情報技術－セキュリティ技術－
JIS Q 27002 に基づくクラウドサービスのための情報セキュリティ管理策の実践の規範
JIS Q 27017：2016（ISO/IEC 27017：2015）（IPSJ/JSA）

平 成 28 年 12 月 20 日 制 定

日本工業標準調査会 審議（日本規格協会 発行）

著作権法により無断での複製，転載等は禁止されております。

Q 27017：2016 (ISO/IEC 27017：2015)

日本工業標準調査会標準第二部会 情報技術専門委員会 構成表
氏名所属（委員会長）

伊 藤智（委員）

青 木 裕佳子

公益社団法人日本消費生活アドバイザー・コンサルタント・相談員協会

稲 垣

総務省行政管理局

浩

国立研究開発法人産業技術総合研究所

岩 田 秀 行日本電信電話株式会社

榎 本 義 彦日本アイ・ビー・エム株式会社

山 田 美佐子

一般財団法人日本消費者協会

小 野 文 孝

東京大学

紅 林 孝 彰日本銀行金融研究所

神 保 光 子

日本電気株式会社

菅 野 育 子

愛知淑徳大学鈴 木 正 敏一般社団法人ビジネス機械・情報システム産業協会

中 山 康 子株式会社東芝西 山

新潟国際情報大学

茂

中 西 悦 子

総務省情報通信国際戦略局

平 岡 靖 敏一般財団法人日本規格協会

三 宅株式会社日立製作所

滋_____________________________________________________
主 務 大 臣：経済産業大臣

制定：平成 28.12.20

官 報 公 示：平成 28.12.20
原 案 作 成 者：一般社団法人情報処理学会（〒105-0011 東京都港区芝公園 3-5-8 機械振興会館 TEL 03-3431-2808）
一般財団法人日本規格協会（〒108-0073 東京都港区三田 3-13-12 三田 MT ビル

TEL 03-4231-8530）

審 議 部 会：日本工業標準調査会 標準第二部会（部会長 大崎 博之）
審議専門委員会：情報技術専門委員会（委員会長 伊藤 智）
この規格についての意見又は質問は，上記原案作成者又は経済産業省産業技術環境局 国際電気標準課（〒100-8901
東京都千代田区霞が関 1-3-1）にご連絡ください。
なお，日本工業規格は，工業標準化法第 15 条の規定によって，少なくとも 5 年を経過する日までに日本工業標準調査会の審議に付され，速やかに，確認，改正又は廃止されます。

著作権法により無断での複製，転載等は禁止されております。

Q 27017：2016 (ISO/IEC 27017：2015)

目 次ページ

序文 ··································································································································· 11

適用範囲························································································································· 12

引用規格························································································································· 13

定義及び略語 ··················································································································· 2

3.1 用語及び定義 ················································································································ 2
3.2 略語 ···························································································································· 3
4クラウド分野固有の概念 ···································································································· 34.1 概要 ···························································································································· 3
4.2 クラウドサービスにおける供給者関係 ················································································ 3
4.3 クラウドサービスカスタマとクラウドサービスプロバイダとの関係 ········································· 44.4 クラウドサービスにおける情報セキュリティリスクの管理 ····················································· 44.5 規格の構成 ··················································································································· 45

情報セキュリティのための方針群 ························································································ 55.1 情報セキュリティのための経営陣の方向性 ·········································································· 56

情報セキュリティのための組織 ··························································································· 76.1 内部組織 ······················································································································ 76.2 モバイル機器及びテレワーキング······················································································ 87

人的資源のセキュリティ ···································································································· 87.1 雇用前 ························································································································· 87.2 雇用期間中 ··················································································································· 97.3 雇用の終了及び変更 ······································································································· 98

資産の管理······················································································································ 98.1 資産に対する責任 ·········································································································· 98.2 情報分類 ····················································································································· 108.3 媒体の取扱い ··············································································································· 119

アクセス制御 ·················································································································· 119.1 アクセス制御に対する業務上の要求事項 ············································································ 119.2 利用者アクセスの管理 ··································································································· 119.3 利用者の責任 ··············································································································· 13
9.4 システム及びアプリケーションのアクセス制御 ··································································· 1310暗号 ···························································································································· 1410.1

暗号による管理策 ········································································································ 14

11 物理的及び環境的セキュリティ ························································································ 1611.1

セキュリティを保つべき領域 ························································································· 1611.2

装置 ·························································································································· 17（1）
著作権法により無断での複製，転載等は禁止されております。

Q 27017：2016 (ISO/IEC 27017：2015) 目次
ページ12運用のセキュリティ ······································································································· 1712.1

運用の手順及び責任 ····································································································· 1712.2

マルウェアからの保護 ·································································································· 1912.3

バックアップ ·············································································································· 1912.4

ログ取得及び監視 ········································································································ 2012.5

運用ソフトウェアの管理 ······························································································· 2212.6

技術的ぜい弱性管理 ····································································································· 2212.7

情報システムの監査に対する考慮事項 ············································································· 22

13

通信のセキュリティ ······································································································· 2313.1

ネットワークセキュリティ管理 ······················································································ 23

13.2

情報の転送 ················································································································· 23

14システムの取得，開発及び保守 ························································································ 2414.1

情報システムのセキュリティ要求事項 ············································································· 2414.2

開発及びサポートプロセスにおけるセキュリティ ······························································ 2414.3

試験データ ················································································································· 2515

供給者関係 ··················································································································· 2515.1

供給者関係における情報セキュリティ ············································································· 2515.2

供給者のサービス提供の管理 ························································································· 2616

情報セキュリティインシデント管理 ·················································································· 27

16.1

情報セキュリティインシデントの管理及びその改善 ··························································· 27

17

事業継続マネジメントにおける情報セキュリティの側面························································ 28

17.1

情報セキュリティ継続 ·································································································· 28

17.2

冗長性 ······················································································································· 2918

順守 ···························································································································· 29

18.1

法的及び契約上の要求事項の順守 ··················································································· 2918.2

情報セキュリティのレビュー ························································································· 30

附属書 A（規定）クラウドサービス拡張管理策集 ······································································ 32
附属書 B（参考）クラウドコンピューティングの情報セキュリティリスクに関する参考文献 ·············· 38
参考文献 ···························································································································· 40
解 説 ······························································································································· 41（2）
著作権法により無断での複製，転載等は禁止されております。

Q 27017：2016 (ISO/IEC 27017：2015)

まえがき
この規格は，工業標準化法第 12 条第 1 項の規定に基づき，一般社団法人情報処理学会（IPSJ）及び一般財団法人日本規格協会（JSA）から，工業標準原案を具して日本工業規格を制定すべきとの申出があり，日本工業標準調査会の審議を経て，経済産業大臣が制定した日本工業規格である。
この規格は，著作権法で保護対象となっている著作物である。
この規格の一部が，特許権，出願公開後の特許出願又は実用新案権に抵触する可能性があることに注意を喚起する。経済産業大臣及び日本工業標準調査会は，このような特許権，出願公開後の特許出願及び実用新案権に関わる確認について，責任はもたない。

（3）
著作権法により無断での複製，転載等は禁止されております。

Q 27017：2016 (ISO/IEC 27017：2015) 目次

白紙（4）
著作権法により無断での複製，転載等は禁止されております。

JIS
Q 27017：2016

日本工業規格(ISO/IEC 27017：2015)

情報技術－セキュリティ技術－
JIS Q 27002 に基づくクラウドサービスのための情報セキュリティ管理策の実践の規範
Information technology-Security techniques-Code of practice forinformation security controls based on ISO/IEC 27002 for cloud services
序文
この規格は，2015 年に第 1 版として発行された ISO/IEC 27017 を基に，技術的内容及び構成を変更することなく作成した日本工業規格である。
この規格で規定する指針は，JIS Q 27002 に規定する指針に追加し，これを補うものである。
特に，この規格は，クラウドサービスカスタマ及びクラウドサービスプロバイダのための情報セキュリティ管理策の実施を支援する指針を提示する。ある指針は管理策を実施するクラウドサービスカスタマのためのものであり，他の指針はクラウドサービスプロバイダがそれらの管理策の実施を支援するためのものである。適切な情報セキュリティ管理策の選択及び提示されている実施の手引の適用は，リスクアセスメント及び法的，契約上，規制又はその他のクラウド分野固有の情報セキュリティ要求事項に依存する。
1

適用範囲
この規格は，次の事項を提供することによって，クラウドサービスの提供及び利用に適用できる情報セキュリティ管理策のための指針を示す。
－ JIS Q 27002 に定める関係する管理策への追加の実施の手引－ クラウドサービスに特に関係する追加の管理策及びその実施の手引
この規格は，管理策及び実施の手引を，クラウドサービスプロバイダ及びクラウドサービスカスタマの双方に対して提供する。
注記 この規格の対応国際規格及びその対応の程度を表す記号を，次に示す。
ISO/IEC 27017:2015，Information technology－Security techniques－Code of practice for information
security controls based on ISO/IEC 27002 for cloud services（IDT）
なお，対応の程度を表す記号“IDT”は，ISO/IEC Guide 21-1 に基づき，“一致している”ことを示す。
2

引用規格
次に掲げる規格は，この規格に引用されることによって，この規格の規定の一部を構成する。これらの引用規格のうちで，西暦年を付記してあるものは，記載の年の版を適用し，その後の改正版（追補を含む。
）は適用しない。西暦年の付記がない引用規格は，その最新版（追補を含む。）を適用する。

著作権法により無断での複製，転載等は禁止されております。