7.4 Security Measures for Users
When accessing the NACCS Center server, users shall comply with the security measures specified by
NACCS Center and report to NACCS Center on details of safety measures they have actuallyimplemented.
When security measures implemented are deemed to be inadequate or inappropriate, NACCS Center
shall direct the users to take remedial measures.

7.4.1 Security Measures Implemented by Users
Table 7-4-1 Content of Security Measures That Users Must Comply withContent(1) Placement of system

Connection mode

Details

Peertopeer
connection

RouterGateway
connection connection○○○

Remarks• A system administrator shall beadministrator

placed at each office whereNACCS is used and at eachlocation where a gateway
computer is installed and reported
to NACCS Center(2) Management of IDs○○○and passwords• The system administrator as

Even when IDs andgiven in (1) above shall manage

passwords are used outside

IDs and passwords used forthe office where NACCS isNACCS

supposed to be used inaccordance with an appliedsystem use contract, suchas when using IDs andpasswords at home or asatellite office due to anatural disaster or otheruncontrollablecircumstances, the systemadministrator at the officewill still manage the IDs andpasswords in an appropriatemanner(3) Anti-virus measures

○

○

○

• All computers connecting to theCommercially available anti-

NACCS Center server shall havevirus software includes anti-

commercially available anti-virus

virus software built into ansoftware installed therein, andOS (such as Microsoft

such anti-virus software shall beDefender)

kept up to date(4) Reporting of user

○

○

○

• The following documents

system configuration

pertinent to the user system thatconnects to the NACCS Center
server shall be submitted to
NACCS Center:7-4-1[1] System configuration diagram[2] Configuration list of devices
used(5) Security measures○○○of the company•Appropriate security measures

The NACCS Center may(including measures against

request the submission ofvulnerability, such as user

users' own security

authentication, access control,

measures if it deems it

encryption and security patch)necessary

shall be taken for users' ownsystem(6) Log management○In order to identify users thatSee (*) for how to implement

connect to the NACCS Centerlog management

server from gateway computers,

7-4-2etc., administrator shall construct

The NACCS Center maya system to manage the history

request the submission of(log) of data

history log if it deems it

transmission/reception

necessary(*) Log management (for gateway connections)
Log management for gateway connections shall be implemented as follows:[1] Items to be logged and retained
Of the messages transmitted and received by the NACCS Center server, the following
items shall be logged and retained:
Table 7-4-2 Items to Be Logged and Retained by Users Using Gateway Connections
Transmission/Upon transmission
Upon reception
reception
Item
User code○○

Identifying number○–Procedure code○○

Date and time○○○:Required–:Not required[2] Period of log retention
Logs shall be retained for a period of one year.
[3] Location and method of log retention
Although users can decide on the location and method of log retention by themselves, theymust be able to promptly disclose retained logs to NACCS Center whenever they ar erequested to do so.

7-4-3

NACCS Center
serverUser system

In JapanGetaway computer, etc.
can be located at asingle location in Japan,
but not outside Japan.

User network
Gateway
computer, etc.

NACCS
connection
routerImport/export declaration○ Logged data to be retained whenprocessing customs procedures *Retention period: 1 year

Jurisdiction of Tokyo Customs
Branchoffice A

NACCS processing
computer A- User code
- Identifying number (for transmission
messages only)- Procedure code
- Date and time

Declared cargo

Import/export declaration
Jurisdiction of Osaka Customs
Branch office B

NACCS processing
computer B

Declared cargo

Figure 7-4-1 Logs for Import/Export Declaration Procedures, etc. Processed on computers Connected
to Gateway Computers

Figure 7-4-2 [Deleted]

7-4-4

7.4.2 Security Standards for Connections to External Networks(1) Restrictions on the Use of NACCS Connection Router[1] Use of LAN port
In the case of peer-to-peer connections, connections via a router, or gateway connections, LANport of the NACCS connection router on the user system side shall be set exclusively for accessto the NACCS server, and therefore the LAN port cannot be used for other purposes. (WANports cannot be used either.)[2] Use of console port
The console port is used by NACCS Center to set the NACCS connection router, and users
must not connect any device to it.
(2) Restrictions on Connection to External Networks without Using NACCS Connection Router[1] Case of connection to external networks using LAN connection (network -to-network connection)
Prior to connecting to any external network, the user is required to undergo security screening
conducted by NACCS Center.
Examples of cases where connection to external networks (other companies' networks,Internet, etc.) is allowed are as follows.
Example 1: Case where a mechanism provided in the user network (proxy server being
installed, etc.) does not allow access to user computers from externalnetworks.
Example 2: Case where functions of the router (not the one provided by NACCSCenter) used to connect to external networks include a NAT equivalentfunction (IP address conversion) that hides the internal network from theoutside.
Example 1

NACCS user network
NACCS
connection
router

NACCS
processing computer

External network(Internet, etc.)

Proxy server

Non-NACCS
processing computer

Other router

User system

Example 2

NACCS user network
NACCS
connection
router

NACCS
processingcomputer

External network(Internet, etc.)
Other router

NAT equivalentfunction
Non-NACCS
processing computer

User system

Figure 7-4-3 Examples (1 and 2) of Cases Where Connection to External Networks is Allowed
7-4-5

[2] Case of remote connection to external networks
Prior to connecting to any external network, the user is required to undergo security screening
conducted by NACCS Center.
[a] Examples of cases where connection to external networks (other companies' networks,Internet, etc.) is allowed are as follows.
Case where a mechanism provided does not allow a third party to access to a computer in aninternal network and a computer in an external network and the network between thecomputers by users installing VPN devices, etc. (The same security measures must be takenfor computers on the external network that are connected remotely as measures forcomputers on the internal network.)

NACCS user network
NACCS
processingcomputer

NACCS
connection
routerExternal network(Internet, etc.)
VPN devices,etc.
Non-NACCS
processing computer

User system

Figure 7-4-4 Example of Case Where Connection between External Networks and NACCS Processing
Computer is Allowed.
Figure 7-4-5 [Deleted]
Table 7-4-3 Restrictions on Connection to External Networks without Using NACCS Connection Router
LAN connection
NACCS processing computer
Non-NACCS processing computer

Remote connection

Subject to security screening conducted by NACCSCenter7-4-6