฌ๊ธฐ๊ธฐ๋ฅผ ํ†ตํ•˜์—ฌ ์ฒ˜๋ฆฌ๋˜๋Š” ๊ฐœ์ธ์˜์ƒ์ •๋ณดํŒŒ์ผ", + "๏ฝข๊ธˆ์œต์‹ค๋ช…๊ฑฐ๋ž˜ ๋ฐ ๋น„๋ฐ€๋ณด์žฅ์— ๊ด€ํ•œ ๋ฒ•๋ฅ ๏ฝฃ์— ๋”ฐ๋ฅธ ๊ธˆ์œต๊ธฐ๊ด€์ด ๊ธˆ์œต์—…๋ฌด ์ทจ๊ธ‰์„ ์œ„ํ•˜์—ฌ ๋ณด์œ ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์„ ํ™ˆํŽ˜์ด์ง€์˜ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ ๋“ฑ๋ก ๋ฉ”๋‰ด๋ฅผ ํ†ตํ•˜์—ฌ ๋ชฉ๋ก์„ ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ์œผ๋‚˜, ๊ทธ ์ค‘ ์ผ๋ถ€ ํ™ˆํŽ˜์ด์ง€ ์„œ๋น„์Šค์™€ ๊ด€๋ จ๋œ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์˜ ๋‚ด์šฉ์ด ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๋ˆ„๋ฝ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์‹ ๊ทœ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์„ ๊ตฌ์ถ•ํ•œ ์ง€ 2๊ฐœ์›”์ด ๊ฒฝ๊ณผํ•˜์˜€์œผ๋‚˜, ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์„ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์œ„์›ํšŒ์— ๋“ฑ๋กํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์œ„์›ํšŒ์— ๋“ฑ๋ก๋˜์–ด ๊ณต๊ฐœ๋œ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์˜ ๋‚ด์šฉ(์ˆ˜์ง‘ํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด์˜ ํ•ญ๋ชฉ ๋“ฑ)์ด ์‹ค์ œ ์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ ํ˜„ํ™ฉ๊ณผ ์ƒ์ดํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ณต๊ณต๊ธฐ๊ด€์ด ์ž„์ง์›์˜ ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ, ํ†ต๊ณ„๋ฒ•์— ๋”ฐ๋ผ ์ˆ˜์ง‘๋˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์— ๋Œ€ํ•ด ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ ๋“ฑ๋ก ์˜ˆ์™ธ์‚ฌํ•ญ์— ํ•ด๋‹น๋˜์ง€ ์•Š์Œ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์„ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์œ„์›ํšŒ์— ๋“ฑ๋กํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.2.2", + "Name": "๊ฐœ์ธ์ •๋ณด ํ’ˆ์งˆ๋ณด์žฅ", + "Description": "์ˆ˜์ง‘๋œ ๊ฐœ์ธ์ •๋ณด๋Š” ์ฒ˜๋ฆฌ ๋ชฉ์ ์— ํ•„์š”ํ•œ ๋ฒ”์œ„์—์„œ ๊ฐœ์ธ์ •๋ณด์˜ ์ •ํ™•์„ฑยท์™„์ „์„ฑยท์ตœ์‹ ์„ฑ์ด ๋ณด์žฅ๋˜๋„๋ก ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ด€๋ฆฌ์ ˆ์ฐจ๋ฅผ ์ œ๊ณตํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.2.2 ๊ฐœ์ธ์ •๋ณด ํ’ˆ์งˆ๋ณด์žฅ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ตœ์‹ ์˜ ์ƒํƒœ๋กœ ์ •ํ™•ํ•˜๊ฒŒ ์œ ์ง€ํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ ๋ฐ ๋ฐฉ์•ˆ์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด๊ฐ€ ๋ณธ์ธ์˜ ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•˜์—ฌ ์ •ํ™•์„ฑ, ์™„์ „์„ฑ ๋ฐ ์ตœ์‹ ์„ฑ์„ ์œ ์ง€ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ3์กฐ(๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ์›์น™)" + ], + "AuditEvidence": [ + "์ •๋ณด์ฃผ์ฒด ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ •ยท๋ณ€๊ฒฝ ์–‘์‹(์˜จ๋ผ์ธ, ์˜คํ”„๋ผ์ธ)", + "๊ฐœ์ธ์ •๋ณด ์ตœ์‹ ์„ฑ ์œ ์ง€ ์ ˆ์ฐจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€๋ฅผ ํ†ตํ•˜์—ฌ ํšŒ์›์ •๋ณด๋ฅผ ๋ณ€๊ฒฝํ•  ๋•Œ๋Š” ๋ณธ์ธํ™•์ธ ์ ˆ์ฐจ๋ฅผ ๊ฑฐ์น˜๊ณ  ์žˆ์œผ๋‚˜, ๊ณ ๊ฐ์„ผํ„ฐ ์ƒ๋‹ด์›๊ณผ์˜ ํ†ตํ™”๋ฅผ ํ†ตํ•œ ํšŒ์› ์ •๋ณด ๋ณ€๊ฒฝ ์‹œ์—๋Š” ๋ณธ์ธํ™•์ธ ์ ˆ์ฐจ๊ฐ€ ๋ฏธํกํ•˜์—ฌ ํšŒ์›์ •๋ณด์˜ ๋ถˆ๋ฒ•์ ์ธ ๋ณ€๊ฒฝ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์˜จ๋ผ์ธ ํšŒ์›์— ๋Œ€ํ•ด์„œ๋Š” ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ œ๊ณตํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์˜คํ”„๋ผ์ธ ํšŒ์›์— ๋Œ€ํ•ด์„œ๋Š” ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ณ€๊ฒฝํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์ œ๊ณตํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.2.3", + "Name": "์ด์šฉ์ž ๋‹จ๋ง๊ธฐ ์ ‘๊ทผ ๋ณดํ˜ธ", + "Description": "์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜ ๋‚ด์— ์ €์žฅ๋˜์–ด ์žˆ๋Š” ์ •๋ณด ๋ฐ ์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜์— ์„ค์น˜๋œ ๊ธฐ๋Šฅ์— ์ ‘๊ทผ์ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ ์ด๋ฅผ ๋ช…ํ™•ํ•˜๊ฒŒ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์•Œ๋ฆฌ๊ณ  ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ๋™์˜๋ฅผ ๋ฐ›์•„์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.2.3 ์ด์šฉ์ž ๋‹จ๋ง๊ธฐ ์ ‘๊ทผ ๋ณดํ˜ธ", + "AuditChecklist": [ + "์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜ ๋‚ด์— ์ €์žฅ๋˜์–ด ์žˆ๋Š” ์ •๋ณด ๋ฐ ์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜์— ์„ค์น˜๋œ ๊ธฐ๋Šฅ์— ๋Œ€ํ•˜์—ฌ ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์ด ํ•„์š”ํ•œ ๊ฒฝ์šฐ ๋ช…ํ™•ํ•˜๊ฒŒ ์ธ์ง€ํ•  ์ˆ˜ ์žˆ๋„๋ก ์•Œ๋ฆฌ๊ณ  ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜ ๋‚ด์—์„œ ํ•ด๋‹น ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ๋ฐ˜๋“œ์‹œ ํ•„์š”ํ•œ ์ ‘๊ทผ๊ถŒํ•œ์ด ์•„๋‹Œ ๊ฒฝ์šฐ, ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)๊ฐ€ ๋™์˜ํ•˜์ง€ ์•Š์•„๋„ ์„œ๋น„์Šค ์ œ๊ณต์„ ๊ฑฐ๋ถ€ํ•˜์ง€ ์•Š๋„๋ก ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ด๋™ํ†ต์‹ ๋‹จ๋ง์žฅ์น˜ ๋‚ด์—์„œ ํ•ด๋‹น ์ ‘๊ทผ๊ถŒํ•œ์— ๋Œ€ํ•œ ์ •๋ณด์ฃผ์ฒด(์ด์šฉ์ž)์˜ ๋™์˜ ๋ฐ ์ฒ ํšŒ๋ฐฉ๋ฒ•์„ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ22์กฐ์˜2(์ ‘๊ทผ๊ถŒํ•œ์— ๋Œ€ํ•œ ๋™์˜)" + ], + "AuditEvidence": [ + "์•ฑ ์ ‘๊ทผ๊ถŒํ•œ ๋™์˜ ํ™”๋ฉด", + "์•ฑ ์ ‘๊ทผ๊ถŒํ•œ ์„ค์ • ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์Šค๋งˆํŠธํฐ ์•ฑ์—์„œ ์„œ๋น„์Šค์— ๋ถˆํ•„์š”ํ•จ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ์ฃผ์†Œ๋ก, ์‚ฌ์ง„, ๋ฌธ์ž ๋“ฑ ์Šค๋งˆํŠธํฐ ๋‚ด ๊ฐœ์ธ์ •๋ณด ์˜์—ญ์— ์ ‘๊ทผํ•  ์ˆ˜ ์žˆ๋Š” ๊ถŒํ•œ์„ ๊ณผ๋„ํ•˜๊ฒŒ ์„ค์ •ํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ •๋ณดํ†ต์‹ ์„œ๋น„์Šค ์ œ๊ณต์ž์˜ ์Šค๋งˆํŠธํฐ ์•ฑ์—์„œ ์Šค๋งˆํŠธํฐ ๋‚ด์— ์ €์žฅ๋˜์–ด ์žˆ๋Š” ์ •๋ณด ๋ฐ ์„ค์น˜๋œ ๊ธฐ๋Šฅ์— ์ ‘๊ทผํ•˜๋ฉด์„œ ์ ‘๊ทผ๊ถŒํ•œ์— ๋Œ€ํ•œ ๊ณ ์ง€ ๋ฐ ๋™์˜๋ฅผ ๋ฐ›์ง€ ์•Š๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์Šค๋งˆํŠธํฐ ์•ฑ์˜ ์ ‘๊ทผ๊ถŒํ•œ์— ๋Œ€ํ•œ ๋™์˜๋ฅผ ๋ฐ›์œผ๋ฉด์„œ ์„ ํƒ์‚ฌํ•ญ์— ํ•ด๋‹นํ•˜๋Š” ๊ถŒํ•œ์„ ํ•„์ˆ˜๊ถŒํ•œ์œผ๋กœ ๊ณ ์ง€ํ•˜์—ฌ ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ ‘๊ทผ๊ถŒํ•œ์— ๋Œ€ํ•œ ๊ฐœ๋ณ„๋™์˜๊ฐ€ ๋ถˆ๊ฐ€๋Šฅํ•œ ์•ˆ๋“œ๋กœ์ด๋“œ 6.0 ๋ฏธ๋งŒ ๋ฒ„์ „์„ ์ง€์›ํ•˜๋Š” ์Šค๋งˆํŠธํฐ ์•ฑ์„ ๋ฐฐํฌํ•˜๋ฉด์„œ ์„ ํƒ์  ์ ‘๊ทผ๊ถŒํ•œ์„ ํ•จ๊ป˜ ์„ค์ •ํ•˜์—ฌ, ์„ ํƒ์  ์ ‘๊ทผ๊ถŒํ•œ์— ๋Œ€ํ•˜์—ฌ ๊ฑฐ๋ถ€ํ•  ์ˆ˜ ์—†๋„๋ก ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.2.4", + "Name": "๊ฐœ์ธ์ •๋ณด ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ๊ณต", + "Description": "๊ฐœ์ธ์ •๋ณด๋Š” ์ˆ˜์ง‘ ์‹œ์˜ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ณ ์ง€ยท๋™์˜๋ฅผ ๋ฐ›์€ ๋ชฉ์  ๋˜๋Š” ๋ฒ•๋ น์— ๊ทผ๊ฑฐํ•œ ๋ฒ”์œ„ ๋‚ด์—์„œ๋งŒ ์ด์šฉ ๋˜๋Š” ์ œ๊ณตํ•˜์—ฌ์•ผ ํ•˜๋ฉฐ, ์ด๋ฅผ ์ดˆ๊ณผํ•˜์—ฌ ์ด์šฉยท์ œ๊ณตํ•˜๋ ค๋Š” ๋•Œ์—๋Š” ์ •๋ณด์ฃผ์ฒด์˜ ์ถ”๊ฐ€ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜ ๊ด€๊ณ„ ๋ฒ•๋ น์— ๋”ฐ๋ฅธ ์ ๋ฒ•ํ•œ ๊ฒฝ์šฐ์ธ์ง€ ํ™•์ธํ•˜๊ณ  ์ ์ ˆํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.2.4 ๊ฐœ์ธ์ •๋ณด ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ๊ณต", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด๋Š” ์ตœ์ดˆ ์ˆ˜์ง‘ ์‹œ ์ •๋ณด์ฃผ์ฒด๋กœ๋ถ€ํ„ฐ ๋™์˜๋ฐ›์€ ๋ชฉ์  ๋˜๋Š” ๋ฒ•๋ น์— ๊ทผ๊ฑฐํ•œ ๋ฒ”์œ„ ๋‚ด์—์„œ๋งŒ ์ด์šฉยท์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๋กœ๋ถ€ํ„ฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต๋ฐ›์€ ๊ฒฝ์šฐ ์ œ๊ณต๋ฐ›์€ ๋ชฉ์ ์˜ ๋ฒ”์œ„ ๋‚ด์—์„œ๋งŒ ์ด์šฉยท์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ˆ˜์ง‘ ๋ชฉ์  ๋˜๋Š” ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๋กœ๋ถ€ํ„ฐ ์ œ๊ณต๋ฐ›์€ ๋ชฉ์ ์˜ ๋ฒ”์œ„๋ฅผ ์ดˆ๊ณผํ•˜์—ฌ ์ด์šฉํ•˜๊ฑฐ๋‚˜ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๋ณ„๋„์˜ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜ ๋ฒ•์  ๊ทผ๊ฑฐ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ๋กœ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ชฉ์  ์™ธ์˜ ์šฉ๋„๋กœ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ์ œ๊ณต๋ฐ›๋Š” ์ž์—๊ฒŒ ์ด์šฉ๋ชฉ์  ๋ฐ ๋ฐฉ๋ฒ• ๋“ฑ์„ ์ œํ•œํ•˜๊ฑฐ๋‚˜ ์•ˆ์ „์„ฑ ํ™•๋ณด๋ฅผ ์œ„ํ•˜์—ฌ ํ•„์š”ํ•œ ์กฐ์น˜๋ฅผ ๋งˆ๋ จํ•˜๋„๋ก ์š”์ฒญํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ณต๊ธฐ๊ด€์ด ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ชฉ์  ์™ธ์˜ ์šฉ๋„๋กœ ์ด์šฉํ•˜๊ฑฐ๋‚˜ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ๊ทธ ์ด์šฉ ๋˜๋Š” ์ œ๊ณต์˜ ๋ฒ•์  ๊ทผ๊ฑฐ, ๋ชฉ์  ๋ฐ ๋ฒ”์œ„ ๋“ฑ์— ๊ด€ํ•˜์—ฌ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ๊ด€๋ณด ๋˜๋Š” ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๋“ฑ์— ๊ฒŒ์žฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ณต๊ณต๊ธฐ๊ด€ ๋“ฑ์ด ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ชฉ์  ์™ธ์˜ ์šฉ๋„๋กœ ์ด์šฉํ•˜๊ฑฐ๋‚˜ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ3์ž ์ œ๊ณต๋Œ€์žฅ์— ๊ธฐ๋กยท๊ด€๋ฆฌํ•˜๋Š” ๋“ฑ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ18์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ๋ชฉ์  ์™ธ ์ด์šฉยท์ œ๊ณต ์ œํ•œ), ์ œ19์กฐ(๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต๋ฐ›์€ ์ž์˜ ์ด์šฉยท์ œ๊ณต ์ œํ•œ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ3์ž ์ œ๊ณต ๋‚ด์—ญ(์š”์ฒญ์„œ ๋“ฑ ๊ด€๋ จ ์ฆ๊ฑฐ์ž๋ฃŒ ํฌํ•จ)", + "๊ฐœ์ธ์ •๋ณด ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ3์ž ์ œ๊ณต ๋Œ€์žฅ(๊ณต๊ณต๊ธฐ๊ด€์ธ ๊ฒฝ์šฐ)", + "ํ™ˆํŽ˜์ด์ง€ ๋˜๋Š” ๊ด€๋ณด ๊ฒŒ์žฌ ๋‚ด์—ญ(๊ณต๊ณต๊ธฐ๊ด€์ธ ๊ฒฝ์šฐ)", + "์ž๋ฃŒ ์ œ๊ณต ์š”์ฒญ ๋Œ€์‘ ์ง€์นจ", + "์ž๋ฃŒ ์ œ๊ณต ์š”์ฒญ ๊ณต๋ฌธ ๋ฐ ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต๋‚ด์—ญ, ๋Œ€์žฅ ๋“ฑ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ƒํ’ˆ๋ฐฐ์†ก์„ ๋ชฉ์ ์œผ๋กœ ์ˆ˜์ง‘ํ•œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์‚ฌ์ „์— ๋™์˜ ๋ฐ›์ง€ ์•Š์€ ์ž์‚ฌ ์ƒํ’ˆ์˜ ํ†ต์‹ ํŒ๋งค ๊ด‘๊ณ ์— ์ด์šฉํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ณ ๊ฐ ๋งŒ์กฑ๋„ ์กฐ์‚ฌ, ๊ฒฝํ’ˆ ํ–‰์‚ฌ์— ์‘๋ชจํ•˜๊ธฐ ์œ„ํ•˜์—ฌ ์ˆ˜์ง‘ํ•œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ž์‚ฌ์˜ ํ• ์ธํŒ๋งคํ–‰์‚ฌ ์•ˆ๋‚ด์šฉ ๊ด‘๊ณ  ๋ฐœ์†ก์— ์ด์šฉํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ณต๊ณต๊ธฐ๊ด€์ด ๋‹ค๋ฅธ ๋ฒ•๋ฅ ์— ๊ทผ๊ฑฐํ•˜์—ฌ ๋ฏผ์›์ธ์˜ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋ชฉ์  ์™ธ๋กœ ํƒ€ ๊ธฐ๊ด€์— ์ œ๊ณตํ•˜๋ฉด์„œ ๊ด€๋ จ ์‚ฌํ•ญ์„ ๊ด€๋ณด ๋˜๋Š” ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€์— ๊ฒŒ์‹œํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ณต๊ณต๊ธฐ๊ด€์ด ๋ฒ”์ฃ„ ์ˆ˜์‚ฌ์˜ ๋ชฉ์ ์œผ๋กœ ๊ฒฝ์ฐฐ์„œ์— ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณตํ•˜๋ฉด์„œ สป๊ฐœ์ธ์ •๋ณด ๋ชฉ์  ์™ธ ์ด์šฉ ๋ฐ ์ œ3์ž ์ œ๊ณต ๋Œ€์žฅสผ์— ๊ด€๋ จ ์‚ฌํ•ญ์„ ๊ธฐ๋กํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.2.5", + "Name": "๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ", + "Description": "๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ๋ชฉ์ ์ œํ•œ, ๊ฒฐํ•ฉ์ œํ•œ, ์•ˆ์ „์กฐ์น˜, ๊ธˆ์ง€์˜๋ฌด ๋“ฑ ๋ฒ•์  ์š”๊ฑด์„ ์ค€์ˆ˜ํ•˜๊ณ  ์ ์ • ์ˆ˜์ค€์˜ ๊ฐ€๋ช…์ฒ˜๋ฆฌ๋ฅผ ๋ณด์žฅํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ฐ€๋ช…์ฒ˜๋ฆฌ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.2. ๊ฐœ์ธ์ •๋ณด ๋ณด์œ  ๋ฐ ์ด์šฉ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.2.5 ๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ", + "AuditChecklist": [ + "๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ๋ชฉ์  ์ œํ•œ, ๊ฐ€๋ช…์ฒ˜๋ฆฌ ๋ฐฉ๋ฒ• ๋ฐ ๊ธฐ์ค€, ์ ์ •์„ฑ ๊ฒ€ํ† , ์žฌ์‹๋ณ„ ๊ธˆ์ง€ ๋ฐ ์žฌ์‹๋ณ„ ๋ฐœ์ƒ ์‹œ ์กฐ์น˜์‚ฌํ•ญ ๋“ฑ ๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ ์ •ํ•˜๊ฒŒ ์ฒ˜๋ฆฌํ•˜๊ธฐ ์œ„ํ•œ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ฐ€๋ช…์ฒ˜๋ฆฌํ•˜์—ฌ ์ด์šฉยท์ œ๊ณต ์‹œ ์ถ”๊ฐ€ ์ •๋ณด์˜ ์‚ฌ์šฉยท๊ฒฐํ•ฉ ์—†์ด๋Š” ๊ฐœ์ธ์„ ์•Œ์•„๋ณผ ์ˆ˜ ์—†๋„๋ก ์ ์ •ํ•œ ์ˆ˜์ค€์œผ๋กœ ๊ฐ€๋ช…์ฒ˜๋ฆฌ๋ฅผ ์ˆ˜ํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋‹ค๋ฅธ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž์™€ ๊ฐ€๋ช…์ •๋ณด๋ฅผ ๊ฒฐํ•ฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ฒฐํ•ฉ์ „๋ฌธ๊ธฐ๊ด€ ๋˜๋Š” ๋ฐ์ดํ„ฐ์ „๋ฌธ๊ธฐ๊ด€์„ ํ†ตํ•ด ๊ฒฐํ•ฉํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ์ถ”๊ฐ€ ์ •๋ณด๋ฅผ ์‚ญ์ œ ๋˜๋Š” ๋ณ„๋„๋กœ ๋ถ„๋ฆฌํ•˜์—ฌ ๋ณด๊ด€ยท๊ด€๋ฆฌ, ๊ด€๋ จ ๊ธฐ๋ก์˜ ์ž‘์„ฑยท๋ณด๊ด€ ๋“ฑ ์•ˆ์ „์„ฑ ํ™•๋ณด์— ํ•„์š”ํ•œ ๊ธฐ์ˆ ์ ยท๊ด€๋ฆฌ์  ๋ฐ ๋ฌผ๋ฆฌ์  ์กฐ์น˜๋ฅผ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ๋ชฉ์  ๋“ฑ์„ ๊ณ ๋ คํ•˜์—ฌ ๊ฐ€๋ช…์ •๋ณด์˜ ์ฒ˜๋ฆฌ ๊ธฐ๊ฐ„์„ ์ ์ •ํ•œ ๊ธฐ๊ฐ„์œผ๋กœ ์ •ํ•˜๊ณ  ์žˆ์œผ๋ฉฐ, ํ•ด๋‹น ๊ธฐ๊ฐ„์ด ๊ฒฝ๊ณผํ•œ ๊ฒฝ์šฐ ์ง€์ฒด ์—†์ด ํŒŒ๊ธฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ต๋ช…์ฒ˜๋ฆฌํ•˜๋Š” ๊ฒฝ์šฐ ์‹œ๊ฐ„ยท๋น„์šฉยท๊ธฐ์ˆ  ๋“ฑ์„ ํ•ฉ๋ฆฌ์ ์œผ๋กœ ๊ณ ๋ คํ•  ๋•Œ ๋‹ค๋ฅธ ์ •๋ณด๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ๋„ ๋” ์ด์ƒ ํŠน์ • ๊ฐœ์ธ์„ ์•Œ์•„๋ณผ ์ˆ˜ ์—†๋„๋ก ์ ์ •ํ•œ ์ˆ˜์ค€์œผ๋กœ ์ต๋ช…์ฒ˜๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ2์กฐ(์ •์˜), ์ œ28์กฐ์˜2(๊ฐ€๋ช…์ •๋ณด์˜ ์ฒ˜๋ฆฌ ๋“ฑ), ์ œ28์กฐ์˜3(๊ฐ€๋ช…์ •๋ณด์˜ ๊ฒฐํ•ฉ ์ œํ•œ), ์ œ28์กฐ์˜4(๊ฐ€๋ช…์ •๋ณด์— ๋Œ€ํ•œ ์•ˆ์ „์กฐ์น˜์˜๋ฌด ๋“ฑ), ์ œ28์กฐ์˜5(๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ ์‹œ ๊ธˆ์ง€์˜๋ฌด ๋“ฑ), ์ œ28์กฐ์˜7(์ ์šฉ๋ฒ”์œ„), ์ œ58์กฐ์˜2(์ ์šฉ์ œ์™ธ)" + ], + "AuditEvidence": [ + "๊ฐ€๋ช…์ฒ˜๋ฆฌยท์ต๋ช…์ฒ˜๋ฆฌ ์ ์ •์„ฑ ํ‰๊ฐ€ ์ ˆ์ฐจ ๋ฐ ๊ฒฐ๊ณผ", + "๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ ๊ธฐ๋ก", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ(๊ฐ€๋ช…์ •๋ณด ์ด์šฉยท์ œ๊ณต์— ๊ด€ํ•œ ์‚ฌํ•ญ) ๋“ฑ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํ†ต๊ณ„์ž‘์„ฑ ๋ฐ ๊ณผํ•™์  ์—ฐ๊ตฌ๋ฅผ ์œ„ํ•˜์—ฌ ์ •๋ณด์ฃผ์ฒด ๋™์˜ ์—†์ด ๊ฐ€๋ช…์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋ฉด์„œ ๊ฐ€๋ช…์ •๋ณด ์ฒ˜๋ฆฌ์— ๊ด€ํ•œ ๊ธฐ๋ก์„ ๋‚จ๊ธฐ๊ณ  ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜, ๋˜๋Š” ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ด€๋ จ ์‚ฌํ•ญ์„ ๊ณต๊ฐœํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐ€๋ช…์ •๋ณด์™€ ๋™์ผํ•œ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋‚ด์— ์ถ”๊ฐ€ ์ •๋ณด๋ฅผ ๋ถ„๋ฆฌํ•˜์ง€ ์•Š๊ณ  ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๊ฑฐ๋‚˜, ๋˜๋Š” ๊ฐ€๋ช… ์ •๋ณด์™€ ์ถ”๊ฐ€ ์ •๋ณด์— ๋Œ€ํ•œ ์ ‘๊ทผ๊ถŒํ•œ์ด ์ ์ ˆํžˆ ๋ถ„๋ฆฌ๋˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ฐ€๋ช…์ฒ˜๋ฆฌํ•˜์—ฌ ํ™œ์šฉํ•˜๊ณ  ์žˆ์œผ๋‚˜ ์ ์ •ํ•œ ์ˆ˜์ค€์˜ ๊ฐ€๋ช…์ฒ˜๋ฆฌ๊ฐ€ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์•„ ์ถ”๊ฐ€ ์ •๋ณด์˜ ์‚ฌ์šฉ ์—†์ด๋„ ๋‹ค๋ฅธ ์ •๋ณด์™€์˜ ๊ฒฐํ•ฉ ๋“ฑ์„ ํ†ตํ•˜์—ฌ ํŠน์ • ๊ฐœ์ธ์„ ์•Œ์•„๋ณผ ์ˆ˜ ์žˆ๋Š” ๊ฐ€๋Šฅ์„ฑ์ด ์กด์žฌํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ํ…Œ์ŠคํŠธ ๋ฐ์ดํ„ฐ ์ƒ์„ฑ, ์™ธ๋ถ€ ๊ณต๊ฐœ ๋“ฑ์„ ์œ„ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ต๋ช…์ฒ˜๋ฆฌํ•˜์˜€์œผ๋‚˜, ํŠน์ด์น˜ ๋“ฑ์œผ๋กœ ์ธํ•˜์—ฌ ํŠน์ • ๊ฐœ์ธ์— ๋Œ€ํ•œ ์‹๋ณ„๊ฐ€๋Šฅ์„ฑ์ด ์กด์žฌํ•˜๋Š” ๋“ฑ ์ต๋ช…์ฒ˜๋ฆฌ๊ฐ€ ์ ์ •ํ•˜๊ฒŒ ์ˆ˜ํ–‰๋˜์—ˆ๋‹ค๊ณ  ๋ณด๊ธฐ ์–ด๋ ค์šด ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.3.1", + "Name": "๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต", + "Description": "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ๋ฒ•์  ๊ทผ๊ฑฐ์— ์˜ํ•˜๊ฑฐ๋‚˜ ์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜๋ฅผ ๋ฐ›์•„์•ผ ํ•˜๋ฉฐ, ์ œ3์ž์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด์˜ ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๋Š” ๋“ฑ ์ œ๊ณต ๊ณผ์ •์—์„œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์•ˆ์ „ํ•˜๊ฒŒ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•œ ๋ณดํ˜ธ๋Œ€์ฑ…์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.3.1 ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด ๋™์˜, ๋ฒ•๋ น์ƒ ์˜๋ฌด์ค€์ˆ˜ ๋“ฑ ์ ๋ฒ• ์š”๊ฑด์„ ๋ช…ํ™•ํžˆ ์‹๋ณ„ํ•˜๊ณ  ์ด๋ฅผ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ๊ด€๋ จ ์‚ฌํ•ญ์„ ๋ช…ํ™•ํ•˜๊ฒŒ ๊ณ ์ง€ํ•˜๊ณ  ๋‹ค๋ฅธ ๋™์˜์‚ฌํ•ญ๊ณผ ๊ตฌ๋ถ„ํ•˜์—ฌ ์ ๋ฒ•ํ•˜๊ฒŒ ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๋™์˜๋ฅผ ๋ฐ›๋Š” ๊ฒฝ์šฐ ๊ด€๋ จ ๋‚ด์šฉ์„ ๋ช…ํ™•ํ•˜๊ฒŒ ๊ณ ์ง€ํ•˜๊ณ  ๋ฒ•๋ น์—์„œ ์ •ํ•œ ์ค‘์š”ํ•œ ๋‚ด์šฉ์— ๋Œ€ํ•ด ๋ช…ํ™•ํžˆ ํ‘œ์‹œํ•˜์—ฌ ์•Œ์•„๋ณด๊ธฐ ์‰ฝ๊ฒŒ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ์ œ๊ณต ๋ชฉ์ ์— ๋งž๋Š” ์ตœ์†Œํ•œ์˜ ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์œผ๋กœ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ ์•ˆ์ „ํ•œ ์ ˆ์ฐจ์™€ ๋ฐฉ๋ฒ•์„ ํ†ตํ•ด ์ œ๊ณตํ•˜๊ณ  ์ œ๊ณต ๋‚ด์—ญ์„ ๊ธฐ๋กํ•˜์—ฌ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ œ3์ž์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด์˜ ์ ‘๊ทผ์„ ํ—ˆ์šฉํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์•ˆ์ „ํ•˜๊ฒŒ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•œ ๋ณดํ˜ธ์ ˆ์ฐจ์— ๋”ฐ๋ผ ํ†ต์ œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์˜ ๋™์˜ ์—†์ด ๊ฐœ์ธ์ •๋ณด์˜ ์ถ”๊ฐ€์ ์ธ ์ œ๊ณต ์‹œ ๋‹น์ดˆ ์ˆ˜์ง‘ ๋ชฉ์ ๊ณผ์˜ ๊ด€๋ จ์„ฑ, ์˜ˆ์ธก ๊ฐ€๋Šฅ์„ฑ, ์ด์ต ์นจํ•ด ์—ฌ๋ถ€, ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๋“ฑ์˜ ๊ณ ๋ ค์‚ฌํ•ญ์— ๋Œ€ํ•œ ํŒ๋‹จ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝ ๋ฐ ์ดํ–‰ํ•˜๊ณ , ์ถ”๊ฐ€์ ์ธ ์ œ๊ณต์ด ์ง€์†์ ์œผ๋กœ ๋ฐœ์ƒํ•˜๋Š” ๊ฒฝ์šฐ ๊ณ ๋ ค์‚ฌํ•ญ์— ๋Œ€ํ•œ ํŒ๋‹จ๊ธฐ์ค€์„ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๊ณ  ์ด๋ฅผ ์ ๊ฒ€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ17์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ œ๊ณต), ์ œ22์กฐ(๋™์˜๋ฅผ ๋ฐ›๋Š” ๋ฐฉ๋ฒ•)", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋ฐฉ๋ฒ•์— ๊ด€ํ•œ ๊ณ ์‹œ" + ], + "AuditEvidence": [ + "์˜จ๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๊ด€๋ จ ์–‘์‹(ํ™ˆํŽ˜์ด์ง€ ํšŒ์›๊ฐ€์ž… ํ™”๋ฉด, ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๋™์˜ ํ™”๋ฉด ๋“ฑ)", + "์˜คํ”„๋ผ์ธ ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๊ด€๋ จ ์–‘์‹(ํšŒ์›๊ฐ€์ž…์‹ ์ฒญ์„œ, ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๋™์˜์„œ ๋“ฑ)", + "์ œ3์ž ์ œ๊ณต ๋‚ด์—ญ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๊ฐ€ ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต ๋™์˜๋ฅผ ๋ฐ›์„ ๋•Œ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ณ ์ง€ํ•˜๋Š” ์‚ฌํ•ญ ์ค‘์— ์ผ๋ถ€ ์‚ฌํ•ญ(๋™์˜ ๊ฑฐ๋ถ€๊ถŒ, ์ œ๊ณตํ•˜๋Š” ํ•ญ๋ชฉ ๋“ฑ)์„ ๋ˆ„๋ฝํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๋Š” ๊ณผ์ •์—์„œ ์ œ3์ž ์ œ๊ณต ๋™์˜ ์—ฌ๋ถ€๋ฅผ ์ ์ ˆํžˆ ํ™•์ธํ•˜์ง€ ๋ชปํ•˜์—ฌ ๋™์˜ํ•˜์ง€ ์•Š์€ ์ •๋ณด์ฃผ์ฒด์˜ ๊ฐœ์ธ์ •๋ณด๊ฐ€ ํ•จ๊ป˜ ์ œ๊ณต๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณต ๋™์˜๋ฅผ ๋ฐ›์„ ๋•Œ, ์ œ๊ณต๋ฐ›๋Š” ์ž๋ฅผ ํŠน์ •ํ•˜์ง€ ์•Š๊ณ  สป~ ๋“ฑสผ๊ณผ ๊ฐ™์ด ํฌ๊ด„์ ์œผ๋กœ ์•ˆ๋‚ดํ•˜๊ณ  ๋™์˜๋ฅผ ๋ฐ›์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ํšŒ์› ๊ฐ€์ž… ๋‹จ๊ณ„์—์„œ ์„ ํƒ์‚ฌํ•ญ์œผ๋กœ ์ œ3์ž ์ œ๊ณต ๋™์˜๋ฅผ ๋ฐ›๊ณ  ์žˆ์œผ๋‚˜, ์ œ3์ž ์ œ๊ณต์— ๋™์˜ํ•˜์ง€ ์•Š์œผ๋ฉด ํšŒ์› ๊ฐ€์ž… ์ ˆ์ฐจ๊ฐ€ ๋” ์ด์ƒ ์ง„ํ–‰๋˜์ง€ ์•Š๋„๋ก ๋˜์–ด ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ œ๊ณต๋ฐ›๋Š” ์ž์˜ ์ด์šฉ ๋ชฉ์ ๊ณผ ๊ด€๋ จ ์—†์ด ์ง€๋‚˜์น˜๊ฒŒ ๋งŽ์€ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.3.2", + "Name": "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ์—…๋ฌด ์œ„ํƒ", + "Description": "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์ œ3์ž์—๊ฒŒ ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ๊ณผ ์ˆ˜ํƒ์ž ๋“ฑ ๊ด€๋ จ์‚ฌํ•ญ์„ ๊ณต๊ฐœํ•˜์—ฌ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค๋ฅผ ํ™๋ณดํ•˜๊ฑฐ๋‚˜ ํŒ๋งค๋ฅผ ๊ถŒ์œ ํ•˜๋Š” ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ๊ณผ ์ˆ˜ํƒ์ž๋ฅผ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ ค์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.3.2 ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ์—…๋ฌด ์œ„ํƒ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์ œ3์ž์—๊ฒŒ ์œ„ํƒ(์žฌ์œ„ํƒ ํฌํ•จ)ํ•˜๋Š” ๊ฒฝ์šฐ ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๋“ฑ์— ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ๊ณผ ์ˆ˜ํƒ์ž๋ฅผ ํ˜„ํ–‰ํ™”ํ•˜์—ฌ ๊ณต๊ฐœํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค๋ฅผ ํ™๋ณดํ•˜๊ฑฐ๋‚˜ ํŒ๋งค๋ฅผ ๊ถŒ์œ ํ•˜๋Š” ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๋Š” ๊ฒฝ์šฐ์—๋Š” ์„œ๋ฉด, ์ „์ž์šฐํŽธ, ๋ฌธ์ž์ „์†ก ๋“ฑ์˜ ๋ฐฉ๋ฒ•์œผ๋กœ ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ๊ณผ ์ˆ˜ํƒ์ž๋ฅผ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ26์กฐ(์—…๋ฌด์œ„ํƒ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ์ œํ•œ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ(๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์œ„ํƒ ๊ด€๋ จ ๊ณต๊ฐœ ๋‚ด์—ญ)", + "๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ ์–‘์‹", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ์œ„ํƒ ๊ณ„์•ฝ์„œ", + "์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค ํ™๋ณดยทํŒ๋งค ๊ถŒ์œ  ์—…๋ฌด ์œ„ํƒ ๊ด€๋ จ ์ •๋ณด์ฃผ์ฒด ํ†ต์ง€ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํ™ˆํŽ˜์ด์ง€ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์œ„ํƒ ์‚ฌํ•ญ์„ ๊ณต๊ฐœํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ผ๋ถ€ ์ˆ˜ํƒ์ž์™€ ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ์ด ๋ˆ„๋ฝ๋œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์žฌํ™” ๋˜๋Š” ์„œ๋น„์Šค๋ฅผ ํ™๋ณดํ•˜๊ฑฐ๋‚˜ ํŒ๋งค๋ฅผ ๊ถŒ์œ ํ•˜๋Š” ์—…๋ฌด๋ฅผ ์œ„ํƒํ•˜๋ฉด์„œ, ์œ„ํƒํ•˜๋Š” ์—…๋ฌด์˜ ๋‚ด์šฉ๊ณผ ์ˆ˜ํƒ์ž๋ฅผ ์„œ๋ฉด๋“ฑ์˜ ๋ฐฉ๋ฒ•์œผ๋กœ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ์ง€ ์•Š๊ณ  ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๋Š” ๊ฒƒ์œผ๋กœ ๊ฐˆ์Œํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ธฐ์กด ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์ˆ˜ํƒ์ž์™€์˜ ๊ณ„์•ฝ ํ•ด์ง€์— ๋”ฐ๋ผ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด ์ˆ˜ํƒ์ž๊ฐ€ ๋ณ€๊ฒฝ๋˜์—ˆ์œผ๋‚˜, ์ด์— ๋Œ€ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ์ง€์ฒด ์—†์ด ๋ฐ˜์˜ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์—…๋ฌด๋ฅผ ์œ„ํƒ๋ฐ›์€ ์ž๊ฐ€ ํ•ด๋‹น ์—…๋ฌด๋ฅผ ์ œ3์ž์—๊ฒŒ ์žฌ์œ„ํƒ์„ ํ•˜๊ณ  ์žˆ์ง€๋งŒ, ์žฌ์œ„ํƒ์— ๊ด€ํ•œ ์‚ฌํ•ญ์„ ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๋“ฑ์— ๊ณต๊ฐœํ•˜๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.3.3", + "Name": "์˜์—…์˜ ์–‘๋„ ๋“ฑ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด ์ด์ „", + "Description": "์˜์—…์˜ ์–‘๋„ยทํ•ฉ๋ณ‘ ๋“ฑ์œผ๋กœ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์ „ํ•˜๊ฑฐ๋‚˜ ์ด์ „๋ฐ›๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด ํ†ต์ง€ ๋“ฑ ์ ์ ˆํ•œ ๋ณดํ˜ธ์กฐ์น˜๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.3.3 ์˜์—…์˜ ์–‘๋„ ๋“ฑ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด ์ด์ „", + "AuditChecklist": [ + "์˜์—…์˜ ์ „๋ถ€ ๋˜๋Š” ์ผ๋ถ€์˜ ์–‘๋„ยทํ•ฉ๋ณ‘ ๋“ฑ์œผ๋กœ ๊ฐœ์ธ์ •๋ณด๋ฅผ ๋‹ค๋ฅธ ์‚ฌ๋žŒ์—๊ฒŒ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ์‚ฌ์ „์— ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์ „๋ฐ›๋Š” ์ž๋Š” ๋ฒ•์  ํ†ต์ง€ ์š”๊ฑด์— ํ•ด๋‹น๋  ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์ „๋ฐ›์€ ์‚ฌ์‹ค ๋“ฑ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์ง€์ฒด ์—†์ด ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์ „๋ฐ›๋Š” ์ž๋Š” ์ด์ „ ๋‹น์‹œ์˜ ๋ณธ๋ž˜ ๋ชฉ์ ์œผ๋กœ๋งŒ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์šฉํ•˜๊ฑฐ๋‚˜ ์ œ3์ž์—๊ฒŒ ์ œ๊ณตํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ27์กฐ(์˜์—…์–‘๋„ ๋“ฑ์— ๋”ฐ๋ฅธ ๊ฐœ์ธ์ •๋ณด์˜ ์ด์ „ ์ œํ•œ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ด์ „ ๊ด€๋ จ ์ •๋ณด์ฃผ์ฒด ๊ณ ์ง€ ๋‚ด์—ญ(์˜์—… ์–‘์ˆ˜๋„ ์‹œ)", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์ž๊ฐ€ ์˜์—… ์–‘์ˆ˜๋ฅผ ํ†ตํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์ „๋ฐ›์œผ๋ฉด์„œ ์–‘๋„์ž๊ฐ€ ๊ฐœ์ธ์ •๋ณด ์ด์ „ ์‚ฌ์‹ค์„ ์•Œ๋ฆฌ์ง€ ์•Š์•˜์Œ์—๋„ ๊ฐœ์ธ์ •๋ณด ์ด์ „ ์‚ฌ์‹ค์„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์˜์—… ์–‘์ˆ˜๋„ ๋“ฑ์— ์˜ํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ด์ „๋ฐ›์œผ๋ฉด์„œ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์ด์ „์„ ์›ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ ์กฐ์น˜ํ•  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•๊ณผ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜์ง€ ์•Š๊ฑฐ๋‚˜, ์ด๋ฅผ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.3.4", + "Name": "๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ์ด์ „", + "Description": "๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ตญ์™ธ๋กœ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ๊ตญ์™ธ ์ด์ „์— ๋Œ€ํ•œ ๋™์˜, ๊ด€๋ จ ์‚ฌํ•ญ์— ๋Œ€ํ•œ ๊ณต๊ฐœ ๋“ฑ ์ ์ ˆํ•œ ๋ณดํ˜ธ์กฐ์น˜๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [ + "s3_bucket_cross_region_replication" + ], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.3. ๊ฐœ์ธ์ •๋ณด ์ œ๊ณต ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.3.4 ๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ์ด์ „", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ตญ์™ธ๋กœ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ๊ตญ์™ธ ์ด์ „์— ๊ด€ํ•œ ๊ณ ์ง€ ์‚ฌํ•ญ์„ ๋ชจ๋‘ ์•Œ๋ฆฌ๊ณ  ๋ณ„๋„ ๋™์˜๋ฅผ ๋ฐ›๊ฑฐ๋‚˜, ์ธ์ฆ ๋˜๋Š” ์ธ์ • ๋“ฑ ์ ๋ฒ• ์š”๊ฑด์„ ์ค€์ˆ˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์™€์˜ ๊ณ„์•ฝ์˜ ์ฒด๊ฒฐ ๋ฐ ์ดํ–‰์„ ์œ„ํ•œ ๊ฐœ์ธ์ •๋ณด์˜ ๊ตญ์™ธ ์ฒ˜๋ฆฌ์œ„ํƒยท๋ณด๊ด€์— ๋Œ€ํ•ด ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ๋Š” ๊ฒฝ์šฐ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ๋ชจ๋‘ ํฌํ•จํ•˜์—ฌ ์ ์ ˆํ•œ ๋ฐฉ๋ฒ•์œผ๋กœ ์•Œ๋ฆฌ๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ๊ด€๋ จ ๋ฒ•๋ น ์ค€์ˆ˜ ๋ฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ ๋“ฑ์— ๊ด€ํ•œ ์‚ฌํ•ญ์„ ํฌํ•จํ•˜์—ฌ ๊ตญ์™ธ ์ด์ „์— ๊ด€ํ•œ ๊ณ„์•ฝ์„ ์ฒด๊ฒฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ๊ตญ์™ธ๋กœ ์ด์ „ํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฅผ ์œ„ํ•˜์—ฌ ํ•„์š”ํ•œ ์กฐ์น˜๋ฅผ ์ทจํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ28์กฐ์˜8(๊ฐœ์ธ์ •๋ณด์˜ ๊ตญ์™ธ ์ด์ „), ์ œ28์กฐ์˜9(๊ฐœ์ธ์ •๋ณด์˜ ๊ตญ์™ธ ์ด์ „ ์ค‘์ง€ ๋ช…๋ น), ์ œ28์กฐ์˜10(์ƒํ˜ธ์ฃผ์˜), ์ œ28์กฐ์˜11(์ค€์šฉ๊ทœ์ •)", + "๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ ์ด์ „ ์šด์˜ ๋“ฑ์— ๊ด€ํ•œ ๊ทœ์ •" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ ์ด์ „ ๊ด€๋ จ ๋™์˜ ์–‘์‹", + "๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ ์ด์ „ ๊ด€๋ จ ๊ณ„์•ฝ์„œ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ", + "๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ ์ฒ˜๋ฆฌ์œ„ํƒยท๋ณด๊ด€ ๊ด€๋ จ ํ†ต์ง€ ๋˜๋Š” ๊ณต๊ฐœ ๋‚ด์—ญ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ณผ์ •์—์„œ ๊ตญ์™ธ ์‚ฌ์—…์ž์—๊ฒŒ ๊ฐœ์ธ์ •๋ณด ์ œ3์ž ์ œ๊ณต์ด ๋ฐœ์ƒํ•˜์˜€์œผ๋‚˜, ์ธ์ฆ, ๋Œ€์ƒ๊ตญ ์ธ์ • ๋“ฑ ๋™์˜ ์˜ˆ์™ธ ์š”๊ฑด์— ํ•ด๋‹น๋˜์ง€ ์•Š์Œ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ ์ด์ „์— ๋Œ€ํ•œ ๋ณ„๋„ ๋™์˜๋ฅผ ๋ฐ›์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ตญ์™ธ ํด๋ผ์šฐ๋“œ ์„œ๋น„์Šค(๊ตญ์™ธ ๋ฆฌ์ „)๋ฅผ ์ด์šฉํ•˜์—ฌ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ์œ„ํƒ ๋ฐ ๋ณด๊ด€์„ ํ•˜๋ฉด์„œ ์ด์ „๋˜๋Š” ๊ตญ๊ฐ€, ์ด์ „ ๋ฐฉ๋ฒ• ๋“ฑ ๊ด€๋ จ ์‚ฌํ•ญ์„ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜๊ฑฐ๋‚˜ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์•Œ๋ฆฌ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด ๊ตญ์™ธ ์ด์ „์— ๋Œ€ํ•œ ๋™์˜๋ฅผ ๋ฐ›์œผ๋ฉด์„œ ์ด์ „๋ฐ›๋Š” ์ž์˜ ๋ช…์นญ(์—…์ฒด๋ช…)๋งŒ ๊ณ ์ง€ํ•˜๊ณ  ์ด์ „๋˜๋Š” ๊ตญ๊ฐ€ ๋“ฑ์— ๋Œ€ํ•˜์—ฌ ์•Œ๋ฆฌ์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.4.1", + "Name": "๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ", + "Description": "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๋ฐ ํŒŒ๊ธฐ ๊ด€๋ จ ๋‚ด๋ถ€ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๊ฒฝ๊ณผ, ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ๋“ฑ ํŒŒ๊ธฐ ์‹œ์ ์ด ๋„๋‹ฌํ•œ ๋•Œ์—๋Š” ํŒŒ๊ธฐ์˜ ์•ˆ์ „์„ฑ ๋ฐ ์™„์ „์„ฑ์ด ๋ณด์žฅ๋  ์ˆ˜ ์žˆ๋Š” ๋ฐฉ๋ฒ•์œผ๋กœ ์ง€์ฒด ์—†์ด ํŒŒ๊ธฐํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.4. ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.4.1 ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๋ฐ ํŒŒ๊ธฐ์™€ ๊ด€๋ จ๋œ ๋‚ด๋ถ€ ์ •์ฑ…์„ ์ˆ˜๋ฆฝํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ๋ชฉ์ ์ด ๋‹ฌ์„ฑ๋˜๊ฑฐ๋‚˜ ๋ณด์œ ๊ธฐ๊ฐ„์ด ๊ฒฝ๊ณผํ•œ ๊ฒฝ์šฐ ์ง€์ฒด ์—†์ด ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•  ๋•Œ์—๋Š” ๋ณต๊ตฌยท์žฌ์ƒ๋˜์ง€ ์•Š๋„๋ก ์•ˆ์ „ํ•œ ๋ฐฉ๋ฒ•์œผ๋กœ ํŒŒ๊ธฐํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ์— ๋Œ€ํ•œ ๊ธฐ๋ก์„ ๋‚จ๊ธฐ๊ณ  ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ21์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ)", + "๊ฐœ์ธ์ •๋ณด์˜ ์•ˆ์ „์„ฑ ํ™•๋ณด์กฐ์น˜ ๊ธฐ์ค€ ์ œ13์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ๋ณด์œ ๊ธฐ๊ฐ„ ๋ฐ ํŒŒ๊ธฐ ๊ด€๋ จ ๊ทœ์ •", + "๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ๊ฒฐ๊ณผ(ํšŒ์› ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ๋“ฑ)", + "๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ๊ด€๋ฆฌ๋Œ€์žฅ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํšŒ์› ํƒˆํ‡ด ๋“ฑ ๋ชฉ์ ์ด ๋‹ฌ์„ฑ๋˜๊ฑฐ๋‚˜ ๋ณด์œ ๊ธฐ๊ฐ„์ด ๊ฒฝ๊ณผ๋œ ๊ฒฝ์šฐ ํšŒ์› ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์—์„œ๋Š” ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜์˜€์œผ๋‚˜, CRMยทDW ๋“ฑ ์—ฐ๊ณ„๋œ ๊ฐœ์ธ์ •๋ณด์ฒ˜๋ฆฌ์‹œ์Šคํ…œ์— ๋ณต์ œ๋˜์–ด ์ €์žฅ๋˜์–ด ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ํŠน์ • ๊ธฐ๊ฐ„ ๋™์•ˆ ์ด๋ฒคํŠธ๋ฅผ ํ•˜๋ฉด์„œ ์ˆ˜์ง‘๋œ ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•˜์—ฌ ์ด๋ฒคํŠธ๊ฐ€ ์ข…๋ฃŒ๋œ ์ดํ›„์—๋„ ํŒŒ๊ธฐ ๊ธฐ์ค€์ด ์ˆ˜๋ฆฝ๋˜์–ด ์žˆ์ง€ ์•Š๊ฑฐ๋‚˜ ํŒŒ๊ธฐ๊ฐ€ ์ด๋ฃจ์–ด์ง€๊ณ  ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ์ฝœ์„ผํ„ฐ์—์„œ ์ˆ˜์ง‘๋˜๋Š” ๋ฏผ์›์ฒ˜๋ฆฌ ๊ด€๋ จ ๊ฐœ์ธ์ •๋ณด(์ƒ๋‹ด์ด๋ ฅ, ๋…น์ทจ ๋“ฑ)๋ฅผ ์ „์ž์ƒ๊ฑฐ๋ž˜๋ฒ•์„ ๊ทผ๊ฑฐ๋กœ 3๋…„๊ฐ„ ๋ณด์กดํ•˜๊ณ  ์žˆ์œผ๋‚˜, 3๋…„์ด ๊ฒฝ๊ณผํ•œ ํ›„์—๋„ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๋ธ”๋ก์ฒด์ธ ๋“ฑ ๊ธฐ์ˆ ์  ํŠน์„ฑ์œผ๋กœ ์ธํ•˜์—ฌ ๋ชฉ์ ์ด ๋‹ฌ์„ฑ๋œ ๊ฐœ์ธ์ •๋ณด์˜ ์™„์ „ ํŒŒ๊ธฐ๊ฐ€ ์–ด๋ ค์›Œ ์™„์ „ํŒŒ๊ธฐ ๋Œ€์‹  ์ต๋ช…์ฒ˜๋ฆฌ๋ฅผ ํ•˜์˜€์œผ๋‚˜, ์ต๋ช…์ฒ˜๋ฆฌ๊ฐ€ ์ ์ ˆํ•˜๊ฒŒ ์ˆ˜ํ–‰๋˜์ง€ ์•Š์•„ ์ผ๋ถ€ ๊ฐœ์ธ์ •๋ณด์˜ ์žฌ์‹๋ณ„ ๋“ฑ ๋ณต์›์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.4.2", + "Name": "์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„ ๋ณด์œ  ์‹œ ์กฐ์น˜", + "Description": "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๊ฒฝ๊ณผ ๋˜๋Š” ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„์—๋„ ๊ด€๋ จ ๋ฒ•๋ น ๋“ฑ์— ๋”ฐ๋ผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ๋ณด์กดํ•˜๋Š” ๊ฒฝ์šฐ์—๋Š” ํ•ด๋‹น ๋ชฉ์ ์— ํ•„์š”ํ•œ ์ตœ์†Œํ•œ์˜ ํ•ญ๋ชฉ์œผ๋กœ ์ œํ•œํ•˜๊ณ  ๋‹ค๋ฅธ ๊ฐœ์ธ์ •๋ณด์™€ ๋ถ„๋ฆฌํ•˜์—ฌ ์ €์žฅยท๊ด€๋ฆฌํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.4. ๊ฐœ์ธ์ •๋ณด ํŒŒ๊ธฐ ์‹œ ๋ณดํ˜ธ์กฐ์น˜", + "Section": "3.4.2 ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„ ๋ณด์œ  ์‹œ ์กฐ์น˜", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๊ฒฝ๊ณผ ๋˜๋Š” ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„์—๋„ ๊ด€๋ จ ๋ฒ•๋ น ๋“ฑ์— ๋”ฐ๋ผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ๋ณด์กดํ•˜๋Š” ๊ฒฝ์šฐ, ๊ด€๋ จ ๋ฒ•๋ น์— ๋”ฐ๋ฅธ ์ตœ์†Œํ•œ์˜ ๊ธฐ๊ฐ„์œผ๋กœ ํ•œ์ •ํ•˜์—ฌ ์ตœ์†Œํ•œ์˜ ์ •๋ณด๋งŒ์„ ๋ณด์กดํ•˜๋„๋ก ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด์˜ ๋ณด์œ ๊ธฐ๊ฐ„ ๊ฒฝ๊ณผ ๋˜๋Š” ์ฒ˜๋ฆฌ๋ชฉ์  ๋‹ฌ์„ฑ ํ›„์—๋„ ๊ด€๋ จ ๋ฒ•๋ น ๋“ฑ์— ๋”ฐ๋ผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ๋ณด์กดํ•˜๋Š” ๊ฒฝ์šฐ ํ•ด๋‹น ๊ฐœ์ธ์ •๋ณด ๋˜๋Š” ๊ฐœ์ธ์ •๋ณดํŒŒ์ผ์„ ๋‹ค๋ฅธ ๊ฐœ์ธ์ •๋ณด์™€ ๋ถ„๋ฆฌํ•˜์—ฌ ์ €์žฅยท๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ถ„๋ฆฌ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•˜์—ฌ ๋ฒ•๋ น์—์„œ ์ •ํ•œ ๋ชฉ์  ๋ฒ”์œ„ ๋‚ด์—์„œ๋งŒ ์ฒ˜๋ฆฌ ๊ฐ€๋Šฅํ•˜๋„๋ก ๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๋ถ„๋ฆฌ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•˜์—ฌ ์ ‘๊ทผ๊ถŒํ•œ์„ ์ตœ์†Œํ•œ์˜ ์ธ์›์œผ๋กœ ์ œํ•œํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ21์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ํŒŒ๊ธฐ)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ๋ณด์œ ๊ธฐ๊ฐ„ ๋ฐ ํŒŒ๊ธฐ ๊ด€๋ จ ๊ทœ์ •", + "๋ถ„๋ฆฌ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ํ˜„ํ™ฉ(ํ…Œ์ด๋ธ” ๊ตฌ์กฐ ๋“ฑ)", + "๋ถ„๋ฆฌ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค ์ ‘๊ทผ๊ถŒํ•œ ํ˜„ํ™ฉ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ํƒˆํ‡ดํšŒ์› ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ์ „์ž์ƒ๊ฑฐ๋ž˜๋ฒ•์— ๋”ฐ๋ผ ์ผ์ •๊ธฐ๊ฐ„ ๋ณด๊ด€ํ•˜๋ฉด์„œ Flag๊ฐ’๋งŒ ๋ณ€๊ฒฝํ•˜์—ฌ ๋‹ค๋ฅธ ํšŒ์›์ •๋ณด์™€ ๋™์ผํ•œ ํ…Œ์ด๋ธ”์— ๋ณด๊ด€ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ์ „์ž์ƒ๊ฑฐ๋ž˜๋ฒ•์— ๋”ฐ๋ฅธ ์†Œ๋น„์ž ๋ถˆ๋งŒ ๋ฐ ๋ถ„์Ÿ์ฒ˜๋ฆฌ์— ๊ด€ํ•œ ๊ธฐ๋ก์— ๋Œ€ํ•ด ๊ด€๋ จ ๋ฒ•์  ์š”๊ฑด์„ ์ž˜๋ชป ์ ์šฉํ•˜์—ฌ 3๋…„์ด ์•„๋‹Œ 5๋…„๊ฐ„ ๋ณด์กดํ•˜๋„๋ก ์ •ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๋ถ„๋ฆฌ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค๋ฅผ ๊ตฌ์„ฑํ•˜์˜€์œผ๋‚˜ ์ ‘๊ทผ๊ถŒํ•œ์„ ๋ณ„๋„๋กœ ์„ค์ •ํ•˜์ง€ ์•Š์•„ ์—…๋ฌด์ƒ ์ ‘๊ทผ์ด ๋ถˆํ•„์š”ํ•œ ์ธ์›๋„ ๋ถ„๋ฆฌ ๋ฐ์ดํ„ฐ๋ฒ ์ด์Šค์— ์ž์œ ๋กญ๊ฒŒ ์ ‘๊ทผ์ด ๊ฐ€๋Šฅํ•œ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ํƒˆํ‡ดํšŒ์› ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜์ง€ ์•Š๊ณ  ์ „์ž์ƒ๊ฑฐ๋ž˜๋ฒ•์— ๋”ฐ๋ผ ๊ณ„์•ฝ ๋˜๋Š” ์ฒญ์•ฝ์ฒ ํšŒ, ๋Œ€๊ธˆ๊ฒฐ์ œ ๋ฐ ์žฌํ™” ๊ณต๊ธ‰์— ๊ด€ํ•œ ๊ธฐ๋ก์„ ๋ถ„๋ฆฌํ•˜์—ฌ ๋ณด์กดํ•˜์˜€์œผ๋‚˜, ์ „์ž์ƒ๊ฑฐ๋ž˜๋ฒ•์— ๋”ฐ๋ฅธ ๋ณด์กด์˜๋ฌด๊ฐ€ ์—†๋Š” ์„ ํƒ์ •๋ณด๊นŒ์ง€ ๊ณผ๋„ํ•˜๊ฒŒ ๋ณด์กดํ•œ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.5.1", + "Name": "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ ๊ณต๊ฐœ", + "Description": "๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ ๋ชฉ์  ๋“ฑ ํ•„์š”ํ•œ ์‚ฌํ•ญ์„ ๋ชจ๋‘ ํฌํ•จํ•˜์—ฌ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์•Œ๊ธฐ ์‰ฝ๋„๋ก ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์„ ์ˆ˜๋ฆฝํ•˜๊ณ , ์ด๋ฅผ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์–ธ์ œ๋“ ์ง€ ์‰ฝ๊ฒŒ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ์ ์ ˆํ•œ ๋ฐฉ๋ฒ•์— ๋”ฐ๋ผ ๊ณต๊ฐœํ•˜๊ณ  ์ง€์†์ ์œผ๋กœ ํ˜„ํ–‰ํ™”ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.5. ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", + "Section": "3.5.1 ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ ๊ณต๊ฐœ", + "AuditChecklist": [ + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์„ ๋ฒ•๋ น์—์„œ ์š”๊ตฌํ•˜๋Š” ๋‚ด์šฉ์„ ๋ชจ๋‘ ํฌํ•จํ•˜์—ฌ ์•Œ๊ธฐ ์‰ฌ์šด ์šฉ์–ด๋กœ ๊ตฌ์ฒด์ ์ด๊ณ  ๋ช…ํ™•ํ•˜๊ฒŒ ์ž‘์„ฑํ•˜์˜€๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์„ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์‰ฝ๊ฒŒ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ์ธํ„ฐ๋„ท ํ™ˆํŽ˜์ด์ง€ ๋“ฑ์— ์ง€์†์ ์œผ๋กœ ํ˜„ํ–‰ํ™”ํ•˜์—ฌ ๊ณต๊ฐœํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์ด ๋ณ€๊ฒฝ๋˜๋Š” ๊ฒฝ์šฐ ์‚ฌ์œ  ๋ฐ ๋ณ€๊ฒฝ ๋‚ด์šฉ์„ ์ง€์ฒด ์—†์ด ๊ณต์ง€ํ•˜๊ณ  ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์–ธ์ œ๋“ ์ง€ ๋ณ€๊ฒฝ๋œ ์‚ฌํ•ญ์„ ์‰ฝ๊ฒŒ ์•Œ์•„ ๋ณผ ์ˆ˜ ์žˆ๋„๋ก ์กฐ์น˜ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ30์กฐ(๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์˜ ์ˆ˜๋ฆฝ ๋ฐ ๊ณต๊ฐœ), ์ œ30์กฐ์˜2(๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์˜ ํ‰๊ฐ€ ๋ฐ ๊ฐœ์„ ๊ถŒ๊ณ )" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ", + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ ๊ฐœ์ • ๊ด€๋ จ ๊ณต์ง€ ๋‚ด์—ญ(๊ฒŒ์‹œํŒ ๋“ฑ)" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœ๋˜์–ด ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘, ์ œ3์ž ์ œ๊ณต ๋‚ด์—ญ์ด ์‹ค์ œ ์ˆ˜์ง‘ ๋ฐ ์ œ๊ณตํ•˜๋Š” ๋‚ด์—ญ๊ณผ ๋‹ค๋ฅธ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ฑ…์ž„์ž์˜ ๋ณ€๊ฒฝ, ์ˆ˜ํƒ์ž ๋ณ€๊ฒฝ ๋“ฑ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ ๊ณต๊ฐœ ๋‚ด์šฉ ์ค‘์— ๋ณ€๊ฒฝ์‚ฌํ•ญ์ด ๋ฐœ์ƒํ•˜์˜€์Œ์—๋„ ์ด๋ฅผ ๋ฐ˜์˜ํ•˜์—ฌ ๋ณ€๊ฒฝํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์ด ๊ณต๊ฐœ๋Š” ๋˜์–ด ์žˆ์œผ๋‚˜, ๋ช…์นญ์ด สป๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจสผ์ด ์•„๋‹ˆ๋ผ สป๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ์ •์ฑ…สผ์œผ๋กœ ๋˜์–ด ์žˆ๊ณ  ๊ธ€์ž ํฌ๊ธฐ, ์ƒ‰์ƒ ๋“ฑ์„ ํ™œ์šฉํ•˜์—ฌ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์‰ฝ๊ฒŒ ์ฐพ์„ ์ˆ˜ ์žˆ๋„๋ก ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์ด ๋ช‡ ์ฐจ๋ก€ ๊ฐœ์ •๋˜์—ˆ์œผ๋‚˜, ์˜ˆ์ „์— ์ž‘์„ฑ๋œ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์˜ ๋‚ด์šฉ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ณต๊ฐœ๋˜์–ด ์žˆ์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ์ „์ž์ƒ๊ฑฐ๋ž˜๋ฒ•, ์ƒ๋ฒ• ๋“ฑ ๋‹ค๋ฅธ ๋ฒ•๋ น์— ๋”ฐ๋ผ ๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜์ง€ ์•„๋‹ˆํ•˜๊ณ  ์ผ์ •๊ธฐ๊ฐ„ ๋ณด๊ด€ํ•˜๊ณ  ์žˆ์œผ๋‚˜, ์ด์— ๋”ฐ๋ฅธ ๋ณด์กด๊ทผ๊ฑฐ์™€ ๋ณด์กดํ•˜๋Š” ๊ฐœ์ธ์ •๋ณด ํ•ญ๋ชฉ์„ ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ์— ๊ณต๊ฐœํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.5.2", + "Name": "์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณด์žฅ", + "Description": "์ •๋ณด์ฃผ์ฒด๊ฐ€ ๊ฐœ์ธ์ •๋ณด์˜ ์—ด๋žŒ, ์ •์ •ยท์‚ญ์ œ, ์ฒ˜๋ฆฌ์ •์ง€, ์ด์˜์ œ๊ธฐ, ๋™์˜์ฒ ํšŒ ๋“ฑ ์š”๊ตฌ๋ฅผ ์ˆ˜์ง‘ ๋ฐฉ๋ฒ•ยท์ ˆ์ฐจ๋ณด๋‹ค ์‰ฝ๊ฒŒ ํ•  ์ˆ˜ ์žˆ๋„๋ก ๊ถŒ๋ฆฌํ–‰์‚ฌ ๋ฐฉ๋ฒ• ๋ฐ ์ ˆ์ฐจ๋ฅผ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜๊ณ , ์ •๋ณด์ฃผ์ฒด์˜ ์š”๊ตฌ๋ฅผ ๋ฐ›์€ ๊ฒฝ์šฐ ์ง€์ฒด ์—†์ด ์ฒ˜๋ฆฌํ•˜๊ณ  ๊ด€๋ จ ๊ธฐ๋ก์„ ๋‚จ๊ฒจ์•ผ ํ•œ๋‹ค. ๋˜ํ•œ ์ •๋ณด์ฃผ์ฒด์˜ ์‚ฌ์ƒํ™œ ์นจํ•ด, ๋ช…์˜ˆํ›ผ์† ๋“ฑ ํƒ€์ธ์˜ ๊ถŒ๋ฆฌ๋ฅผ ์นจํ•ดํ•˜๋Š” ์ •๋ณด๊ฐ€ ์œ ํ†ต๋˜์ง€ ์•Š๋„๋ก ์‚ญ์ œ์š”์ฒญ, ์ž„์‹œ์กฐ์น˜ ๋“ฑ์˜ ๊ธฐ์ค€์„ ์ˆ˜๋ฆฝยท์ดํ–‰ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.5. ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", + "Section": "3.5.2 ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณด์žฅ", + "AuditChecklist": [ + "์ •๋ณด์ฃผ์ฒด ๋˜๋Š” ๊ทธ ๋Œ€๋ฆฌ์ธ์ด ๊ฐœ์ธ์ •๋ณด์— ๋Œ€ํ•œ ์—ด๋žŒ, ์ •์ •ยท์‚ญ์ œ, ์ฒ˜๋ฆฌ์ •์ง€ ๋ฐ ๋™์˜ ์ฒ ํšŒ ๋“ฑ(์ดํ•˜ '์—ด๋žŒ๋“ฑ์š”๊ตฌ'๋ผ ํ•จ)์„ ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘๋ฐฉ๋ฒ•ยท์ ˆ์ฐจ๋ณด๋‹ค ์–ด๋ ต์ง€ ์•„๋‹ˆํ•˜๋„๋ก ๊ถŒ๋ฆฌ ํ–‰์‚ฌ ๋ฐฉ๋ฒ• ๋ฐ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜์—ฌ ๊ณต๊ฐœํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด ๋˜๋Š” ๊ทธ ๋Œ€๋ฆฌ์ธ์ด ๊ฐœ์ธ์ •๋ณด ์—ด๋žŒ๋“ฑ์š”๊ตฌ๋ฅผ ํ•˜๋Š” ๊ฒฝ์šฐ ๊ธฐ๊ฐ„ ๋‚ด์— ์—ด๋žŒ๋“ฑ์š”๊ตฌ์— ๋”ฐ๋ฅธ ํ•„์š”ํ•œ ์กฐ์น˜๋ฅผ ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด ๋˜๋Š” ๊ทธ ๋Œ€๋ฆฌ์ธ์ด ๊ฐœ์ธ์ •๋ณด ์ˆ˜์ง‘ยท์ด์šฉยท์ œ๊ณต ๋“ฑ์˜ ๋™์˜๋ฅผ ์ฒ ํšŒํ•˜๋Š” ๊ฒฝ์šฐ ์ง€์ฒด ์—†์ด ์ˆ˜์ง‘๋œ ๊ฐœ์ธ์ •๋ณด๋ฅผ ํŒŒ๊ธฐํ•˜๋Š” ๋“ฑ ํ•„์š”ํ•œ ์กฐ์น˜๋ฅผ ์ทจํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์˜ ์—ด๋žŒ๋“ฑ์š”๊ตฌ์— ๋Œ€ํ•œ ์กฐ์น˜์— ๋ถˆ๋ณต์ด ์žˆ๋Š” ๊ฒฝ์šฐ ์ด์˜๋ฅผ ์ œ๊ธฐํ•  ์ˆ˜ ์žˆ๋„๋ก ํ•„์š”ํ•œ ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜์—ฌ ์•ˆ๋‚ดํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณด์ฃผ์ฒด์˜ ์—ด๋žŒ๋“ฑ์š”๊ตฌ ๋ฐ ์ฒ˜๋ฆฌ ๊ฒฐ๊ณผ์— ๋Œ€ํ•˜์—ฌ ๊ธฐ๋ก์„ ๋‚จ๊ธฐ๊ณ  ์žˆ๋Š”๊ฐ€?", + "์ •๋ณดํ†ต์‹ ๋ง์—์„œ ์‚ฌ์ƒํ™œ ์นจํ•ด ๋˜๋Š” ๋ช…์˜ˆํ›ผ์† ๋“ฑ ํƒ€์ธ์˜ ๊ถŒ๋ฆฌ๋ฅผ ์นจํ•ดํ•œ ๊ฒฝ์šฐ ์นจํ•ด๋ฅผ ๋ฐ›์€ ์ž๊ฐ€ ์ •๋ณดํ†ต์‹ ์„œ๋น„์Šค ์ œ๊ณต์ž์—๊ฒŒ ์ •๋ณด์˜ ์‚ญ์ œ ์š”์ฒญ ๋“ฑ์„ ํ•  ์ˆ˜ ์žˆ๋Š” ์ ˆ์ฐจ๋ฅผ ๋งˆ๋ จํ•˜์—ฌ ์‹œํ–‰ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ34์กฐ์˜2(๋…ธ์ถœ๋œ ๊ฐœ์ธ์ •๋ณด์˜ ์‚ญ์ œยท์ฐจ๋‹จ), ์ œ35์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์—ด๋žŒ), ์ œ35์กฐ์˜2(๊ฐœ์ธ์ •๋ณด์˜ ์ „์†ก ์š”๊ตฌ), ์ œ36์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ •์ •ยท์‚ญ์ œ), ์ œ37์กฐ(๊ฐœ์ธ์ •๋ณด์˜ ์ฒ˜๋ฆฌ์ •์ง€ ๋“ฑ), ์ œ37์กฐ์˜2(์ž๋™ํ™”๋œ ๊ฒฐ์ •์— ๋Œ€ํ•œ ์ •๋ณด์ฃผ์ฒด์˜ ๊ถŒ๋ฆฌ ๋“ฑ), ์ œ38์กฐ(๊ถŒ๋ฆฌํ–‰์‚ฌ์˜ ๋ฐฉ๋ฒ• ๋ฐ ์ ˆ์ฐจ)", + "์ •๋ณดํ†ต์‹ ๋ง๋ฒ• ์ œ44์กฐ(์ •๋ณดํ†ต์‹ ๋ง์—์„œ์˜ ๊ถŒ๋ฆฌ๋ณดํ˜ธ), ์ œ44์กฐ์˜2(์ •๋ณด์˜ ์‚ญ์ œ์š”์ฒญ ๋“ฑ), ์ œ44์กฐ์˜3(์ž„์˜์˜ ์ž„์‹œ์กฐ์น˜)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ๋ฐฉ์นจ", + "๊ฐœ์ธ์ •๋ณด ์—ด๋žŒ๋“ฑ์š”๊ตฌ ์ฒ˜๋ฆฌ ์ ˆ์ฐจ, ๊ด€๋ จ ์–‘์‹", + "๊ฐœ์ธ์ •๋ณด ์—ด๋žŒ๋“ฑ์š”๊ตฌ ์‹œ ์กฐ์น˜ ๋‚ด์—ญ", + "ํšŒ์› ํƒˆํ‡ด ๋ฐ ๋™์˜ ์ฒ ํšŒ ์ ˆ์ฐจ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ๊ฐœ์ธ์ •๋ณด์˜ ์—ด๋žŒ, ์ •์ •ยท์‚ญ์ œ, ์ฒ˜๋ฆฌ์ •์ง€ ์š”๊ตฌ ๋ฐฉ๋ฒ•์„ ์ •๋ณด์ฃผ์ฒด๊ฐ€ ์•Œ ์ˆ˜ ์žˆ๋„๋ก ๊ณต๊ฐœํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด์˜ ์—ด๋žŒ ์š”๊ตฌ์— ๋Œ€ํ•˜์—ฌ ์ •๋‹นํ•œ ์‚ฌ์œ ์˜ ํ†ต์ง€ ์—†์ด ์—ด๋žŒ ์š”๊ตฌ๋ฅผ ์ ‘์ˆ˜๋ฐ›์€ ๋‚ ๋กœ๋ถ€ํ„ฐ 10์ผ์„ ์ดˆ๊ณผํ•˜์—ฌ ํšŒ์‹ ํ•˜๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 3 : ๊ฐœ์ธ์ •๋ณด์˜ ์—ด๋žŒ ๋ฏผ์›์— ๋Œ€ํ•œ ์ฒ˜๋ฆฌ ๋‚ด์—ญ ๊ธฐ๋ก ๋ฐ ๋ณด๊ด€์ด ์ด๋ฃจ์–ด์ง€์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 4 : ์ •๋ณด์ฃผ์ฒด ๋‹น์‚ฌ์ž ๋˜๋Š” ์ •๋‹นํ•œ ๋Œ€๋ฆฌ์ธ์ด ๋งž๋Š”์ง€์— ๋Œ€ํ•œ ํ™•์ธ ์ ˆ์ฐจ ์—†์ด ์—ด๋žŒ ํ†ต์ง€๊ฐ€ ์ด๋ฃจ์–ด์ง€๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 5 : ๊ฐœ์ธ์ •๋ณด์˜ ์ •์ •ยท์‚ญ์ œ ์š”๊ตฌ์— ๋Œ€ํ•˜์—ฌ ์ •์ •ยท์‚ญ์ œ ์š”๊ตฌ๋ฅผ ์ ‘์ˆ˜๋ฐ›์€ ๋‚ ๋กœ๋ถ€ํ„ฐ 10์ผ์„ ์ดˆ๊ณผํ•˜์—ฌ ํšŒ์‹ ํ•˜๋Š” ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 6 : ํšŒ์› ๊ฐ€์ž… ์‹œ์—๋Š” ์˜จ๋ผ์ธ์„ ํ†ตํ•˜์—ฌ ์‰ฝ๊ฒŒ ํšŒ์› ๊ฐ€์ž…์ด ๊ฐ€๋Šฅํ•˜์˜€์œผ๋‚˜, ํšŒ์› ํƒˆํ‡ด ์‹œ์—๋Š” ์‹ ๋ถ„์ฆ ๋“ฑ ์ถ”๊ฐ€ ์„œ๋ฅ˜๋ฅผ ์ œ์ถœํ•˜๊ฒŒ ํ•˜๊ฑฐ๋‚˜ ์˜คํ”„๋ผ์ธ ๋ฐฉ๋ฌธ์„ ํ†ตํ•ด์„œ๋งŒ ๊ฐ€๋Šฅํ•˜๋„๋ก ํ•˜๋Š” ๊ฒฝ์šฐ" + ] + } + ] + }, + { + "Id": "3.5.3", + "Name": "์ •๋ณด์ฃผ์ฒด์— ๋Œ€ํ•œ ํ†ต์ง€", + "Description": "๊ฐœ์ธ์ •๋ณด์˜ ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ๋“ฑ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ํ†ต์ง€ํ•˜์—ฌ์•ผ ํ•  ์‚ฌํ•ญ์„ ํŒŒ์•…ํ•˜์—ฌ ๊ทธ ๋‚ด์šฉ์„ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ†ต์ง€ํ•˜์—ฌ์•ผ ํ•œ๋‹ค.", + "Checks": [], + "Attributes": [ + { + "Domain": "3. ๊ฐœ์ธ์ •๋ณด ์ฒ˜๋ฆฌ ๋‹จ๊ณ„๋ณ„ ์š”๊ตฌ์‚ฌํ•ญ", + "Subdomain": "3.5. ์ •๋ณด์ฃผ์ฒด ๊ถŒ๋ฆฌ๋ณดํ˜ธ", + "Section": "3.5.3 ์ •๋ณด์ฃผ์ฒด์— ๋Œ€ํ•œ ํ†ต์ง€", + "AuditChecklist": [ + "๋ฒ•์  ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹นํ•˜๋Š” ๊ฒฝ์šฐ ๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ๋˜๋Š” ๊ทธ ๋‚ด์—ญ์„ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋Š” ์ •๋ณด์‹œ์Šคํ…œ์— ์ ‘์†ํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์ฃผ๊ธฐ์ ์œผ๋กœ ํ†ต์ง€ํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?", + "๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ํ•ญ๋ชฉ์€ ๋ฒ•์  ์š”๊ตฌํ•ญ๋ชฉ์„ ๋ชจ๋‘ ํฌํ•จํ•˜๊ณ  ์žˆ๋Š”๊ฐ€?" + ], + "RelatedRegulations": [ + "๊ฐœ์ธ์ •๋ณด ๋ณดํ˜ธ๋ฒ• ์ œ20์กฐ์˜2(๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ์˜ ํ†ต์ง€)" + ], + "AuditEvidence": [ + "๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ๊ธฐ๋ก", + "๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ์–‘์‹ ๋ฐ ๋ฌธ๊ตฌ" + ], + "NonComplianceCases": [ + "์‚ฌ๋ก€ 1 : ์ „๋…„๋„ ๋ง ๊ธฐ์ค€ ์ง์ „ 3๊ฐœ์›” ๊ฐ„ ์ผ์ผ ํ‰๊ท  ์ €์žฅยท๊ด€๋ฆฌํ•˜๊ณ  ์žˆ๋Š” ๊ฐœ์ธ์ •๋ณด๊ฐ€ 100๋งŒ๋ช… ์ด์ƒ์œผ๋กœ์„œ ๊ฐœ์ธ์ •๋ณด ์ด์šฉ์ œ๊ณต ๋‚ด์—ญ ํ†ต์ง€ ์˜๋ฌด ๋Œ€์ƒ์ž์— ํ•ด๋‹น ๋จ์—๋„ ๋ถˆ๊ตฌํ•˜๊ณ  ๊ธˆ๋…„๋„์— ๊ฐœ์ธ์ •๋ณด ์ด์šฉ ๋ฐ๋‚ด์—ญ์„ ํ†ต์ง€ํ•˜์ง€ ์•Š์€ ๊ฒฝ์šฐ", + "์‚ฌ๋ก€ 2 : ๊ฐœ์ธ์ •๋ณด ์ด์šฉยท์ œ๊ณต ๋‚ด์—ญ์„ ๊ฐœ๋ณ„ ์ •๋ณด์ฃผ์ฒด์—๊ฒŒ ์ง์ ‘์ ์œผ๋กœ ํ†ต์ง€ํ•˜๋Š” ๋Œ€์‹  ํ™ˆํŽ˜์ด์ง€์—์„œ ๋‹จ์ˆœ ํŒ์—…์ฐฝ์ด๋‚˜ ๋ณ„๋„ ๊ณต์ง€์‚ฌํ•ญ์œผ๋กœ ์•ˆ๋‚ด๋งŒ ํ•œ ๊ฒฝ์šฐ" + ] + } + ] + } + ] +} diff --git a/prowler/lib/check/compliance_models.py b/prowler/lib/check/compliance_models.py index f53e49ab17..45a9b6fc76 100644 --- a/prowler/lib/check/compliance_models.py +++ b/prowler/lib/check/compliance_models.py @@ -169,6 +169,19 @@ class Mitre_Requirement(BaseModel): Checks: list[str] +# KISA-ISMS-P Requirement Attribute +class KISA_ISMSP_Requirement_Attribute(BaseModel): + """KISA ISMS-P Requirement Attribute""" + + Domain: str + Subdomain: str + Section: str + AuditChecklist: Optional[list[str]] + RelatedRegulations: Optional[list[str]] + AuditEvidence: Optional[list[str]] + NonComplianceCases: Optional[list[str]] + + # Base Compliance Model # TODO: move this to compliance folder class Compliance_Requirement(BaseModel): @@ -183,6 +196,7 @@ class Compliance_Requirement(BaseModel): ENS_Requirement_Attribute, ISO27001_2013_Requirement_Attribute, AWS_Well_Architected_Requirement_Attribute, + KISA_ISMSP_Requirement_Attribute, # Generic_Compliance_Requirement_Attribute must be the last one since it is the fallback for generic compliance framework Generic_Compliance_Requirement_Attribute, ] diff --git a/prowler/lib/outputs/compliance/compliance.py b/prowler/lib/outputs/compliance/compliance.py index 2d68e85964..b74eafa97f 100644 --- a/prowler/lib/outputs/compliance/compliance.py +++ b/prowler/lib/outputs/compliance/compliance.py @@ -7,6 +7,7 @@ from prowler.lib.outputs.compliance.ens.ens import get_ens_table from prowler.lib.outputs.compliance.generic.generic_table import ( get_generic_compliance_table, ) +from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp import get_kisa_ismsp_table from prowler.lib.outputs.compliance.mitre_attack.mitre_attack import ( get_mitre_attack_table, ) @@ -62,6 +63,15 @@ def display_compliance_table( output_directory, compliance_overview, ) + elif "kisa_isms_" in compliance_framework: + get_kisa_ismsp_table( + findings, + bulk_checks_metadata, + compliance_framework, + output_filename, + output_directory, + compliance_overview, + ) else: get_generic_compliance_table( findings, diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/__init__.py b/prowler/lib/outputs/compliance/kisa_ismsp/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py new file mode 100644 index 0000000000..8bfbff5b54 --- /dev/null +++ b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py @@ -0,0 +1,89 @@ +from colorama import Fore, Style +from tabulate import tabulate + +from prowler.config.config import orange_color + + +def get_kisa_ismsp_table( + findings: list, + bulk_checks_metadata: dict, + compliance_framework: str, + output_filename: str, + output_directory: str, + compliance_overview: bool, +): + sections = {} + kisa_ismsp_compliance_table = { + "Provider": [], + "Section": [], + "Status": [], + "Muted": [], + } + pass_count = [] + fail_count = [] + muted_count = [] + for index, finding in enumerate(findings): + check = bulk_checks_metadata[finding.check_metadata.CheckID] + check_compliances = check.Compliance + for compliance in check_compliances: + if ( + compliance.Framework.startswith("KISA") + and compliance.Version in compliance_framework + ): + for requirement in compliance.Requirements: + for attribute in requirement.Attributes: + section = attribute.Section + # Check if Section exists + if section not in sections: + sections[section] = { + "Status": f"{Fore.GREEN}PASS{Style.RESET_ALL}", + "Muted": 0, + } + if finding.muted: + if index not in muted_count: + muted_count.append(index) + sections[section]["Muted"] += 1 + else: + if finding.status == "FAIL" and index not in fail_count: + fail_count.append(index) + elif finding.status == "PASS" and index not in pass_count: + pass_count.append(index) + + # Add results to table + sections = dict(sorted(sections.items())) + for section in sections: + kisa_ismsp_compliance_table["Provider"].append(compliance.Provider) + kisa_ismsp_compliance_table["Section"].append(section) + kisa_ismsp_compliance_table["Muted"].append( + f"{orange_color}{sections[section]['Muted']}{Style.RESET_ALL}" + ) + if len(fail_count) + len(pass_count) + len(muted_count) > 1: + print( + f"\nCompliance Status of {Fore.YELLOW}{compliance_framework.upper()}{Style.RESET_ALL} Framework:" + ) + overview_table = [ + [ + f"{Fore.RED}{round(len(fail_count) / len(findings) * 100, 2)}% ({len(fail_count)}) FAIL{Style.RESET_ALL}", + f"{Fore.GREEN}{round(len(pass_count) / len(findings) * 100, 2)}% ({len(pass_count)}) PASS{Style.RESET_ALL}", + f"{orange_color}{round(len(muted_count) / len(findings) * 100, 2)}% ({len(muted_count)}) MUTED{Style.RESET_ALL}", + ] + ] + print(tabulate(overview_table, tablefmt="rounded_grid")) + if not compliance_overview: + print( + f"\nFramework {Fore.YELLOW}{compliance_framework.upper()}{Style.RESET_ALL} Results:" + ) + print( + tabulate( + kisa_ismsp_compliance_table, + headers="keys", + tablefmt="rounded_grid", + ) + ) + print( + f"{Style.BRIGHT}* Only sections containing results appear.{Style.RESET_ALL}" + ) + print(f"\nDetailed results of {compliance_framework.upper()} are in:") + print( + f" - CSV: {output_directory}/compliance/{output_filename}_{compliance_framework}.csv\n" + ) diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py new file mode 100644 index 0000000000..f23aac87b2 --- /dev/null +++ b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws.py @@ -0,0 +1,93 @@ +from prowler.lib.check.compliance_models import Compliance +from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput +from prowler.lib.outputs.compliance.kisa_ismsp.models import AWSKISAISMSPModel +from prowler.lib.outputs.finding import Finding + + +class AWSKISAISMSP(ComplianceOutput): + """ + This class represents the AWS KISA-ISMS-P compliance output. + + Attributes: + - _data (list): A list to store transformed data from findings. + - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file. + + Methods: + - transform: Transforms findings into AWS KISA-ISMS-P compliance format. + """ + + def transform( + self, + findings: list[Finding], + compliance: Compliance, + compliance_name: str, + ) -> None: + """ + Transforms a list of findings into AWS KISA-ISMS-P compliance format. + + Parameters: + - findings (list): A list of findings. + - compliance (Compliance): A compliance model. + - compliance_name (str): The name of the compliance model. + + Returns: + - None + """ + for finding in findings: + # Get the compliance requirements for the finding + finding_requirements = finding.compliance.get(compliance_name, []) + for requirement in compliance.Requirements: + if requirement.Id in finding_requirements: + for attribute in requirement.Attributes: + compliance_row = AWSKISAISMSPModel( + Provider=finding.provider, + Description=compliance.Description, + AccountId=finding.account_uid, + Region=finding.region, + AssessmentDate=str(finding.timestamp), + Requirements_Id=requirement.Id, + Requirements_Name=requirement.Name, + Requirements_Description=requirement.Description, + Requirements_Attributes_Domain=attribute.Domain, + Requirements_Attributes_Subdomain=attribute.Subdomain, + Requirements_Attributes_Section=attribute.Section, + Requirements_Attributes_AuditChecklist=attribute.AuditChecklist, + Requirements_Attributes_RelatedRegulations=attribute.RelatedRegulations, + Requirements_Attributes_AuditEvidence=attribute.AuditEvidence, + Requirements_Attributes_NonComplianceCases=attribute.NonComplianceCases, + Status=finding.status, + StatusExtended=finding.status_extended, + ResourceId=finding.resource_uid, + ResourceName=finding.resource_name, + CheckId=finding.check_id, + Muted=finding.muted, + ) + self._data.append(compliance_row) + # Add manual requirements to the compliance output + for requirement in compliance.Requirements: + if not requirement.Checks: + for attribute in requirement.Attributes: + compliance_row = AWSKISAISMSPModel( + Provider=compliance.Provider.lower(), + Description=compliance.Description, + AccountId="", + Region="", + AssessmentDate=str(finding.timestamp), + Requirements_Id=requirement.Id, + Requirements_Name=requirement.Name, + Requirements_Description=requirement.Description, + Requirements_Attributes_Domain=attribute.Domain, + Requirements_Attributes_Subdomain=attribute.Subdomain, + Requirements_Attributes_Section=attribute.Section, + Requirements_Attributes_AuditChecklist=attribute.AuditChecklist, + Requirements_Attributes_RelatedRegulations=attribute.RelatedRegulations, + Requirements_Attributes_AuditEvidence=attribute.AuditEvidence, + Requirements_Attributes_NonComplianceCases=attribute.NonComplianceCases, + Status="MANUAL", + StatusExtended="Manual check", + ResourceId="manual_check", + ResourceName="Manual check", + CheckId="manual", + Muted=False, + ) + self._data.append(compliance_row) diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/models.py b/prowler/lib/outputs/compliance/kisa_ismsp/models.py new file mode 100644 index 0000000000..98b1f00a78 --- /dev/null +++ b/prowler/lib/outputs/compliance/kisa_ismsp/models.py @@ -0,0 +1,31 @@ +from typing import Optional + +from pydantic import BaseModel + + +class AWSKISAISMSPModel(BaseModel): + """ + The AWS KISA-ISMS-P Model outputs findings in a format compliant with the AWS KISA-ISMS-P standard + """ + + Provider: str + Description: str + AccountId: str + Region: str + AssessmentDate: str + Requirements_Id: str + Requirements_Name: str + Requirements_Description: str + Requirements_Attributes_Domain: str + Requirements_Attributes_Subdomain: str + Requirements_Attributes_Section: str + Requirements_Attributes_AuditChecklist: Optional[list[str]] + Requirements_Attributes_RelatedRegulations: Optional[list[str]] + Requirements_Attributes_AuditEvidence: Optional[list[str]] + Requirements_Attributes_NonComplianceCases: Optional[list[str]] + Status: str + StatusExtended: str + ResourceId: str + ResourceName: str + CheckId: str + Muted: bool diff --git a/tests/config/config_test.py b/tests/config/config_test.py index 8445690523..1e1d235ac2 100644 --- a/tests/config/config_test.py +++ b/tests/config/config_test.py @@ -390,6 +390,8 @@ class Test_Config: "fedramp_low_revision_4_aws", "cis_2.0_gcp", "cis_1.8_kubernetes", + "kisa_isms-p_2023_aws", + "kisa_isms-p_2023-korean_aws", ] assert ( get_available_compliance_frameworks().sort() == compliance_frameworks.sort() diff --git a/tests/lib/outputs/asff/asff_test.py b/tests/lib/outputs/asff/asff_test.py index c17207481b..9f8ee6a97b 100644 --- a/tests/lib/outputs/asff/asff_test.py +++ b/tests/lib/outputs/asff/asff_test.py @@ -447,6 +447,8 @@ class TestASFF: "si-4-5", ], "FedRAMP-Low-Revision-4": ["ac-2", "au-2", "ca-7"], + "KISA-ISMS-P-2023": ["2.6.1"], + "KISA-ISMS-P-2023-korean": ["2.6.1"], }, ) diff --git a/tests/lib/outputs/compliance/fixtures.py b/tests/lib/outputs/compliance/fixtures.py index ddf0dc7e6b..7b1d069c1e 100644 --- a/tests/lib/outputs/compliance/fixtures.py +++ b/tests/lib/outputs/compliance/fixtures.py @@ -12,6 +12,7 @@ from prowler.lib.check.compliance_models import ( Mitre_Requirement_Attribute_AWS, Mitre_Requirement_Attribute_Azure, Mitre_Requirement_Attribute_GCP, + KISA_ISMSP_Requirement_Attribute, ) CIS_1_4_AWS_NAME = "cis_1.4_aws" @@ -632,3 +633,73 @@ NIST_800_53_REVISION_4_AWS = Compliance( ), ], ) +KISA_ISMSP_AWS_NAME = "kisa_isms-p_2023_aws" +KISA_ISMSP_AWS = Compliance( + Framework="KISA-ISMS-P", + Provider="AWS", + Version="2023", + Description="The ISMS-P certification, established by KISA Korea Internet & Security Agency", + Requirements=[ + Compliance_Requirement( + Id="2.5.3", + Name="User Authentication", + Description="User access to information systems", + Attributes=[ + KISA_ISMSP_Requirement_Attribute( + Domain="2. Protection Measure Requirements", + Subdomain="2.5. Authentication and Authorization Management", + Section="2.5.3 User Authentication", + AuditChecklist=[ + "Is access to information systems and personal information controlled through secure authentication?", + "Are login attempt limitations enforced?", + ], + RelatedRegulations=[ + "Personal Information Protection Act, Article 29", + "Standards for Ensuring the Safety of Personal Information, Article 5", + ], + AuditEvidence=[ + "Login screen for information systems", + "Login failure message screen", + ], + NonComplianceCases=[ + "Case 1: Insufficient authentication when accessing information systems externally.", + "Case 2: No limitation on login failure attempts.", + ], + ) + ], + Checks=[ + "cloudwatch_log_metric_filter_authentication_failures", + "cognito_user_pool_mfa_enabled", + ], + ), + Compliance_Requirement( + Id="2.5.4", + Name="User Authentication", + Description="User access to information systems", + Attributes=[ + KISA_ISMSP_Requirement_Attribute( + Domain="2. Protection Measure Requirements", + Subdomain="2.5. Authentication and Authorization Management", + Section="2.5.3 User Authentication", + AuditChecklist=[ + "Is access to information systems and personal information controlled through secure authentication?", + "Are login attempt limitations enforced?", + ], + RelatedRegulations=[ + "Personal Information Protection Act, Article 29", + "Standards for Ensuring the Safety of Personal Information, Article 5", + ], + AuditEvidence=[ + "Login screen for information systems", + "Login failure message screen", + ], + NonComplianceCases=[ + "Case 1: Insufficient authentication when accessing information systems externally.", + "Case 2: No limitation on login failure attempts.", + ], + ) + ], + Checks=[], + ), + ], +) diff --git a/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws_test.py b/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws_test.py new file mode 100644 index 0000000000..8e64325f2e --- /dev/null +++ b/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_aws_test.py @@ -0,0 +1,122 @@ +from datetime import datetime +from io import StringIO + +from freezegun import freeze_time +from mock import patch + +from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp_aws import AWSKISAISMSP +from prowler.lib.outputs.compliance.kisa_ismsp.models import AWSKISAISMSPModel +from tests.lib.outputs.compliance.fixtures import KISA_ISMSP_AWS +from tests.lib.outputs.fixtures.fixtures import generate_finding_output +from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER, AWS_REGION_EU_WEST_1 + + +class TestAWSKISAISMSP: + def test_output_transform(self): + findings = [generate_finding_output(compliance={"KISA-ISMS-P-2023": ["2.5.3"]})] + + output = AWSKISAISMSP(findings, KISA_ISMSP_AWS) + output_data = output.data[0] + assert isinstance(output_data, AWSKISAISMSPModel) + assert output_data.Provider == "aws" + assert output_data.AccountId == AWS_ACCOUNT_NUMBER + assert output_data.Region == AWS_REGION_EU_WEST_1 + assert output_data.Description == KISA_ISMSP_AWS.Description + assert output_data.Requirements_Id == KISA_ISMSP_AWS.Requirements[0].Id + assert ( + output_data.Requirements_Description + == KISA_ISMSP_AWS.Requirements[0].Description + ) + assert ( + output_data.Requirements_Attributes_Domain + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].Domain + ) + assert ( + output_data.Requirements_Attributes_Subdomain + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].Subdomain + ) + assert ( + output_data.Requirements_Attributes_Section + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].Section + ) + assert ( + output_data.Requirements_Attributes_AuditChecklist + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].AuditChecklist + ) + assert ( + output_data.Requirements_Attributes_RelatedRegulations + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].RelatedRegulations + ) + assert ( + output_data.Requirements_Attributes_AuditEvidence + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].AuditEvidence + ) + assert ( + output_data.Requirements_Attributes_NonComplianceCases + == KISA_ISMSP_AWS.Requirements[0].Attributes[0].NonComplianceCases + ) + assert output_data.Status == "PASS" + assert output_data.StatusExtended == "" + assert output_data.ResourceId == "" + assert output_data.ResourceName == "" + assert output_data.CheckId == "test-check-id" + assert output_data.Muted is False + # Test manual check + output_data_manual = output.data[1] + assert output_data_manual.Provider == "aws" + assert output_data_manual.AccountId == "" + assert output_data_manual.Region == "" + assert output_data_manual.Requirements_Id == KISA_ISMSP_AWS.Requirements[1].Id + assert ( + output_data_manual.Requirements_Description + == KISA_ISMSP_AWS.Requirements[1].Description + ) + assert ( + output_data_manual.Requirements_Attributes_Domain + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].Domain + ) + assert ( + output_data_manual.Requirements_Attributes_Subdomain + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].Subdomain + ) + assert ( + output_data_manual.Requirements_Attributes_Section + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].Section + ) + assert ( + output_data_manual.Requirements_Attributes_AuditChecklist + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].AuditChecklist + ) + assert ( + output_data_manual.Requirements_Attributes_RelatedRegulations + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].RelatedRegulations + ) + assert ( + output_data_manual.Requirements_Attributes_AuditEvidence + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].AuditEvidence + ) + assert ( + output_data_manual.Requirements_Attributes_NonComplianceCases + == KISA_ISMSP_AWS.Requirements[1].Attributes[0].NonComplianceCases + ) + assert output_data_manual.Status == "MANUAL" + assert output_data_manual.StatusExtended == "Manual check" + assert output_data_manual.ResourceId == "manual_check" + assert output_data_manual.ResourceName == "Manual check" + assert output_data_manual.CheckId == "manual" + assert output_data_manual.Muted is False + + @freeze_time(datetime.now()) + def test_batch_write_data_to_file(self): + mock_file = StringIO() + findings = [generate_finding_output(compliance={"KISA-ISMS-P-2023": ["2.5.3"]})] + output = AWSKISAISMSP(findings, KISA_ISMSP_AWS) + output._file_descriptor = mock_file + + with patch.object(mock_file, "close", return_value=None): + output.batch_write_data_to_file() + + mock_file.seek(0) + content = mock_file.read() + expected_csv = f"PROVIDER;DESCRIPTION;ACCOUNTID;REGION;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_NAME;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_DOMAIN;REQUIREMENTS_ATTRIBUTES_SUBDOMAIN;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_AUDITCHECKLIST;REQUIREMENTS_ATTRIBUTES_RELATEDREGULATIONS;REQUIREMENTS_ATTRIBUTES_AUDITEVIDENCE;REQUIREMENTS_ATTRIBUTES_NONCOMPLIANCECASES;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED\r\naws;The ISMS-P certification, established by KISA Korea Internet & Security Agency;123456789012;eu-west-1;{datetime.now()};2.5.3;User Authentication;User access to information systems;2. Protection Measure Requirements;2.5. Authentication and Authorization Management;2.5.3 User Authentication;['Is access to information systems and personal information controlled through secure authentication?', 'Are login attempt limitations enforced?'];['Personal Information Protection Act, Article 29', 'Standards for Ensuring the Safety of Personal Information, Article 5'];['Login screen for information systems', 'Login failure message screen'];['Case 1: Insufficient authentication when accessing information systems externally.', 'Case 2: No limitation on login failure attempts.'];PASS;;;;test-check-id;False\r\naws;The ISMS-P certification, established by KISA Korea Internet & Security Agency;;;{datetime.now()};2.5.4;User Authentication;User access to information systems;2. Protection Measure Requirements;2.5. Authentication and Authorization Management;2.5.3 User Authentication;['Is access to information systems and personal information controlled through secure authentication?', 'Are login attempt limitations enforced?'];['Personal Information Protection Act, Article 29', 'Standards for Ensuring the Safety of Personal Information, Article 5'];['Login screen for information systems', 'Login failure message screen'];['Case 1: Insufficient authentication when accessing information systems externally.', 'Case 2: No limitation on login failure attempts.'];MANUAL;Manual check;manual_check;Manual check;manual;False\r\n" + assert content == expected_csv diff --git a/tests/lib/outputs/outputs_test.py b/tests/lib/outputs/outputs_test.py index 76aacb7294..52a08e7fa8 100644 --- a/tests/lib/outputs/outputs_test.py +++ b/tests/lib/outputs/outputs_test.py @@ -49,7 +49,7 @@ class TestOutputs: assert unroll_list(list, ",") == "test, test1, test2" def test_parse_html_string(self): - string = "CISA: your-systems-3, your-data-1, your-data-2 | CIS-1.4: 2.1.1 | CIS-1.5: 2.1.1 | GDPR: article_32 | AWS-Foundational-Security-Best-Practices: s3 | HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii | GxP-21-CFR-Part-11: 11.10-c, 11.30 | GxP-EU-Annex-11: 7.1-data-storage-damage-protection | NIST-800-171-Revision-2: 3_3_8, 3_5_10, 3_13_11, 3_13_16 | NIST-800-53-Revision-4: sc_28 | NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, cp_9_8, pm_11_b, sc_8_3, sc_8_4, sc_13_a, sc_16_1, sc_28_1, si_19_4 | ENS-RD2022: mp.si.2.aws.s3.1 | NIST-CSF-1.1: ds_1 | RBI-Cyber-Security-Framework: annex_i_1_3 | FFIEC: d3-pc-am-b-12 | PCI-3.2.1: s3 | FedRamp-Moderate-Revision-4: sc-13, sc-28 | FedRAMP-Low-Revision-4: sc-13" + string = "CISA: your-systems-3, your-data-1, your-data-2 | CIS-1.4: 2.1.1 | CIS-1.5: 2.1.1 | GDPR: article_32 | AWS-Foundational-Security-Best-Practices: s3 | HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii | GxP-21-CFR-Part-11: 11.10-c, 11.30 | GxP-EU-Annex-11: 7.1-data-storage-damage-protection | NIST-800-171-Revision-2: 3_3_8, 3_5_10, 3_13_11, 3_13_16 | NIST-800-53-Revision-4: sc_28 | NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, cp_9_8, pm_11_b, sc_8_3, sc_8_4, sc_13_a, sc_16_1, sc_28_1, si_19_4 | ENS-RD2022: mp.si.2.aws.s3.1 | NIST-CSF-1.1: ds_1 | RBI-Cyber-Security-Framework: annex_i_1_3 | FFIEC: d3-pc-am-b-12 | PCI-3.2.1: s3 | FedRamp-Moderate-Revision-4: sc-13, sc-28 | FedRAMP-Low-Revision-4: sc-13 | KISA-ISMS-P-2023: 2.6.1 | KISA-ISMS-P-2023-korean: 2.6.1" assert ( parse_html_string(string) == """ @@ -88,6 +88,10 @@ class TestOutputs: •FedRamp-Moderate-Revision-4: sc-13, sc-28 •FedRAMP-Low-Revision-4: sc-13 + +•KISA-ISMS-P-2023: 2.6.1 + +•KISA-ISMS-P-2023-korean: 2.6.1 """ ) @@ -204,10 +208,12 @@ class TestOutputs: "PCI-3.2.1": ["s3"], "FedRamp-Moderate-Revision-4": ["sc-13", "sc-28"], "FedRAMP-Low-Revision-4": ["sc-13"], + "KISA-ISMS-P-2023": ["2.6.1"], + "KISA-ISMS-P-2023-korean": ["2.6.1"], } assert ( unroll_dict(test_compliance_dict, separator=": ") - == "CISA: your-systems-3, your-data-1, your-data-2 | CIS-1.4: 2.1.1 | CIS-1.5: 2.1.1 | GDPR: article_32 | AWS-Foundational-Security-Best-Practices: s3 | HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii | GxP-21-CFR-Part-11: 11.10-c, 11.30 | GxP-EU-Annex-11: 7.1-data-storage-damage-protection | NIST-800-171-Revision-2: 3_3_8, 3_5_10, 3_13_11, 3_13_16 | NIST-800-53-Revision-4: sc_28 | NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, cp_9_8, pm_11_b, sc_8_3, sc_8_4, sc_13_a, sc_16_1, sc_28_1, si_19_4 | ENS-RD2022: mp.si.2.aws.s3.1 | NIST-CSF-1.1: ds_1 | RBI-Cyber-Security-Framework: annex_i_1_3 | FFIEC: d3-pc-am-b-12 | PCI-3.2.1: s3 | FedRamp-Moderate-Revision-4: sc-13, sc-28 | FedRAMP-Low-Revision-4: sc-13" + == "CISA: your-systems-3, your-data-1, your-data-2 | CIS-1.4: 2.1.1 | CIS-1.5: 2.1.1 | GDPR: article_32 | AWS-Foundational-Security-Best-Practices: s3 | HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii | GxP-21-CFR-Part-11: 11.10-c, 11.30 | GxP-EU-Annex-11: 7.1-data-storage-damage-protection | NIST-800-171-Revision-2: 3_3_8, 3_5_10, 3_13_11, 3_13_16 | NIST-800-53-Revision-4: sc_28 | NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, cp_9_8, pm_11_b, sc_8_3, sc_8_4, sc_13_a, sc_16_1, sc_28_1, si_19_4 | ENS-RD2022: mp.si.2.aws.s3.1 | NIST-CSF-1.1: ds_1 | RBI-Cyber-Security-Framework: annex_i_1_3 | FFIEC: d3-pc-am-b-12 | PCI-3.2.1: s3 | FedRamp-Moderate-Revision-4: sc-13, sc-28 | FedRAMP-Low-Revision-4: sc-13 | KISA-ISMS-P-2023: 2.6.1 | KISA-ISMS-P-2023-korean: 2.6.1" ) def test_unroll_dict_to_list(self):