Information Security Policy
1. Introduction
NPO MIS (hereinafter “the Corporation”) deeply recognizes the importance of all the information assets we handle in our daily activities, and positions the appropriate and secure management and protection of those information assets as one of the organization’s most important tasks. In light of the increasingly sophisticated and complex risks, such as cyberattacks and information leaks, that have accompanied the advance of information technology in recent years, the Corporation declares that it will build a robust information security system and continuously improve and strengthen it. This Basic Policy applies to all persons involved with the Corporation and serves as a guideline for thoroughly protecting information assets.
2. Definition and Importance of Information Assets
Information assets at the Corporation include all information held and managed by the Corporation, whether on paper or in electronic form, together with the associated systems, hardware, software, and networks, as well as the people who handle the information. These include personal information, member information, supporter information, financial information, activity records, confidential documents, contracts, website information, and social media account information. Ensuring the security of these information assets is extremely important, as it directly affects the Corporation’s public trust and the continuity of its activities.
3. Ensuring the Three Elements of Information Security
The Corporation gives top priority to the confidentiality, integrity, and availability of its information assets.
- Confidentiality means that information can be accessed only by authorized persons.
- Integrity refers to a state in which the accuracy and completeness of information are guaranteed and there has been no tampering or unauthorized change.
- Availability means maintaining a state in which information and systems can be used when needed.
We recognize that protecting these three elements is the foundation of information security measures, and we will strengthen them without upsetting the balance among them.
4. Compliance with Laws, Norms, and Contracts
The Corporation will strictly comply with all domestic and international laws, regulations, guidelines, and industry standards related to information security, as well as the obligations stated in contracts concluded by the Corporation. It will also keep track of the latest developments in related laws, such as the Act on the Protection of Personal Information, the Act on Regulation of Transmission of Specified Electronic Mail, and the Act on the Prohibition of Unauthorized Computer Access, and respond appropriately. In this way, the Corporation will avoid legal risks and fulfill its social responsibilities.
5. Establishment and Operation of an Organizational System
The Corporation will make all persons involved aware of the importance of information security, clarify authority and responsibilities, and work to maintain and strengthen its security system.
6. Risk Management
The Corporation will regularly assess the risks to its information assets and identify vulnerabilities and potential threats. It will introduce appropriate control measures according to the size of the risks to reduce or avoid them. Specific measures will be taken from multiple angles, including technical measures (introducing firewalls and antivirus software) and human measures (education and training, access rights management).
7. Thorough Human Security
The Corporation will provide regular education and training to all persons involved to raise awareness of information security. It will clarify policies and procedures related to information security, impose confidentiality obligations, and take strict measures, including disciplinary action, against violators. It will also conduct appropriate screening when members join, and will have information assets returned and access rights revoked when members leave.
8. Strengthening System and Network Security
To ensure the secure operation of IT systems and networks, the Corporation implements technical measures such as the following.
- Blocking unauthorized external access with firewalls
- Introducing and regularly updating the latest antivirus software
- Building a monitoring system with an intrusion detection system (IDS)
- Regularly inspecting systems for vulnerabilities and addressing them promptly
- Minimizing access rights (granting only the minimum necessary privileges)
- Tightening password management policies and promoting the introduction of multi-factor authentication
9. Building an Incident Response System
To prepare for information security incidents, the Corporation will develop an incident response manual to enable prompt and accurate responses. This includes an immediate reporting system upon discovery, investigation of causes, prevention of further damage, impact assessment, recovery measures, and the planning and implementation of measures to prevent recurrence. Regular drills will be conducted to strengthen response capabilities.
10. Management of Contractors
When outsourcing information processing work, the Corporation will rigorously evaluate the contractor’s information security management system. It will establish audits of and reporting obligations for contractors and make every effort to minimize the risk of information leaks. The same evaluation will be carried out when a contractor is changed.
11. Promoting Information Security Education
The Corporation will provide regular and systematic information security education to all members to raise security awareness and promote the acquisition of knowledge. This will be carried out continuously using a variety of methods, such as regular training and e-learning. The Corporation will also consistently raise awareness of phishing scams and social engineering.
12. Continuous Improvement and Audits
Based on an information security management system (ISMS), the Corporation will conduct regular internal audits and third-party audits to evaluate compliance with this Policy and the effectiveness of its measures. Based on the results, it will draw up improvement plans and carry out concrete improvement activities. It will continuously make improvements so that it can respond promptly to technological advances and new threats.
13. Social Responsibility and Transparency
The Corporation will publish the status of its information security measures as appropriate to ensure transparency toward society and persons involved. In the event of an information leak or security incident, it will promptly make this public and do its utmost to minimize the damage and restore trust. In this way, the Corporation will fulfill its social responsibilities and work to maintain and strengthen relationships of trust.
14. Review of This Policy
This Basic Policy will be reviewed as appropriate in response to amendments to laws, changes in the social environment, technological progress, the emergence of new threats, and so on, and the latest version will be published. Revisions will be promptly and thoroughly communicated to all staff, and the latest information security system will be maintained at all times.
Established: October 23, 2026