参考資料２「OECD 1 重要情報インフラの保護に関する理事会勧告」について
１．本勧告の要点（１）「OECD 重要情報インフラの保護に関する理事会勧告」とは・ OECD 情報コンピュータ通信政策(ICCP)委員会にて、日本を含む７カ国のベストプラクティスをもとに策定
・ インターネット経済の将来像に関する OECD 閣僚会議（2008 年 6 月 17・18 日、於ソウル）にて決定（原文は次頁以降参照）（２）「重要情報インフラ」とは「相互接続された情報システムとネットワークであり、その途絶や破壊が、国民の公衆衛生、安全、安心、経済的福祉、又は政府や経済の有効的な機能に重大な影響をもたらすもの」（３）Part１：国内レベルでの重要情報インフラ保護・ 重要情報インフラ保護に向けて、政府の指導力と責任を表明すること
例．明確な基本方針を導入、政策目的の達成のために民間部門との連携 等・ 重要情報インフラのリスクを管理
例．国家的な戦略の策定、相互依存性への考慮、CERT/CSIRT の開発、脆弱性と脅威分析に基づいたリスク管理の実行、その定期的な見直し 等
・ 民間部門との連携
例．リスク管理、インシデント対応等に焦点を当てた官民の信頼関係構築、情報の機微性を認識した上での定期的な情報交換、官民共同連携による研究開発を通じた CII の安全性向上 等（４）Part2：国境を越えたＣＩＩ保護・ 加盟国は、国家間・民間部門双方に対し、戦略、政策、オペレーションのいずれのレベルにおいても協力
・ その結果、個々の国が独力での対応能力を超えて事象や環境に対応し、重要情報インフラ保護がより確かなものになる
例．情報や経験の共有、国境を越えた依存性や相互依存性をリスクマネジメントに適用
２．今後の方向性
加盟国に対して本勧告の遂行を奨励するとともに、重要情報インフラ保護に関する問題の国際的な協力を促進するために、5 年毎に点検する。
1

OECD（Organisation for Economic Co-operation and Development：経済協力開発機構）は、先進国間の自由な意見交換・情報交換を通じて、1) 経済成長、2) 貿易自由化、3) 途上国支援に貢献することを目的に、1961 年に設立（本部：パリ）

2 –OECD RECOMMENDATION OF THE COUNCIL ON THE PROTECTION OF CRITICAL INFORMATION INFRASTRUCTURESORGANISATION FOR ECONOMIC CO-OPERATION AND DEVELOPMENTThe OECD is a unique forum where the governments of 30 democracies work
together to address the economic, social and environmental challenges of globalisation.
The OECD is also at the forefront of efforts to understand and to help governments
respond to new developments and concerns, such as corporate governance, theinformation economy and the challenges of an ageing population. The Organisation
provides a setting where governments can compare policy experiences, seek answers
to common problems, identify good practice and work to co-ordinate domestic andinternational policies.
The OECD member countries are: Australia, Austria, Belgium, Canada, the Czech
Republic, Denmark, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy,Japan, Korea, Luxembourg, Mexico, the Netherlands, New Zealand, Norway, Poland,
Portugal, the Slovak Republic, Spain, Sweden, Switzerland, Turkey, the United Kingdom
and the United States. The Commission of the European Communities takes part in thework of the OECD.

© OECD.

OECD RECOMMENDATION OF THE COUNCIL ON THE PROTECTION OF CRITICAL INFORMATION INFRASTRUCTURES – 3Foreword

This Recommendation was developed by the OECD Committee for Information,
Computer and Communication Policy (ICCP Committee), and its Working Party onInformation Security and Privacy. The Recommendation was adopted by the OECD
Council at its 1172nd Session on 30 April 2008.

© OECD.

4 –OECD RECOMMENDATION OF THE COUNCIL ON THE PROTECTION OF CRITICAL INFORMATION INFRASTRUCTURES

OECD Recommendation of the Council on theProtection of Critical Information Infrastructures

THE COUNCILHaving regard to Article 5 b) of the Convention on the Organisation for
Economic Co-operation and Development of 14 December 1960;
Having regard to the Recommendation of the Council concerning Guidelines
for the Security of Information Systems and Networks - Towards a Culture ofSecurity [C(2002)131], hereinafter the "Security Guidelines";
Having regard to the Resolution 58/199 adopted by the General Assembly of
the United Nations on the creation of a global culture of cybersecurity and theprotection of critical information infrastructures;
Recognising that the functioning of our economies and societies increasinglyrelies on information systems and networks that are interconnected andinterdependent, domestically and across borders; that a number of those systems
and networks are of national critical importance; and that their protection is apriority area for national policy and international cooperation;
Recognising that in order to improve the protection of domestic and crossborder critical information infrastructures, Member countries need to share theirknowledge and experience in developing policies and practices and cooperate moreclosely between themselves as well as with non Member economies;
Recognising that the protection of critical information infrastructures requires
coordination domestically and across borders with the private sector owners andoperators of such infrastructures, hereinafter the “private sector”;

On the proposal of the Committee for Information, Computer andCommunication Policy:
AGREES that:
For the purposes of this Recommendation, critical information infrastructures,
hereinafter “CII”,
should be understood as referring to those interconnected
information systems and networks, the disruption or destruction of which would
have a serious impact on the health, safety, security, or economic well-being ofcitizens, or on the effective functioning of government or the economy;
National CII are identified through a risk assessment process and typically
include one or more of the following:© OECD.

Information components supporting critical infrastructures, and/orOECD RECOMMENDATION OF THE COUNCIL ON THE PROTECTION OF CRITICAL INFORMATION INFRASTRUCTURES – 5

Information infrastructures supporting essential components of government
business; and/or

Information infrastructures essential to the national economy.

RECOMMENDS that:
Member countries introduce and maintain an effective framework to implement
the OECD Security Guidelines in relation to the protection of CII, taking into accountthe specific policy and operational guidance set out herein;

PART I. Protection of critical information infrastructures at thedomestic level
Member countries should:
Demonstrate government leadership and commitment to protect CII by:
Adopting clear policy objectives at the highest level of government.



Identifying government agencies and organisations with responsibility andauthority to implement these policy objectives.

Consulting with private sector owners and operators of CII to establish
mutual cooperation for the implementation of these objectives.

Ensuring transparency on the delegations of responsibility to government
authorities and agencies to facilitate closer co-operation within thegovernment and with the private sector.



Systematically reviewing policy and legal frameworks and self-regulatory
schemes which may apply to CII, including those addressing cross-borderthreats, to assess the need to enhance their implementation, to amend themor to develop new instruments.

Taking steps, where appropriate, to enhance the security level ofcomponents of information system and networks that constitute CII.

Manage risks to CII by:
Developing a national strategy that gains commitment from all thoseconcerned, including the highest levels of government and the private sector.

Taking into consideration interdependencies.

Conducting a risk assessment based on the analysis of vulnerabilities and thethreats to the CII, in order to protect economies and societies against theimpacts of highest national concern.

Developing, on the basis of the assessment, and periodically reviewing anational risk management process that sets out the detailed organisation,
tools and monitoring mechanisms required to implement the risk
management strategy at every level, including:i.

The appropriate organisational structure to provide guidelines andpromote good security practices at the national level and to manage
and monitor progress, as well as a complete set of processes to ensure© OECD.

6 –OECD RECOMMENDATION OF THE COUNCIL ON THE PROTECTION OF CRITICAL INFORMATION INFRASTRUCTURES
preparedness, including prevention, protection, response and recovery
from natural and malicious threats.
ii.

A system of measurement to evaluate and appraise measures in place(including exercises and tests as appropriate) and allow for feedback
and continuous update.

Developing an incident response capability, such as a computer security
incident response team (CERT/CSIRTs), in charge of monitoring, warning,alerting and carrying out recovery measures for CII; and mechanisms tofoster closer cooperation and communications among those involved inincident response.

Work in partnership with the private sector by:
Establishing trusted public-private partnerships with a focus on risk
management, incident response and recovery.

Enabling mutual and regular exchange of information by establishing
information sharing arrangements that acknowledge the sensitivity ofcertain information.

Fostering innovation through public-private research and development
projects focused on the improvement of the security of CII and as
appropriate, sharing these innovations across borders.

PART II. Protecting critical information infrastructures across borders
Member countries should cooperate among themselves and with the private
sector at the strategy, policy and operational levels to ensure the protection of CII
against events and circumstances beyond the capacity of individual countries toaddress alone.
They should in particular proactively engage in bilateral and multilateral
cooperation at regional and global levels with a view to:© OECD.

Share knowledge and experience with respect to the development ofdomestic policies and practices and to models for coordinating with private
sector owners and operators of critical information infrastructures.

Develop a common understanding of:i.

Risk management applicable to cross-border dependencies and interdependencies.

ii.

Generic vulnerabilities, threats and impacts on the CII, to facilitatecollective action to address those that are widespread, such as security
flaws and malicious software, as well as to improve risk management
strategies and policies.

Make available information regarding the national agencies involved in theprotection of CII, their roles and responsibilities, to facilitate identification ofcounterparts and improve the timeliness of cross border action.

Acknowledge the value of participation in international or regional networks
for watch, warning and incident response, to enable robust information

OECD RECOMMENDATION OF THE COUNCIL ON THE PROTECTION OF CRITICAL INFORMATION INFRASTRUCTURES – 7

sharing and coordination at the operational level, as well as to better manage
crisis in case of an incident developing across borders.
Support cross-border collaboration for, and information sharing on, publicprivate research and development for the protection of CII.

INVITES:
Member countries to disseminate this Recommendation throughout the publicand private sectors, including governments, businesses and other internationalorganisations to encourage all relevant participants to take the necessary steps forthe protection of CII;
Non-Member economies to take account of this Recommendation andcollaborate with Member countries in its implementation;
INSTRUCTS the OECD
Communication Policy to:

Committeefor

Information,

ComputerandPromote the implementation of this Recommendation and review it every fiveyears to foster international co-operation on issues relating to the protection of CII.

© OECD.