South Korea ISMS-P 2.10.1: Security system operation

Operating procedures exist for each security system in use; administrators and others with access are kept to a minimum and unauthorised access tightly controlled; policy registration, change and deletion follow a formal procedure; exception rules are managed by procedure with least privilege; rule sets are reviewed periodically for validity; and security systems performing the functions required by law are installed to prevent unlawful access to and leakage from personal information processing systems (PIPA Article 29; Standards for Securing Personal Information Article 6).