Security Management

Acceptable Use of Assets Policy

Defines permitted and prohibited use of company-owned devices, accounts, and network resources by employees and contractors.

Password Policy

Sets enforceable minimum standards for password strength, rotation, storage, and multi-factor authentication across systems.

Backup and Recovery Policy

Establishes requirements for data backup frequency, retention, testing, and restoration to protect against data loss.

Compliance Management

Coordinates how the organization tracks, evidences, and reports adherence to security regulations, standards, and contractual obligations.

Disposal and Destruction Policy

Specifies how data-bearing media and physical records must be sanitized or destroyed at end of life to prevent data exposure.

Information Classification Policy

Defines sensitivity tiers for organizational data and the handling requirements attached to each tier.

Information Transfer Policy

Governs how classified data may be exchanged internally, with partners, and with third parties, across physical and digital channels.

ISMS Policy

The top-level charter that establishes scope, objectives, and governance structure for the organization's information security management …

COBIT-Based Security Governance

How COBIT separates security governance from security management to align security controls with business value.

ISMS-P

Korea's integrated Information Security and Personal Information Management System certification, combining ISMS and PIMS.

ISO 27001

The international standard for an information security management system, built on a continuous PDCA improvement cycle.

Privacy Impact Assessment (PIA)

A procedure for analyzing and remediating personal-information risk before a system that handles personal data is built or changed.

Korea's Data 3 Acts

The legal basis for using pseudonymized and anonymized data in Korea, and the procedure for combining pseudonymized data across data …

Differential Privacy

A mathematically provable privacy mechanism that injects statistical noise so results barely change whether or not any one individual's data …

EU AI Act

The EU's risk-based legal framework that sets tiered obligations for AI systems to protect human safety, health, and fundamental rights.

5 Pseudonymization Techniques

The five core techniques for processing personal information into pseudonymized data that balances data utility with privacy.

CSAP Tiered Certification

Korea's Cloud Security Assurance Program restructured into 3 tiers by data sensitivity, and what it requires of public agencies adopting …