(Note: this English version is provided as a translationof the Japanese version, the original, for the user'sconvenience.)

Password Guideline for Users of Kyoto University Campus-wide Information
System(Established by the Chief of the Institute for Information Management and Communication, January 12, 2010)

1. Purpose
This Guideline is established to describe matters that users and the like must know in advance when they use passwords
in combination with their accounts for the Campus-wide Information System in accordance with Article 8.3 of the Rules for
Using the Kyoto University Campus-wide Information System.

2. General cautions related to password
2.1 Changing the initial password
Users and the like must change the initial passwords assigned to them immediately after they receive their initialpassword. Do not continue using the initial password to access Kyoto University Campus-wide Information System.

2.2 Character strings for passwords
The password string created by users and the like must satisfy all of the following conditions:- The password string must include at least 12 characters.
- The password string must have at least one character from each of Character Groups A to C below, and may also
contain one or more characters from Group D.
A) Upper case letters of the alphabet (A to Z)
B) Lower case letters of the alphabet (a to z)C) Numbers (0 to 9)D) Symbols (@!#$%&=-+*/.,:;[]|_)
The following character strings must not be used as passwords since they are easy to guess by other persons:- A character string that can be easily guessed from the account information of the user or the like (name, user ID,etc.).
-A character string resulting from shuffling the above-mentioned account information, or comprising of theabove-mentioned string and numbers or symbols.

- Any word listed in dictionaries.
- A name of a celebrity or any other proper name.

2.3 Changing a password
Users and the like must periodically change the passwords for their accounts if they are so instructed by the Chief ofthe Institute for Information Management and Communication. When a user and the like are instructed to change his/her
password immediately, he/she must change it immediately. The new password must not be similar to the password
before the change.

2.4 Controlling the password
Users and the like must keep their passwords under strict control. Users and the like must exercise the greatest
caution not to reveal their passwords to other persons or carelessly expose their password to other persons’ eyes.

3. Procedures related to password
3.1 When a user forgets their password
If a user and the like forgets his/her password, he/she must submit to the Institute for Information Management andCommunication a request to reset the password in the designated form, presenting his/her identification card (studentidentification card or staff identification card). When the password is reset, the user and the like must immediately set anew password.

3.2 Reporting a password-related incident
If the account of a user or the like is used by any other person or if there is any threat of such unauthorized use, he/she
must immediately report the incident to the Chief of Institute for Information Management and Communication.

Supplementary provision
1.

Measures to conform to this guideline shall also be applied to a password for an account of specific department
information systems connected to Kyoto University Campus-wide Information System.
Measures associated with this revision of the guideline shall be completed by March 31, 2015.

2.

This guideline becomes effective from February 4, 2014.

3.

This guideline becomes effective from April 1, 2021, and apply from January 14, 2021.