isms-checklist

What this skill does

Inspects control items against the ISMS-P (Information Security and Personal Information Protection Management System, 정보보호 및 개인정보보호 관리체계) certification criteria. Interactively reviews three domains — Management System Establishment and Operation (관리체계 수립 및 운영), Protection Measure Requirements (보호대책 요구사항), and Personal Information Processing Stage Requirements (개인정보 처리 단계별 요구사항) — tracks compliant/non-compliant/not-applicable status, and generates a gap analysis report with prioritized remediation recommendations.

When to use

• When assessing current status before applying for initial ISMS-P certification
• When conducting an internal self-assessment ahead of a certification renewal audit
• When quickly gauging compliance status for a specific control domain
• When information security personnel are building a management system roadmap

Prerequisites

• No external tools required (checklist-based)
• Inspector's knowledge of the organization's information security policies and current state
• (Optional) KISA ISMS-P certification criteria document: https://isms.kisa.or.kr

Inputs

Item	Description	Example
ORG_NAME	Name of the organization under review	TechCompany Inc.
DOMAIN	Domain selection (1/2/3/all)	all
SCOPE	Certification scope description (optional)	All enterprise information systems and personal data processing services

Workflow

Step 1: Configure the inspection environment

ORG_NAME="${SECSKILL_ORG_NAME:-}"
if [ -z "$ORG_NAME" ]; then
  read -rp "Organization name: " ORG_NAME
fi
echo ""
echo "Select the domain(s) to inspect:"
echo "  1) Management System Establishment and Operation (관리체계 수립 및 운영) - 16 controls"
echo "  2) Protection Measure Requirements (보호대책 요구사항) - 64 controls"
echo "  3) Personal Information Processing Stage Requirements (개인정보 처리 단계별 요구사항) - 22 controls"
echo "  all) All domains - 102 controls"
DOMAIN_SEL="${SECSKILL_DOMAIN_SEL:-}"
if [ -z "$DOMAIN_SEL" ]; then
  read -rp "Selection [1/2/3/all]: " DOMAIN_SEL
fi
SCOPE="${SECSKILL_SCOPE:-}"
if [ -z "$SCOPE" ]; then
  read -rp "Certification scope (optional): " SCOPE
fi

REPORT_FILE="/tmp/isms_check_$(date +%Y%m%d_%H%M%S).md"
cat > "$REPORT_FILE" <<EOF
# ISMS-P Certification Criteria Inspection Results

- **Organization**: $ORG_NAME
- **Certification scope**: ${SCOPE:-Not specified}
- **Inspection date**: $(date '+%Y-%m-%d')
- **Domain**: $DOMAIN_SEL

---
EOF
echo "[+] Report initialized: $REPORT_FILE"