Guide to Protecting Cloud Service Usersand Ensuring Compliance
For Appropriate Risk Management by Top Management

Version 1.0

June 2011

ASP-SaaS-Cloud ConsortiumTable of Contents
Chapter 1

Purpose and outline of this guide .................................................................... 1

1.

How to read this guide ............................................................................................... 1

2.

Many advantages of cloud services ........................................................................... 4

3.

Why risk management is necessary when using cloud services ................................ 6

4.

Coverage of this guide in terms of users’ rights and ensuring their compliance ......... 6

Chapter 2

Effective risk management system for cloud service users ............................. 8

1.

Important prior arrangement for risk management ..................................................... 92.

Comparing and selecting cloud providers and services with less risks .................... 11

3.

Mitigating risks upon agreeing to use cloud services ............................................... 13

4.

Risk management issues while using cloud services ............................................... 14

5.

Risk management issues at renewal or end of agreement ...................................... 15

Chapter 3

Points to confirm............................................................................................ 16

1.

Points to confirm to protect cloud users’ rights and ensure their compliance ........... 16

2.

Special points to confirm when users’ data are recorded at overseas datacenters .. 21

3.

Preventing an awareness gap between users and cloud services providers ........... 22

Reference 1

Glossary .................................................................................................... 24

Reference 2

Guidelines related to cloud services .......................................................... 26

Reference 3

Data related to users’ rights and compliance ............................................. 28

This guide is published by ASP-SaaS-Cloud Consortium through the process of publiccomment requests. This guide is described based on the discussion in FY 2010 of Cloud
User’s Rights Protection Review Committee of ASP-SaaS-Cloud Promotion Conference
that is co-founded by Japan’s Ministry of Internal Affairs and Communications and
ASPIC.

Copyright © 2011 ASP-SaaS-Cloud Consortium, All rights reserved.

Chapter 1
1.

Purpose and outline of this guide

How to read this guide(1) Purpose of this guide
Cloud services are currently expanding all over the world. There are many cloudservice providers that offer borderless global services. As cloud service providers
and services become increasingly diverse, so there are an increasing number ofboth excellent providers and services that can bring clear profits to users and risky
providers and services that do not satisfy users’ security policies. Therefore it
becomes important for users to be able to cleverly choose reliable cloud providers
and services.
This guide provides enterprises that intend to use public cloud services (seeReference 1) with comprehensive information on risk management processes andpoints requiring confirmation. The aim is to help them choose cloud service
providers and services that match their risk management policies, implement
adequate risk management systems and use services safely. We chose public
cloud services because this service model typically brings particular merits andcharacteristics of cloud services. However, this guide also provides enterprisesthat plan to use private cloud services (see Reference 1) with useful information onrisk management processes.
(2) Who should read this guide?
This guide describes issues that corporate managers who plan to use or alreadyuse public cloud services are recommended to read.

1.

Corporate managers of large corporations with a board of directors and listed corporations:
The guide helps corporate managers to fulfill their duty of diligence and establish adequate risk
management systems and processes that enable corporations to safely use cloud services.

2.

Corporate managers of small and medium-sized corporations:
The guide helps corporate managers to dispel illusions that all cloud services are risky, remove theneed for in-house IT specialists, and enable cloud services to be used safely and cost-effectively.

3.

Corporate managers of a global enterprise:
The guide illustrates the checkpoints for protecting users’ rights and ensuring users’ compliance when
global enterprises use borderless global cloud services.

(3) How to read this guideThis guide consists of three chapters and three references.
Chapter 1 describes the following:- How to read this guide- Merit of cloud services and need to implement risk management systems
1-

Legal structures related to user’s rights and ensuring compliance that arecovered in version 1 and will be covered in the following versions.
Chapter 2 describes recommended risk management processes that should beexecuted at each stage of the cloud service utilization cycle. In this chapter, both
recommended directions to persons in charge by corporate managers and issues
that should be judged and determined by corporate managers are covered.
Chapter 3 describes points requiring confirmation from three viewpoints.
Guidelines and rules for the enforcement of laws that are necessary to confirm
protection of users’ rights and ensure their compliance are listed in Reference 3.

Chapter 1 Purpose and outline of this guide
1. How to read this guide
2. Many advantages of cloud services
3. Why risk management is necessary when using cloud services
4. Coverage of this guide in terms of users’ rights and ensuring their compliance
Chapter 2 Effective risk management system for cloud service users
1. Important prior arrangement for risk management
2. Comparing and selecting cloud providers and services with less risks
3. Mitigating risks upon agreeing to use cloud services
4. Risk management issues while using cloud services
5. Risk management issues at renewal or end of agreement
Chapter 3 Considerations requiring focused confirmation
1. Points to confirm to protect cloud users’ rights and ensure their compliance2. Special points to confirm when users’ data are recorded at overseas datacenters
3. Preventing an awareness gap between users and cloud services providers
Reference 1

Glossary

Reference 2

Guidelines related to cloud services

Reference 3

Data related to users’ rights and compliance

All corporate managers are recommended to read Chapter 1.
Corporate managers who are going to implement risk management systems forcloud services should read Chapter 2 and Chapter 3.
Corporate managers who have already implemented risk management systems
for cloud services can use this guide to strengthen their system with pinpoint
countermeasures by reading the necessary part of Chapter 3.
The parts of this guide that each user should read differ according to the type ofuser information to be recorded in cloud services and location of the datacenter.
Please refer to the figure on the next page.

2

Read
Chapter 1*Trade secrets, information related to the activities ofmanagements, electronic data and logs that are related tofinancial reporting, private information, technologicalinformation, national tax records, etc.

Do you plan torecord information
which may generaterisks* in cloudservices?

NO

You are recommended to read Chapter
2 and Chapter 3 to brush up your basic
knowledge on using cloud services.

YES
Read
Chapter 2*Please refer to 1. in Chapter 3 to find which partyou should read.
Read necessary part of “1. (1)(2)”* of Chapter 3

Do you have a plan torecord your data inoverseas datacenters?

YES

Read Chapter 3
2.

NO
Read Chapter 33.

(4) Main focus of this guide and related guidelines (see reference 2)This guide provides corporate managers with comprehensive information on risk
management processes and points requiring confirmation at each stage of thecloud service utilization cycle. This guide is unique because it stresses theprotection of users’ rights and ensuring their compliance.
There is another guideline and another guidance that are written for cloud service
users:
Guideline for Information Security Management when using cloud Services(METI, Apr. 2011)
Guidance for Safe Use of Cloud Services by Small and Medium-Sized
Enterprises (IPA, Apr. 2011)3

2.

Many advantages of cloud services(1) Paradigm shift from “owning computing resources” to “outsourcing computing
resources”
Helped by the rapid popularization of broadband networks in Japan, enterprises
are steadily entering an era in which they outsource IT systems instead ofdeveloping them by themselves. Recently many cloud service providers havecome to equip datacenters with a large amount of black-boxed computing
resources. As a result, users are now able to select and start using services andcomputing resources promptly after they select them from catalogs.

Owned by Users

Outsourced by UsersEnterprise facility

Do not buy
servers or
storagesEnterprise Facility

Internet, etc.

Buy servers
and storages

Uniform, largescale andblack-boxed

・・・
・・・

企業の施設内
企業の施設内
企業の施設内 Enterprise facility

Cloud service provider’s facility

Shared by users(2) Clear advantages of public cloud
Cloud services offer many advantages. Some of them as follows:* These advantages are not limited to public clouds, but they are obvious in thecase of public clouds.
Powerful tools for speedy corporate management
In general, it is necessary to invest in ICT systems and networks when enterprises
launch new business or entrepreneurial ventures are set up. Cloud services
enable enterprises to outsource the necessary ICT resources in a short time and in
an inexpensive way. Thus, it becomes easier for enterprises to realize speedy
management by actively testing out new businesses.
Tools for focused investment in competitiveness and differentiation of enterprises
The competitiveness of enterprises is improved if they can differentiate themselves
4

from other enterprises. By applying cloud services to administrative andaccounting work that do not relate to strategic differentiation, enterprises can turn
ICT cost and manpower into strategic differentiation in their business fields.
Also, enterprises do not need to incur costs for upgrading their systems.
Furthermore, small and medium-sized enterprises can improve the quality of theiradministrative and accounting work by using the same functions as large
enterprises that are provided by cloud services.
Tool for green activities by enterprises
Enterprises can effectively decrease their CO2 emissions by using cloud services
that are operated in datacenters with high energy efficiency.
Tools to improve abilities to respond to natural disasters
Widespread natural disasters may occur at any time. Cloud services are a useful
tool for enterprises to ensure a business continuity plan in the event of a large
natural disaster.
Release or relief from burden of tasks related to ICT procurement
Small and medium-sized enterprises can start using ICT more easily because the
ICT procurement process becomes much easier by using cloud services.
Release or relief from burden of ICT operation and maintenance tasks
Releasing or relieving enterprises of the burden of ICT operation and maintenancetasks is a very attractive advantage of cloud services for small and medium-sizedenterprises that lack ICT specialists.
Release or relief from burden of information security tasks
Small and medium-sized enterprises often have some problems in information
security in their ICT systems because they may have an insufficient number of
employees who specialize in information security.
By using cloud services that are operated at datacenters with a high level of
information security and sufficient number of information security specialists, small
and medium-sized enterprises can expect to see improvements in the level of theirinformation security management.

5

3.

Why risk management is necessary when using cloud services

Although public cloud services have many advantages, risk control over cloud service
providers may become limited because physical ICT resources are black-boxed andtheir operation and maintenance are outsourced. This limited governance may
potentially generate various kinds of secondary risks (see Reference 1). For instance,
the following accidents may occur:
1. A claim over ownership of trade secrets is not approved because an enterprise
does not sufficiently manage its secrets.
2. Society could lose its trust in an enterprise if such enterprise divulges a large
amount of private information.
3. Technical information that is restricted in terms of sending it to foreign countries
could possibly be leaked by cloud service providers whose datacenters arelocated overseas.
4. Secret information could be divulged if cloud service providers do not delete users’
data completely.
It should be a duty of corporate managers in large enterprises with a board of
directors and in listed enterprises to establish risk management systems.
By thinking of the issues described above, corporate managers are recommended totake the initiative in developing systems that apply risk management processes toeach stage of the cloud service utilization cycle.

4.

Coverage of this guide in terms of users’ rights and ensuring theircomplianceThis guide stresses the protection of users’ rights and ensuring their compliance. The
kind of legal structures that Version 1 of this guide covers is shown in the following
text box. In the following version, we intend to extend the coverage of legal structuresthat should be focused on.

6

Legal structures covered by Version 1 of this guide
1. Protecting users’ rights-

Protection of Trade Secrets by Unfair Competition Prevention Act (management of trade
secrets)

2. Ensuring users’ compliance-

The Companies Act and so-called J-SOX Act-

The Personal Information Protection Law
Health insurance and welfare; broadcasting and postal area; economy and industry;
employment management; legal issues; corporate pensions; foreign affairs; financial
matters; agriculture; forestry and fisheries area; land and transport; and the environment.

-

The Foreign Exchange and Foreign Trade Control Law (prevention of outflow oftechnological information)-

The Law Concerning Preservation of National Tax Records in Electronic Form, theCorporation Tax Act, and so on (preserving books in electronic form)

Legal structures that will be covered in later versions of this guide
1. Protecting users’ rights-

Legal structures related to intellectual property right (industrial property right, copyrightand so on)

2. Ensuring users’ compliance-

The Personal Information Protection Law
Healthcare and nursing, monetary and credit matters, business area using study results inmedical and genetics fields and the related information, labor-related issues, education,and police and defense-

Legal structures that allows preservation of books, ledgers, drawings and so on based on
the Electronic Documents Act-

Industry acts such as the Construction Industry Act

7

Chapter 2

Effective risk management system for cloudservice users

The risk management cycle of cloud services consist of important prior arrangement
for risk management, comparing and selecting cloud providers and services with lessrisks, mitigating risks upon agreeing to use cloud services, coping with risk
management issues while using cloud services, coping with risk management issues
at renewal and coping with risk management issues at the end of the agreement.
The following figure shows the necessary guidance, acceptance and authorization forcorporate managers to execute at each stage of the risk management cycle of cloudservices.

Corporate managers make arrangements
to achieve accountability for theirdecisions in advance.

Important priorarrangement forrisk management.

Authorize the purpose forusing cloud services.
Provide guidance to makerules and criteria for service
benchmarking andmanagement’s decision on
selecting providers andservices.

Monitoring and control risks
caused by loss of governance(see Reference 1).

Control risks caused byincomplete deletion of users’
data upon end of use(see Reference 1).

Comparing andselecting cloudproviders and services
with less risks.
Provide guidance to collectthe necessary information,
benchmarking and reporting.
Provide guidance toevaluate the balance among
benefit, level of risk
acceptance and cost.
Provide guidance to verify
special confirmation items(see Chapter 3).

Mitigating risks upon
agreement for use ofcloud services.

Authorize the decision touse cloud services.

Provide guidance to survey
current situation and review
the results.

Control the following risks (see Reference 1):
1. Compliance violation, 2. Uncontrolled reconsignment, 3. Sudden
termination of services, 4. Vendor lock-in, 5. Emerging risks whenusers record their data at overseas datacenters.

Risk management
issues at renewal.
Accept the performance ofgovernance over cloud service
providers.

Risk management
issues at the end of
the agreement.
Provide guidance to verify
integrity of user’s data given
back and complete deletion,
and acceptance of its result.

8

Authorize agreement
and SLA.

Provide guidance todouble-check special
confirmation items andacceptance of its result.

Risk management
issues while using
cloud services.

Provide guidance to correct
important problems that arefound by user’s monitoringprocess.

Take command of response
for accidents andmanagement’s judgment.

1.

Important prior arrangement for risk management

The purpose of prior arrangement for risk management is to survey the current
situation, prepare corporate managers for using cloud services, and determine which
providers to choose and which services to choose.
The survey on the current situation aims to ensure that:(1) Corporate managers take the initiative in understanding the value and risk
acceptance level of information that is to be recorded in cloud services.
(2) Corporate managers, based on this knowledge, try to figure out what level ofservice and information security is realized and the cost required to keep thislevel. These items are basic knowledge for enterprises to choose the level ofrequirements to be imposed on cloud service providers.
Corporate managers provide personnel in charge of information systems withguidance to survey the current situation and review the results.
Corporate managers provide user divisions of cloud services with guidance to clarify
the concrete benefit from using cloud services and accept the results. When choosing
services, the most important criterion is benefit. Therefore, benchmarking othercriteria should be processed on the premise that a certain amount of benefit isobtained.
Corporate managers provide personnel in charge of information systems withguidance to create (1) a checklist of criteria for selecting cloud service providers andservices and (2) a checklist of special points to confirm that are described in Chapter 3,
and authorize these checklists. By using these checklists, it becomes possible toselect cloud service providers and services in a highly transparent way.

9

1. Provide guidance to survey current situation and review the result.
Review current policies of your enterprise which relate to information that are to be recorded in cloud services.
1. Review current policies of your enterprise (information security policy, privacy protection policy, trade secret management policy, IT
general control policy and so on) which relate to information that is to be recorded in cloud services.
2. Prior to recording this information in cloud services, corporate managers provide personnel in charge of information systems withguidance to improve in-house policies and authorize the improvement if necessary.
Survey value and risk acceptance level of informationthat is to be recorded in cloud services.

Survey current level of information security management
and services used in-house.

1. Corporate managers provide personnel in charge of
information systems with guidance to survey value and risk
acceptance level of information that is to be recorded in cloudservices.
2. Corporate managers provide guidance to classify the
information written above so that it becomes clear that the
information relates to the enterprise’s rights, compliance andso on.
3. Use the result for decision making on whether the informationis allowed to be recorded in cloud services.

1. Corporate managers provide personnel in charge of
information systems with guidance to survey the current
information security management, service level and necessary
cost that are applied to the information to be recorded in cloudservices.
2. Utilize the result as a reference to consider what level ofservice and information security cloud service providers should
offer.

3. Provide guidance to make rules and criteria forservice benchmarking and management’s
decision on selecting providers and services.

2. Authorize the purpose for using
cloud services.
Clarify benefit of using cloud services.
1. Corporate managers provide the user division of cloudservices with guidance to clarify concrete benefits (i.e.,
purposes) obtained from using cloud services and accept theresult.
2. Corporate managers should decide whether to use cloudservices so that actual benefit is the criterion of the first order.
3. Define quantitative benefit as a key performance Indicator(KPI).

10

Provide guidance to create policies, criteria and manuals
and authorize them.
Corporate managers provide personnel in charge of information
systems with guidance to create the following rules, criteria andchecklists and authorize them.
1) Criteria to choose providers and services- Criteria to evaluate sound management of providers- Criteria to verify service level requirements- Criteria to verify information security requirements- Checklist to check agreement statement and so on
2) Checklists for special points to confirm described in Chapter 3

2.

Comparing and selecting cloud providers and services with less risks

At this stage, personnel in charge of practical tasks collect information from cloudservice providers and compile benchmarking results at first. Then, based on thisreport, corporate managers make a decision on whether to use cloud services. They
consider whether they will certainly obtain benefits and the ideal balance between risk
acceptance level and cost. After this decision, corporate managers provide guidance
to help personnel choose cloud service providers and services in accordance withpredefined criteria for selecting service providers and authorize the results.
However, upon selecting cloud service providers and services, it is necessary toconfirm that providers and services satisfy the following conditions:(1) Providers can offer services and service levels that satisfy the special points toconfirm described in Chapter 3.
(2) Providers can offer an agreement of use that satisfies the user’s policies andneeds.

11

1. Provide guidance to collect necessary
information, benchmarking and reporting.
Corporate managers provide personnel in charge of information systems with guidance to collectinformation from cloud service providers, compile benchmarking results and report the results. This inaccordance with the criteria of selecting providers prepared at the prior arrangement stage and thechecklists for special confirmations described in Chapter 3.

2. Provide guidance to evaluate the balanceamong benefit, level of risk acceptance and cost.
Evaluate the balance among benefit, level of risk
acceptance and cost.
1. With top priority, it is necessary to get benefits certainly andachieve the appropriate purpose of using cloud services.
For example, in the case of small and medium-sized enterprises,
the purpose may be to improve information security
management systems. In this case, it is fairly easy to selectcloud services that satisfy the purpose of use.
2. On the premise of getting benefits and satisfying user’s
in-house policies, compare and evaluate the balance of costs
that is necessary to realize adequate information security
management and service levels
and risk acceptance level of the information that is to berecorded in cloud services.
Moreover, compare and evaluate the risk level between
situations where the information is kept recorded in-house andsituations where the information is recorded in cloud services.
3. Corporate managers provide personnel in charge of information
systems with guidance to create evaluation reports and review
the results.

3. Provide guidance to verify special
confirmation items.
Provide guidance to verify special
confirmation items
1. Corporate managers provide personnel in charge of
information systems with guidance to verify special
points to confirm described in Chapter 3.
2. If the information recorded in cloud services relates
to the enterprise’s rights, compliance and so on,
corporate managers provide personnel in charge of
information systems with guidance to collectinformation required to check confirmation items
described in 1. of Chapter 3 from cloud providers.
3. If users have a plan to record their data at overseas
datacenters, corporate managers provide personnel
in charge of information systems with guidance tocollect information required to check confirmation
items described in 2. of Chapter 3 from cloudproviders.
4. Corporate managers provide personnel in charge of
information systems with guidance to collectinformation required to checkpoints requiring attention
due to a potential awareness gap between users andcloud service providers described in 3. of Chapter 3
from cloud providers.

4. Authorize the decision to use cloud services.
1. Based on the evaluation results of the balance among benefit, level of risk acceptance and cost, corporate managers decide
whether or not to use cloud services.
2. Based on the evaluation results, personnel in charge of information systems select cloud service providers and services inaccordance with the criteria of selecting cloud services that is authorized at the prior arrangement stage. Corporate managers
authorize the selection of cloud service provider and services.
3. Upon authorization of the selection of cloud service provider and services, it is necessary to confirm that the selected provider
should be able to offer services that satisfy special confirmation items described in Chapter 3. Corporate managers accept theconfirmation results.
4. If user’s security policy requires, corporate managers provide personnel in charge of information systems with guidance toverify whether or not selected cloud service provider can cooperate with user’s internal audit and accept the confirmation
results.

12

3.

Mitigating risks upon agreeing to use cloud services

Upon agreeing to use cloud services, it is best to confirm the content of agreements
carefully and in detail by using checklists that are prepared in advance and corporate
managers must accept the result. Personnel in charge of information systems should
double-check the content of service level agreements (SLA) and establish an
agreement with the authorization of corporate managers based on the results of
selecting providers and services executed in the previous stage (i.e., comparing andselecting cloud providers and services with less risks).
Upon executing an SLA, please refer to “3. Preventing an awareness gap between
users and cloud services providers” in Chapter 3. Corporate managers should provide
personnel in charge of information systems with guidance to execute final
confirmation according to the points requiring attention. This is because there may be
an awareness gap between users and cloud service operators, as described in 3. ofChapter 3.
1. Authorize agreement and SLA
Authorize agreement and SLA.
1. Corporate managers provide personnel in charge of information systems with guidance to confirm the content of agreements
carefully and in detail by using the checklists that are prepared in advance. If there are no problems, corporate managers
authorize the result.
2. Regarding SLA, corporate managers have already authorized the decision on choosing cloud service providers and services
that can realize the required service level at an acceptable cost based on the criteria for selecting providers and services. Thiswas done at the stage of benchmarking of cloud service providers and services. Therefore at this stage, personnel in charge
compare the proposed SLA by the provider with in-house policy and confirm if it is acceptable in detail.
3. After this confirmation process, corporate managers authorize the result and conclude a SLA.

2. Provide guidance to double-check special
confirmation items and acceptance of its result.
Provide guidance to double-check special confirmation items and acceptance of its result.
1. The points requiring attention due to potential awareness gap between users and cloud service providers are described in 3.
of Chapter 3.
2. Corporate managers provide personnel in charge of information systems with guidance to execute final confirmationaccording to the points requiring attention due to a potential awareness gap between users and cloud service providers andaccept the result.
3. In reality, because careful survey has already been done at the stage of benchmarking of cloud service providers andservices, this task is not a negotiation but is likely to be a double-checking of items.

13

4.

Risk management issues while using cloud services

The main role of corporate managers at this stage is to cope with unexpected
problems and accidents.
(1)

Provide guidance to correct important problems that are found during user’s
monitoring process
Important problems such as a serious loss of governance over cloud service providers
or important violation of service level agreements may be found during user’s
everyday monitoring process. In this case, corporate managers should provide
personnel in charge of information systems with guidance to investigate the cause
and create a countermeasure plan, review the plan and accept it.
(2)

Take command of response for unexpected accidents and management’s
judgment
Unexpected serious events include widespread natural disasters and large-scale
divulgation of private information. If these should occur, corporate managers musttake command in responding to these events and make managerial decisions.

14

5.

Risk management issues at renewal or end of agreement

At this stage, enterprises decide whether they will continue using the same cloudservices next year.
If the enterprise decides to continue using the services, corporate managers should
receive an annual report that describes the actual performance of governance overcloud service providers last year from personnel in charge of information systems andreview the report. Enterprises may ask the cloud service provider to submit third-party
assurance in order to prove that the enterprise adequately governed the cloud service
provider.
If the enterprise decides to change the cloud service provider and services, it must
confirm that user’s data are appropriately given back and completely deleted after that.
If the enterprise use public cloud services, this task must be ensured and confirmed.
Corporate managers should provide personnel in charge of information systems withguidance to verify the result very carefully and accept the work completion report.
2. Risk management issues at theend of the agreement

1. Risk management issues at renewal

Provide guidance to verify integrity ofuser’s data given back and complete
deletion, and acceptance of its result.

Accept the performance of governance overcloud service Providers.
1. Many laws require adequate governance over outsourcing
providers of IT systems.
2. Corporate managers provide personnel in charge of information
systems with guidance to report actual performance ofgovernance over cloud service providers last year and accept
the report.
3. Corporate managers can choose to have the enterprise ask thecloud service provider to submit the third-party assurance inorder to prove that the enterprise governed cloud service
provider adequately.
4. In this case, ask cloud service providers to submit a verification
report that is described based on the “Information Security
Verification Service” defined by the research report No. 39 (May,2010) of IT Committee, Japanese Institute of Certified Public
Accountants,* From the perspective of ensuring internal control over financial
reporting, it is important that cloud service providers haveobtained SAS70 as it falls into the proof of governance control
over outsourcing providers. If it is not limited to financial
reporting, SAS70 cannot be deemed to be a “third-party
certificate.” But in reality, it is widely referred to as showing themanagement style of the cloud service provider.

15

1. It is very important for users of cloud services toreceive their data with the format that is possible toprocess by users themselves. Corporate managers
guide personnel in charge of information systems withguidance to decide rules related to user’s data given
back (necessary period, method, data format, etc.) in
advance, and receive data surely by following therules. Corporate managers review and accept theresults.
2. If users use public cloud services, it is necessary toconfirm that users’ data is completely deleted byreceiving data deletion certificate document, or if it isdifficult, an alternative method with high reliability.
Corporate managers provide personnel in charge of
information systems with guidance to confirm
complete deletion of user’s data and accept thecompletion report. If an alternative method other thanreceiving data deletion certificate document is applied,
corporate managers require personnel in charge of
information systems to carefully verify theadequateness of the method.

Chapter 3

Points to confirm

In this chapter, we will describe the points to confirm from three viewpoints so as toensure the protection of cloud service users and ensure compliance of cloud users.

1.

Points to confirm to protect cloud users’ rights and ensure theircomplianceThis section describes our approaches to verify that (1) users’ rights are protectedbased on domestic laws and regulations and (2) users’ compliance is ensured basedon domestic laws and regulations with regard to the use of cloud services. Please
select and read the related descriptions according to the type of information that you
plan to record in cloud services.
Type of information to be recorded in cloud services:
Protecting users’ rights
Trade secrets
Ensuring users’
Information related to thecomplianceactivities of management,
electronic data and logs thatare related to financial
reportingPrivate information
Technological information
National tax records

Related descriptions
(1)
(2) A

(2) B
(2) C
(2) D

(1) Protecting users’ rights
The typical rights of cloud service users protected by domestic laws andregulations in both civil and criminal terms include trade secrets of the users andintellectual property rights of the users.
With regard to trade secrets, it is essential to ensure three requirements to beeligible for legal protection: a) the concerned information shall be managed as asecret, b) it shall be useful information, c) it shall not be publicly known.
Corporate managers need to pay special attention to the fact that using cloudservices may risk one of the aforementioned requirements, which is a) managed
status of secrets. Enterprises must verify that there is no discrepancy withinternal management policies and operation rules for trade secrets when using
cloud services and/or that such discrepancy should not risk a) managed status of
secrets. This is based on the “Trade Secrets Management Guidelines” (seeReference 3) formulated by METI.

16

Important points to confirm in checking based on Trade Secrets Management Guidelines
1. Contract details related to method of managing secrets- Identification and limitation of access and its administrator, protection from external
intrusion, and data deletion and disposal- Management related to ensuring legal competency etc.
2. Contract details related to organizational management to ensure appropriate functioning ofmanagement of secrets etc.
- Cooperation with internal audits

In conducting the verification, personnel in charge shall investigate the details
and corporate managers shall review the investigation details. Based on thisreview result, corporate managers shall make judgments, such as trade secrets
are recorded in cloud services, the information to be recorded in cloud services
is not managed as trade secrets, or trade secrets are not recorded in cloudservices.
* Other than those cited here, some other elements such as intellectual property
rights (industrial property rights, copyrights etc.) may be included. We plan toexpand descriptions on the protection of rights when we revise this guide in
future.
(2) Ensuring users’ compliance
The following laws and regulations relate to ensuring users’ compliance:
Laws and regulations related to ensuring users’ compliance
A． Corporate Law, Financial Instruments and Exchange Act (so-called J-SOX Act):
Internal governance of listed enterprises and large corporations
B． Privacy Protection Law
C． Foreign Exchange and Foreign Trade Act (Foreign Exchange Act): Preventing
technological information from flowing overseas
D． Law Concerning Preservation of National Tax Records in Electronic Form (Law for
Preserving Electronic Documents), Corporate Tax Law etc.: Preservation of electronic
data such as books etc.
E． Industry laws that users comply with on routine basis: Regulations set by competentauthorities etc.

Depending on the laws and regulations, different approaches are applied whenchecking whether users’ compliance is ensured in using cloud services. The
following section describes this confirmation method based on each law andregulation other than industry laws. In conducting the confirmation, personnel incharge shall investigate the details and corporate managers shall review theinvestigation details. Corporate managers shall decide whether to introduce
cloud services based on this review result.
* We plan to expand descriptions on ensuring compliance when we revise thisguide in future with regard to industry laws and such like set by the competentauthorities that users comply with on a daily basis.
A. Confirmation related to internal governance17

For large corporations with a board of directors, enterprises must verify that theuse of cloud services does not disturb the establishment of a system to ensure
appropriate business operations, as requested by Article 100, Paragraph 1 of
the Rules for the Enforcement of Corporate Law. For instance, developing arisk management policy and establishing a risk management and monitoring
system are required. It is essential to develop a system that can verify thatthese policies and systems work appropriately and practically later on.
Similarly, in the case of listed enterprises, it is important to ensure a verification
system based on the J-SOX Act in using cloud services. Verification shall for
example demonstrate that risk management policies and systems work
appropriately and practically.
These elements are not described in detail in this guide. Please refer to thedescription on COSO frameworks.
B. Confirmation related to protecting private information
Guidelines for protecting private information established by each government
agency (see Reference 3) determine the guidelines for supervising private dataconsignees. The confirmation to ensure compliance in using cloud services
shall be carried out also based on these guidelines.
The contents of the guidelines differ significantly depending on the government
agencies that established each guideline. Therefore, confirmation shall be
carried out by choosing appropriate guidelines for the industry area of yourcompany (see Reference 3).
Considerations in referring to guidelines related to protecting private information(differences among various guidelines)
1. Does the guideline request establishment of a standard in selecting data consignees?
2. Requirement items to be included in the consignment contract (level of specificity,
handling of repeated consignment, handling of contract termination etc.)
3. Does the guideline request scheduled and/or unscheduled audits of the consignees?
4. Does the guideline request obligation of reporting to consigners in the event of an
accident such as leakage of personal data? Further, does the guideline request
clarification of consignees’ liability in the event of an accident?
5. Does the guideline request a periodical review of the contract details?
6. Does the guideline refer to the anonymization of personal data at consignment?

* This guide covers various areas including health insurance and welfare;broadcasting and postal area; economy and industry; employment management;
legal issues; corporate pensions; foreign affairs; financial matters; agriculture;
forestry and fisheries area; land and transport; and the environment. Besides,
guidelines for protecting private information have been established in someareas including healthcare and nursing, monetary and credit, business areasusing study results in medical and genetics fields and the related information,
labor-related matters, education, and police and defense. We plan to expand
descriptions on ensuring compliance when we revise this guide in future.
C. Confirmation to prevent technological information from flowing overseas
When using cloud services at an overseas datacenter, it is essential to giveconsideration to the risks concerning the flow of technological information18

overseas, as cited in the separate list of the Export Trade Control Ordinance.
The Guidelines on Preventing Technology Outflow established by METI (seeReference 3) state as follows: “Consideration should be given to avoid carelessexposure of important know-how in documents. If any know-how is included ina drawing or document, the information shall be managed in a stringent
manner as a trade secret or such like.” Therefore, by deciding whether or not it
is possible to store the trade secret in overseas datacenters, corporate
managers can make their decision on whether or not it is possible to record thetechnological information in cloud services using overseas datacenters.
D. Confirmation related to preserving national tax records in electronic form
Rules for the Enforcement of Law for Preserving Electronic Documents set thefollowing requirements concerning the preservation of national tax records inelectronic form1 (see Reference 3).
Requirements concerning the preservation of electronic documents in Rules for the
Enforcement of Law for Preserving Electronic Documents
1. Ensuring authenticity (ensuring history for data correction and deletion)
2. Ensuring mutual correlation (possibility to verify correlation between recorded items
and items recorded in ledgers)
3. Establishing related documents (documents to identify procedural steps related toestablishment and preservation of electromagnetic records)
4. Ensuring legibility (possibility to display and print out the information in areader-friendly format)
5. Ensuring searchability (search function based on transaction date, accounting item,
transaction amount etc.)
6. Providing electronic signatures and time stamps

Corporate managers shall decide whether it is possible to use cloud services
after examining any possible problem from various aspects. Such aspects
include ensuring authenticity and the related legal competence, method toensure legibility, continuation of services to ensure long-term preservation
based on legal requirements, operation-related issues for electronic signatures
and time stamps.
* With regard to preserving electronic documents based on the Law for
Preserving Electronic Documents, we plan to expand descriptions on ensuring
compliance when we revise this guide in future. This is because othergovernment agencies approve electronic preservation of documents such as
books, ledgers and drawings.
(3) Active use of ASP-SaaS Information Disclosure Certification System for Safety
and Reliability
The status of information disclosure and the commitment of cloud service
providers are important in collecting information to be used for making
2This refers to cases where a computing process is consigned to an external organization and aprocessing program not internally developed is used. These conditions often arise when using
cloud services in general.

19management decisions. In selecting an appropriate provider, it isrecommendable, at least for the time being, to give priority to the qualified cloudservice providers who are certified with ASP-SaaS Information Disclosure
Certification for Safety and Reliability 2 . This is a system operated by theFoundation for MultiMedia Communications. The cloud services providers
qualified for this certification show thorough commitment to information
disclosure related to safety and reliability of the services they provide to theircustomers.
Currently, examinations on the Guidelines for Disclosure of Information Related
to Safety and Reliability of cloud Services and certification system for thispurpose are going on. We expect in future that the new guidelines andcertification system will play an important role in this area.
Number of certified services
Service categories

Note: Services involved with multiple categories are counted multiple times.
Industry-specific type

Industry / sector-dependent services that enable dominant activities of enterprises / organizations(Construction & real estate, transport & logistics, healthcare & nursing, administration & public
services etc. )Financial / Accounts

Services that support financial / accounts and accounting works

Human affairs/
Payrolls

Services that support human affairs (including recruitment) and payroll works

Education

Services related to E-learning, human resource development etc.
Services related to data collection for marketing purpose centered on the data forclients’ gender, age, position and contact history with the clients
Services related to collection of wide range ofclients’ data ranging from product trading to
product maintenance / management
Services to support works related to production, purchasing andlogistics to improve work efficiency

SFA / Sales support

CRM / Client management
Production / Sales /Purchasing / Logistics
Intra-company / Inter-group
information sharing

Website construction
EC-related

Services related to groupware, web-meeting andmanagement of internal files etc.
Services related to contents management system (CMS) and offering of website construction template etc.
Services related to opening of web shopping site and the services to offer shopping cart function etc.

Mail distribution

Services related to E-mail magazine and E-mail marketing
Services related to virus check, web filtering, authentication, log
management etc.

Security
SNS / Blog

Services to support communities such as SNS and blogs
Services not categorized in above categories (including
services for ASP / SaaS platform, shared services for ASP /SaaS, outsourced services etc.)

OthersNumber of certified services for each service category in “ASP-SaaS Information Disclosure
Certification System for Safety and Reliability”* This graph was created based on the information cited in the website for ASP and SaaS Information Disclosure Certification
System for Safety and Reliability (http://www.fmmc.or.jp/asp-nintei/)2

http://www.fmmc.or.jp/asp-nintei/

20

2.

Special points to confirm when users’ data are recorded at overseas
datacenters

It is essential to confirm which countries’ laws including Japanese laws can possibly
be applied to potential conflicts if cloud service users record their data in overseas
datacenters or choose services of foreign providers whose headquarters are locatedoutside of Japan.
Users are recommended to pay attention to the following points:
1. Users should include descriptions in their contracts that state Japanese law shallbe applied and the court of jurisdiction shall be one located in Japan in the case of
any lawsuits.
2. Users should make an agreement with a Japanese subsidiary of a foreign cloudservice provider.
3. Users should confirm the way of giving notices and the ability to continue businessthat the foreign cloud service provider has in case there is any unexpected andunavoidable investigation by a foreign public power.
4. Users are strongly recommended not to record data inside conflict-ridden
countries.
Points to confirm:
4. No data should be recorded inside conflict-ridden
countries. Robbery at datacenter facilities may
occur if there is a dispute or coup d'état.

* Users are responsible
for ensuring complianceand following guidelines
of ministries with respect
to their own information
assets.

Overseas
datacenter

5.
User

Data

2.
Make an agreement with aJapanese subsidiary of aforeign cloud service provider.
Japan’s public power canadminister and investigate theprovider.

3.
Court in Japan

Japanese subsidiary1.

Check if the cloudservice provider offers achoice of countries
where user’s data arerecorded.

Declare in the contract that Japanese
law shall be applied and the court ofjurisdiction shall be one located inJapan in the case of lawsuits.

* E-disclosure system at foreign courts may
become an important issue. Expensive
attorneys’ fees may become a problem, too.

Headquarter locatedoutside Japan* If a foreign country’s law
is applied, an unexpectedorder to produce evidence
may be issued by aforeign public power.

There is a potential risk that overseas cloudservices may suddenly stop if overseas
headquarters are forced to suspend business,receive an order for attachment of property and soon.
Confirm if the provider can continue services even if
the provider confronts such an unexpected situation.
* Users should confirm how cloud service
providers will cope with investigations andorders to produce evidence by a foreign
public power. Providers should inform usersof it promptly, and make arrangement so thatusers can speak to a foreign public power
directly.

* Suppose users select a country where their data are recorded. It does not guarantee that thelaws of the selected country are applied in the case of lawsuits. Users should ensure not only item
5, but also item 1.

21

3.

Preventing an awareness gap between users and cloud services
providers

There are some points requiring attention because there may be an awareness gap
between users and cloud service providers when closing a contract for cloud services.
As these points constitute items for special confirmation in selecting services,
corporate managers shall instruct their personnel in charge of information systems to
pay adequate attention to them.
(1) Split of responsibilities between users and providers in cloud services
We often observe an awareness gap between users and cloud service providers
concerning split responsibilities. Corporate managers shall instruct theirpersonnel in charge of information systems to establish a policy to prevent a gapof awareness regarding split responsibilities in terms of the following issues,particularly:
1. Operation management of networks among users, cloud service providers andcommunication providers
2. Management operation of OSes and computing resources
3. Operation management at application level
4. Operation management of machines and equipment installed by cloud service providers
in the company’s facility(2) Points requiring attention due to a potential awareness gap between users andcloud service providers
When using a cloud service, a potential awareness gap about responsibility isoften observed at a basic policy level between users and cloud service providers
with regard to compliance breach risk, governance loss risk, the risk of abrupt
service termination, and the risk of imperfect data deletion at service termination.
The aforementioned gap may be a main factor giving rise to these risks in aconspicuous manner. As a specific countermeasure, you need to carefully listen
to the position statement of cloud service providers to eliminate any awarenessgap. Then, a provider and services that satisfy your policy and needs should beselected by comparing providers. There are eight essential check points as
below:
1. Is there any difference in awareness for compliance obligation?
Explanation: There may be a discrepancy at a management policy level in the attitude
to security of compliance in terms of privacy information protection, non-disclosure of
trade secrets and establishment and operation of internal governance between users
and cloud service providers. In this case, conformance with compliance obligations
requested by users in using cloud services may be compromised. It is necessary toconfirm in detail the cloud service providers’ attitude towards ensuring compliance withregard to the aspects considered important by your company.

22

2. Is there any difference in awareness concerning how to fulfill accountability in the eventof a “major incident” such as leakage of private information and trade secrets?
Explanation: Even if a major incident should occur on the cloud service provider side,user companies are often requested to play a main role in fulfilling accountability. For
instance, an outflow of private information from the cloud service providers is one ofthese cases, when the user company received the information from its clients. In sucha case, it is necessary to coordinate awareness for responsibilities between users andcloud service providers so that the user company can fulfill its accountability
appropriately and make concerted efforts with the cloud service providers. Before
entering into a contract, you should confirm specific actions such as contents of
information and the way they are to be offered.
3. Compensation for damages and breach of operation assurance
Explanation: There may be an awareness gap about the range of compensation fordamages when a user suffers a loss attributable to the cloud service provider. For
instance, the amount of compensation is usually determined as a reduction of service
charge. It is essential to notice that no compensation for damages by loss of business
opportunity and loss of data are assured by cloud service providers.
4. Procedure to change service contents based on a request from the cloud service
providerExplanation: With regard to application services, the renewal of service functions areleft to the discretion of cloud service providers and the users do not have to pay for themodification costs. On the other hand, a type of modification not desired by users may
be conducted. Therefore, it is essential to confirm the specific procedure to be taken by
cloud service providers in the renewal of service functions.
5. Procedures in the case of service termination based on a reason cited by cloud service
providerExplanation: An abrupt termination of cloud services may have a serious impact on
their users. It is necessary to choose a financially stable service provider and confirm
the advance notice period before closing a contract.
6. Confirmation of the handling of users’ data and its ownership
Explanation: A discrepancy may be observed sometimes between users and the cloudservice providers with regard to awareness about ownership of the data preserved andstored within the framework of cloud service offering. Such a potential awareness gap
between the parties tends to become obvious as a difference of policy for secondary
use of users’ data. It is necessary to confirm the policy of cloud service providers withregard to the range of ownership of user’s data and choose the provider that can offer
the policy which agrees well with user’s policy.
* Ownership right: rights to create, modify and delete data
7. Complete deletion of users’ data
Explanation: An awareness gap may occur between users and cloud service providers
with regard to “complete deletion of users’ data.” Particularly, it is necessary to carryout thorough investigation so that there is no awareness gap about how to delete thedata, and confirm whether or not the cloud service provider can offer a data deletion
method acceptable to the users.

23

Reference 1

GlossaryIn this reference, we will explain the technical terms used in this guide.

Service models
1. Infrastructure as a Service (IaaS):
The capability provided to the user is to provide processing, storage, networks, and otherfundamental computing resources where the user is able to deploy and run arbitrary software,
which can include operating systems and applications.
2. Platform as a Service (PaaS):
The capability provided to the user is to deploy onto the cloud infrastructure user-created or
acquired applications created using programming languages and tools supported by theprovider.
3. Application Services* (the term ASP-SaaS is used often):
The capability provided to the user is to use the provider’s applications running on a cloudinfrastructure. The applications are accessible from various client devices through a thin clientinterface such as a web browser.

Service deployment models
1. Private cloud:
Cloud infrastructure is operated solely for an organization.
2. Public cloud:
Cloud infrastructure made available to the general public or a large industry group and owned
by an organization selling cloud services.
3. Hybrid cloud:
Cloud infrastructure is a composition of a private cloud and public cloud that remain uniqueentities but are bound together by standardized or proprietary technology that enables data
and application portability.

Other terms
1. Service Level Agreement (SLA):
A document that describes agreements on operations management established between theuser and the cloud service provider. The agreements are established for reliability andperformance of services, quality of safety management, quality of customer services and soon. It is preferable to describe necessary and sufficient agreements on SLA documents so as
to keep charges affordable.

24Explanations on important risks related to cloud services
A cloud service is a technically advanced implementation of IT outsourcing. Public
cloud services have the following risks because of the black-boxed feature of these
services. Especially, risks related to loss of governance, compliance violation,
incomplete deletion of users’ data upon end of use and risks that emerge when users
record their data at overseas datacenters are considered to be important.
Cause of risks

Actual consequence by this risk

Loss of governance-

Loss of fine risk control-

Black-boxed operations and resources-

Difficult to cope with digital forensics-

Difficult to make SLA-

Inadequate information disclosure by cloud service providers incase of critical incidents etc.

Compliance violation-

It becomes difficult to manage and control cloud service providers
adequately and appropriately to maintain compliance because of
the loss of governance over cloud service providers.

-

It may be hard for cloud service users to verify and prove that they
maintain compliance via a third party’s audit if cloud service
providers do not disclose the necessary information.

Reconsignment

Cloud service providers do not properly manage and control
recommissioning service providers.

Sudden termination

Cloud services may suddenly be terminated due to bankruptcy of cloudof services

service providers, M&As of cloud service providers, and so on.

Vendor lock-in

Users may be locked in by cloud service providers because of the
difficulty of migrating data to other cloud services.

Incomplete deletion

Cloud service providers may not delete users’ data completely uponof users’ data uponend of use.

end of use
Users record their
data

at

-

overseas

It becomes difficult to determine which country’s law is applied inorder to resolve conflicts between users and cloud service

datacentersproviders.
-

Unexpected data disclosure by forced producing of evidence ore-disclosure may happen due to foreign country’s public power.

-

Robbery at datacenter’s facilities may happen due to a disturbanceor coup d'etat.

-

Technological information may illegally flow out to foreign countries.

25

Reference 2

Guidelines related to cloud services
Whole picture: This guide is colored.
Domain specificDomainTargetCommonLocal government

ASP-SaaS
ASP-SaaSInformation
InformationDisclosure
Disclosure
Certification
CertificationSystem
Systemfor
forSafety
SafetyandandReliability
version
1.0(MIC,
Reliability version 1.0 (MIC,Nov.
Nov.
2007)
2007)
Information
InformationSecurity
SecurityCountermeasure
CountermeasureGuideline
Guidelinefor
for
ASP-SaaS
ASP-SaaSProviders
Providers(MIC,(MIC,Jan.
Jan.2008)
2008)

ASP-SaaS
providers

Healthcare

Education

Guideline
Guidelinefor
forSafety
SafetyManagement
Managementof
ofCloud
Cloud
Service
ServiceProviders
Providerswho
who
HandleHandleMedical
MedicalInformation
(MIC,
Jul.
Information (MIC, Jul.2009,
2009,
Dec.
Dec.2010
2010updated)
updated)Guideline
Guidelinefor
forASP-SaaS
ASP-SaaS
serviceserviceproviders
providerswho
who
provideservices
provide servicesin
inthe
the
field
fieldofofschoolschoolaffairs
affairs(MIC,(MIC,Oct.
Oct.2010)
2010)

SampleSampleSLA
SLADocument
Document
based
basedononthe
theGuideline
Guidelinefor
for
SafetyManagement
Safety Managementofof
Cloud
CloudService
ServiceProviders
Providers
who
whoHandle
HandleMedical
MedicalInformation
Information(MIC,(MIC,Dec.
Dec.
2010)
2010)

Datacenter
DatacenterService
ServiceInformation
Information
Disclosure
DisclosureCertification
CertificationSystem
Systemfor
for
SafetySafetyandandReliability
Reliabilityversion
version1.0
1.0
(MIC,
(MIC,Feb.
Feb.2009)
2009)

Guideline
Guidelinefor
forInformation
Information
Processing
ProcessingService
Service
Providers
who
Providers whoAccept
AcceptandandManageManageMedical
MedicalInformation
Information(METI,(METI,Mar.
Mar.
2008)
2008)

Guide
GuidetotoProtecting
ProtectingCloud
CloudService
Service
Users
Usersand
andEnsuring
EnsuringCompliance
Compliance(ASPIC,(ASPIC,July
July2011)
2011)

ASP-SaaS
users

Guideline
Guidelinefor
forInformation
InformationSecurity
Security
Management
Managementin
inCaseCaseofofUsing
UsingCloud
Cloud
Services
Services(METI,(METI,Apr.
Apr.2011)
2011)

Guideline
Guidelinefor
forICT
ICT
Outsourcing
Outsourcingby
byPublic
PublicSector
SectorOrganization
Organization(MIC,(MIC,Mar.
Mar.2003)
2003)

Guideline
Guidelinefor
forSafety
SafetyManagement
Managementof
ofMedical
MedicalInformation
InformationSystems
Systemsversion
4.1(MHLW,
version 4.1 (MHLW,Feb.
Feb.
2010
2010updated)
updated)Guideline
Guidelinefor
forInstalling
InstallingandandUsing
UsingASP-SaaS
ASP-SaaSby
by
Local
Government
Local Government
(MIC,
Apr.
2010)
(MIC, Apr. 2010)

Guidance
Guidancefor
forSafe
SafeUseUseof
ofCloud
Cloud
Services
Servicesby
bySmall
SmallandandMedium-Sized
Medium-Sized
Enterprises
(IPA,
Apr.
2011)
Enterprises (IPA, Apr. 2011)

Recommended
Recommended
Specification
SpecificationDescriptions
Descriptions
for
forInformation
InformationSecurity
Security
Systems
Systemsat
atSchools
Schoolsversion
version
1.0
1.0(CEC,(CEC,2010)2010)
Guideline
Guidelinefor
forInstallation
Installationof
ofInformation
InformationSystems
Systemsfor
for
SchoolSchoolAffairs
Affairsas
asaapart
partofof
Total
TotalSchool
SchoolInformatization
Informatization
Plan
Plan(APPLIC,(APPLIC,2009)
2009)

Guideline
Guidelinefor
forSLASLAofofASP-SaaS
ASP-SaaS(METI,(METI,Jan.
Jan.2008)
2008)

Guidelines for ASP-SaaS users
1. Guideline for Installing and Using ASP-SaaS by Local Government (MIC): April
2010
This guideline describes points requiring attention when local governments install and use
ASP-SaaS.

2. Guideline for SLA of ASP-SaaS (METI): January 2008
This guideline describes important characteristics of ASP-SaaS from the viewpoint of
information security management. Such management is necessary for enterprisemanagement and IT division employees to well understand the points of information
security requiring attention, establish appropriate agreement and eventually use
ASP-SaaS safely. This guideline should help enterprises to better select ASP-SaaS
providers and services and appropriately establish SLAs.

26

Guidelines for cloud service users
1. Guideline for Information Security Management when using Cloud Services(METI): April 2011
This guideline describes the following three issues by assuming that cloud services areextensively used by users:
1. Risk controls that users should implement
2. Service level and security management that users should request to cloud service
providers
3. Recommended information security management systems
This Guideline updates risk controls of JIS Q 27002* in order for organizations that use
cloud services to smoothly implement adequate information security countermeasures
based on this document.
* Code of practice for information security management

2. Guidance for Safe Use of cloud Services by Small and Medium-Sized Enterprise(IPA): April 2011
This Guidance describes recommendations and check items so that small andmedium-sized enterprises can easily decide to use cloud services, verify adequacy ofterms of service and confirm important reminders related to information security.

27

Reference 3

Data related to users’ rights and complianceThis section indicates guidelines set by government agencies cited in this guide withregard to users’ rights and compliance.
Note: This reference does not show comprehensive data of the guidelines formulated
by government agencies. If there are any regulations or guidelines that are observedby your company other than those mentioned below, they should be added in youroperation.

Guidelines for users’ rights
 METI

Protection of trade secrets by Unfair Competition Prevention Act

Name

Announcement
and review(latest one
only)
April 2010

Competent
authority or
issuing party

Trade Secrets Management Guidelines
METI
Chapter 2 1. Definition of trade secrets
Chapter 3 2. Secret management method recommended to
implement management of trade secrets
3. Status of organizational management
recommended to implement appropriate functioning oftrade secret management* There is no description that clearly refers to the consignment of system services to external

parties. If cloud services are used, the focus will be on whether or not the trade secrets
preserved on provider’s side should satisfy the requirements shown in the definition of trade
secrets.

28

Guidelines for security of users’ compliance MOJ/FSAInternal governance of large corporations (companies with a board of
directors and listed enterprises)

Name

Announcement
and review(latest one
only)
March 2009

Competent
authority or
issuing party

Ordinance for the Enforcement of the Companies Act
MOJ(System to ensure appropriate operation) Article 100-1
Standard for evaluation of internal governance and audit for
February 2007
FSA
financial reports
I. 2. (6) Measures devised to deal with IT
Enforcement standard on evaluation of governance and audit for
February 2007
FSA
financial reports
II. 3. (3) (e) Evaluation of internal governance by using IT(4) (c) Judgment on effectiveness of internal governance relating toIT* COSO framework and such like are useful references with respect to the details of IT

governance and measures to be taken when consigning to external parties.

 Each government agency
Guidelines related to protection of private information3: Requirements forconsignment to external parties are clearly described.
1. Health insurance and welfare
Name

Guidelines for Appropriate Handling of Private information in
Health Insurance Associations etc. (Director’s notification)
III. 4. (3) Handling in the case of consignment of services
Guidelines for Appropriate Handling of Private information in
National Health Insurance Associations etc. (Director’s notification)
III. 4. (3) Handling in the case of consignment of services
Guidelines for Appropriate Handling of Private information in theFederation of National Health Insurance Associations etc.
(Director’s notification)
III. 4. (3) Handling in the case of consignment of services
Guidelines for Appropriate Handling of Private information by
Welfare Service Business Providers (Director’s notification)
III. 4. (3) Handling in the case of consignment of services

3

CAA: http://www.caa.go.jp/seikatsu/kojin/gaidorainkentou.html

29Announcement
and review(latest one
only)
December
2004

Competent
authority or
issuing party

December
2004

MHLW

September
2005

MHLW

November
2004

MHLW

MHLW

2. Broadcast and postal area
Name

Guidelines for Protection of Private information of Broadcast
Recipients (Notice)(Supervision of data consignees) Article 16, Article 17
Guidelines for Protection of Private information in Postal Business
Area (Notice)(Supervision of data consignees) Article 11
Guidelines for Protection of Private information in Correspondence
Delivery Business Area (Notice)(Supervision of data consignees) Article 11

Announcement
and review(latest one
only)
September
2009

Competent
authority or
issuing party

March 2008

MIC

March 2008

MIC

Announcement
and review(latest one
only)
October 2009

Competent
authority or
issuing party

MIC

3. Economy and industry
Name

Guidelines for Laws on Private information Protection in Economy
and Industry Area (Notice)
2-2-3-4. Supervision of data consignees (Related to Article 22)

METI

4. Employment management
Name

Guidelines for Countermeasures by Providers to Secure
Appropriate Handling of Private information Related to
Employment Management (Notice)
No. 3 “4. Matters on supervision of data consignees” defined in
Articles 22.

Announcement
and review(latest one
only)
July 2004

Competent
authority or
issuing party

Announcement
and review(latest one
only)
September
2009

Competent
authority or
issuing party

March 2010

MOJ

Announcement
and review(latest one
only)
October 2004

Competent
authority or
issuing party

MHLW

5. Legal issues
Name

Guidelines for Protection of Private information in Operations underJurisdiction of MOJ (Notice)No. 6 Responsibilities Related to Management of Privacy Data, 4Supervision of data consignees (Related to Article 22)
Guideline for Protection of Private information in debt management
and collection industry area
No. 7 Responsibilities for management of personal data, 4Supervision of data consignees (Related to Article 22)

MOJ

6. Corporate pensions
Name

Handling of Private information Related to Corporate Pension etc.
(Director’s notification)

30

MHLW

No. 5 Matters related to supervision of data consignees

7. Foreign affairs
Name

Guidelines for Protection of Private information Handled by
Providers in Services under the Jurisdiction of MOFA (Notice)(Countermeasures for consignment of personal data) Article 11

Announcement
and review(latest one
only)
March 2005

Competent
authority or
issuing party
MOFA

8. Financial matters
Name

Guidelines for Protection of Private information in Area under theJurisdiction of MOF (Notice)(Supervision of data consignees) Article 13

Announcement
and review(latest one
only)
March 2010

Competent
authority or
issuing party
MOF

9. Agriculture, forestry and fisheries
Name

Guidelines for Protection of Private information in Agriculture,
Forestry and Fisheries area (Notice)No.6 5. Supervision of data consignees (Related to Article 22)

Announcement
and review(latest one
only)
July 2009

Competent
authority or
issuing party

Announcement
and review(latest one
only)
December
2004

Competent
authority or
issuing party

Announcement
and review (thelatest only)
December
2009

Competent
authority or
issuing party
MOE

MHLW

10. Land and transport
Name

Guidelines for Protection of Private information in Area under theJurisdiction of MLIT (Notice)(Supervision of data consignees) Article 11

MLIT

11. The environment
Name

Guidelines for Protection of Private information in Operations under
the Jurisdiction of MOE (Notice)No. 6 “4. Supervision of data consignees” (Related to Article 22)31 METI

Prevention of outflow of technological information

Name

Announcement
and review(latest one
only)
March 2003

Competent
authority or
issuing party

Guidelines to prevent flow-out of technological information
METI
I. 2. (2) “Unintended flow-out of technology”
II. 5. Flow-out of technology through flow-out of drawings andknowhow necessary for manufacturing
III. 4. 6. Considerations to prevent flow-out of technology throughflow-out of drawings and knowhow necessary for manufacturing (p.
22)* See separate table of Export Trade Control Ordinance4 for the scope of technologies for which

flow-out is prohibited.

 MOF

Preservation of National Tax Records in Electronic Form

Name

Rules for the Enforcement of Corporate Tax “Limitation on place ofpreservation”(Filing and Preservation for Books and Documents of Consolidated
Corporations) Article 8, 3–10
(Filing and Preservation for Books and Documents) Article 59(Filing and Preservation for Books and Documents etc.) Article 67* Reference: Law Concerning Preservation of National Tax
Records in Electronic Form and Rules for the Enforcement of Law
Concerning Preservation of National Tax Records in Electronic
Form (MOF) stipulate provisions with regard to preservation ofbooks in electronic form5.
MFJ Ordinance No.1 dated January 31, 2005: Ordinance for Partial
Revision of Rules for the Enforcement of Law Concerning
Preservation of National Tax Records in Electronic Form
“Presentation of requirements for preservation etc.”

45Announcement
and review(latest one
only)
October 2010

MOF

January 2005

MOF

http://www.kyushu.meti.go.jp/seisaku/boueki/bouekikanri/yushutsurei.html
http://www.nta.go.jp/taxanswer/hojin/5930.htm

32Competent
authority or
issuing party