NISD-K305-101

Technical Standards for Information Security
Measures for the Central Government
Computer Systems

April 21, 2011
Established by the Information Security Policy Council

NISD-K305-101

NISD-K305-101

Table of Contents
Chapter 2.1 General ..............................................................................................................................1
2.1.1.1 Positioning of Technical Standards for Measures .............................................................1(1)

Positioning of these Technical Standards for Measures as an enhancement ofInformation Security Measures for the Central Government Computer Systems .................1(2)

Revising these Technical Standards for Measures ....................................................1(3)

Compliance with laws and regulations .....................................................................1

2.1.1.2 How to use Technical Standards for Measures .................................................................1(1)

Structure .................................................................................................................... 1(2)

Itemized measures .....................................................................................................1(3)

Setting security levels ...............................................................................................1

2.1.1.3 Classification of Information and Types of Marking ........................................................1(1)

Classification and marking........................................................................................1(2)

Classification.............................................................................................................1(3)

Types of marking ......................................................................................................2

2.1.1.4 Evaluation Procedure ........................................................................................................2
2.1.1.5 Definition of Terms ...........................................................................................................2
Chapter 2.2 Measures based on Clarifying Information Security Requirements ..................................3
2.2.1 Information Security Functions ...............................................................................................3
2.2.1.1 Authentication Functions ..................................................................................................3
Compliance Requirements ........................................................................................................3(1)

Introducing authentication functions.........................................................................3

2.2.1.2 Access Control Functions..................................................................................................5
Compliance Requirements ........................................................................................................5(1)

Introducing access control functions .........................................................................5(2)

Configuring access control........................................................................................5

2.2.1.3 Administrative Functions ..................................................................................................6
Compliance Requirements ........................................................................................................6(1)

Introducing administrative functions ........................................................................6(2)

Granting and managing identification codes and authentication information...........6

2.2.1.4 Audit Trail Management Functions...................................................................................7
Compliance Requirements ........................................................................................................7(1)

Introducing audit trail management functions .......................................................... 7(2)

Obtaining and keeping the audit trails ......................................................................7

2.2.1.5 Assurance Functions .........................................................................................................8
Compliance Requirements ........................................................................................................8

Table of Contents-1

NISD-K305-101(1)Introducing assurance functions................................................................................8

2.2.1.6 Encryption and Electronic Signatures (including Key Management) ...............................8
Compliance Requirements ........................................................................................................8(1)

Introducing encryption and electronic signature functions .......................................8(2)

Management concerning encryption and electronic signatures ................................92.2.2 Threats to Information Security ............................................................................................. 10
2.2.2.1 Security Holes ................................................................................................................. 10
Compliance Requirements ...................................................................................................... 10(1)

Implementing information systems ......................................................................... 10(2)

Operating information systems ...............................................................................10

2.2.2.2 Malware .......................................................................................................................... 11
Compliance Requirements ...................................................................................................... 11(1)

Implementing information systems ......................................................................... 11(2)

Operating information systems ............................................................................... 11

2.2.2.3 Denial of Service Attacks................................................................................................ 12
Compliance Requirements ...................................................................................................... 12(1)

Implementing information systems ......................................................................... 12(2)

Operating information systems ...............................................................................122.2.2.4 Stepping Stone ................................................................................................................ 13
Compliance Requirements ...................................................................................................... 13(1)

Implementing information systems ......................................................................... 13(2)

Operating information systems ...............................................................................13

Chapter 2.3 Measures for Information System Components ..............................................................142.3.1 Facilities and Environment .................................................................................................... 14
2.3.1.1 Secure Areas where Computers and Communication Equipment are Located ...............14
Compliance Requirements ...................................................................................................... 14(1)

Managing entry and exit .........................................................................................14(2)

Managing visitors and delivery personnel ..............................................................14(3)

Securing computers and communication equipment .............................................. 15(4)Managing security in secure areas ..........................................................................16(5)

Measures against disasters and failures...................................................................16

2.3.2 Computers .............................................................................................................................. 17
2.3.2.1 Common Measures for Computers .................................................................................17
Compliance Requirements ...................................................................................................... 17(1)

Installing computers ................................................................................................17(2)

Operating computers ...............................................................................................17

Table of Contents-2

NISD-K305-101(3)

Disposing of computers .......................................................................................... 17

2.3.2.2 Terminals.........................................................................................................................18
Compliance Requirements ...................................................................................................... 18(1)

Installing terminals..................................................................................................18(2)

Operating terminals .................................................................................................18

2.3.2.3 Servers ............................................................................................................................ 19
Compliance Requirements ...................................................................................................... 19(1)

Installing servers .....................................................................................................19(2)

Operating servers ....................................................................................................192.3.3 Application Software ............................................................................................................. 20
2.3.3.1 E-mail.............................................................................................................................. 20
Compliance Requirements ...................................................................................................... 20(1)

Introducing e-mail services .....................................................................................20(2)

Operating e-mail services........................................................................................20

2.3.3.2 Web ................................................................................................................................. 20
Compliance Requirements ...................................................................................................... 20(1)

Introducing web servers ..........................................................................................20(2)

Developing web applications ..................................................................................21(3)

Operating web services ...........................................................................................21

2.3.3.3 Domain Name System (DNS) .........................................................................................22
Compliance Requirements ...................................................................................................... 22(1)

Introducing DNS .....................................................................................................22(2)

Operating DNS........................................................................................................222.3.4 Communication Lines ............................................................................................................ 23
2.3.4.1 Common Measures for Communication Lines ............................................................... 23
Compliance Requirements ...................................................................................................... 23(1)

Implementing communication lines ........................................................................ 23(2)

Operating communication lines ..............................................................................24(3)

Disposing of communication lines ..........................................................................24

2.3.4.2 Management of Communication Lines in the Government Facilities ............................25
Compliance Requirements ...................................................................................................... 25(1)

Implementing communication lines in government facilities ................................. 25(2)

Operating communication lines in government facilities........................................25(3)

Measures on communication lines ..........................................................................25

2.3.4.3 Connecting to Communication Lines Outside the Government Facilities ......................26
Compliance Requirements ...................................................................................................... 26

Table of Contents-3

NISD-K305-101(1)Connecting internal lines to external lines ..............................................................26(2)

Operating communication lines inside the government facilities which areconnected to communication lines outside the government facilities .................................27
Chapter 2.4 Measures for Individual Issues ........................................................................................ 28
2.4.1 Miscellaneous ........................................................................................................................ 28
2.4.1.1 Measures for Introducing IPv6 Technology to Information Systems .............................28
Compliance Requirements ...................................................................................................... 28(1)

Measures for vulnerability during the IPv6 transition.............................................28(2)

Preventing and monitoring unintended IPv6 communications ...............................28

Table of Contents-4

NISD-K305-101

Chapter 2.1 General
2.1.1.1 Positioning of Technical Standards for Measures(1) Positioning of these Technical Standards for Measures as an enhancement of Information
Security Measures for the Central Government Computer Systems
As described in the Management Standards for Information Security Measures for the Central
Government Computer Systems (hereinafter referred to as the "Management Standards for
Measures").
(2) Revising these Technical Standards for Measures
As stipulated in the Management Standards for Measures.
(3) Compliance with laws and regulations
As stipulated in the Management Standards for Measures.

2.1.1.2 How to use Technical Standards for Measures(1) Structure
As stipulated in the Management Standards for Measures.
(2) Itemized measures
As stipulated in the Management Standards for Measures.
(3) Setting security levels
As stipulated in the Management Standards for Measures.

2.1.1.3 Classification of Information and Types of Marking(1) Classification and marking
As stipulated in the Management Standards for Measures.
(2) Classification
As stipulated in the Management Standards for Measures.

1

NISD-K305-101(3) Types of marking
As stipulated in the Management Standards for Measures.

2.1.1.4 Evaluation Procedure
As stipulated in the Management Standards for Measures.

2.1.1.5 Definition of Terms
As stipulated in the Management Standards for Measures.
The following terms additionally appear in these Technical Standards for Measures.

"Delivery personnel" means a person who receives items from, or passes items to employees. Suchas of courier services and delivery of office equipment, etc.

"Announced security hole" means a publically known security hole which has been announced bysoftware or hardware manufacturers or vendors, or by security-related organizations such as the
JPCERT Coordination Center.

"Multiple factors authentication / composite authentication" is an authentication method whichuses a combination of multiple methods.

"Mobile PC" means a terminal which can be moved as required for business purposes regardless ofthe shape of the terminal. A laptop PC that is used only at a specific location is not classified as amobile PC.

2

NISD-K305-101

Chapter 2.2 Measures based on Clarifying Information Security
Requirements
2.2.1 Information Security Functions
2.2.1.1 Authentication Functions
Compliance Requirements(1) Introducing authentication functions[BASIC Requirements](a) For information systems which are deemed to require authentication, information systemsecurity officers must provide functions for identification and authentication.
(b) For information systems which are deemed to require authentication and secrecy of theauthentication information, information system security administrators must protect
authentication information from disclosure.
(i)Authentication information must be encrypted when it is stored.

(ii)

Authentication information must be encrypted when it is transmitted.

(iii) If authentication information cannot be encrypted when it is stored or transmitted,
the user must be notified so whenever the user sets, changes, or provides (enters)
his/her own authentication information.
(c) For information systems which are deemed to require authentication and periodical changeof authentication information, information system security officers must establish afunction to periodically prompt users to change authentication information and one of thefollowing additional functions.
(i)

A function to check whether the user changes his/her authentication information
periodically(ii)

A function to refuse continued use of the information system if the user does notchange his/her authentication information periodically(d) For information systems which are deemed to require authentication and measures against
the possibility where their authentication information storage device may be accessed bythird parties, information system security officers must establish a function to stop
authentication using the given authentication information or given authentication
information storage device, or to stop the use of information systems which use thecompromised identification code.
(e) For information systems which are deemed to require authentication and deploy
knowledge-based authentication, information system security officers must establish the3

NISD-K305-101

following functions.
(i)

A function to let the users set their own authentication information(ii)

A function to protect authentication information set by users from disclosure toothers.

(f)

For information systems which are deemed to require authentication and deploy anauthentication method other than knowledge-based, ownership-based, or biological means,the information system security officer must implement an authentication method whichmeets all the applicable requirements in the following according to its characteristics.
(i)

It must not authenticate illegitimate subjects (prevention of false acceptance).

(ii)

It must not reject legitimate subjects by any reasons which are not the subject's fault(prevention of false rejection).

(iii) Legitimate subjects must not be able to grant (also issue, renew, or change;
hereinafter the same in this section) or lend their authentication information to otherparties easily (prevention of impersonation).
(iv) The authentication information must not be easily copied (prevention of
reproduction).
(v)

There must be means to disable individual logon at the discretion of the information
system security administrator (assurance of invalidation).

(vi) Authentication must be functional whenever required without disruption (assuranceof availability).
(vii) If any information or device needs to be supplied from an external source in order to
add new subjects, the supply must be sufficient throughout the information system's
lifetime (assurance of continuity).
(viii) The authentication information must re-issuable to the legitimate subject in a securemanner if the previously granted authentication information becomes unusable(assurance of re-issuance).
[ENHANCED Requirements](g) For information systems which are deemed to require authentication, information systemsecurity officers must establish a multiplefactor (composite) authentication function.
(h) For information systems which are deemed to require authentication, information systemsecurity officers must establish a function which notifies the logon user information on theprevious logon.
(i)

For information systems which are deemed to require authentication, information systemsecurity officers must establish a function which detects or prevents illegal logon attempts.

(j)

For information systems which are deemed to require authentication, information systemsecurity officers must establish a function which displays a notification about the use of

4

NISD-K305-101

the given information system before the user logs in to the information system.
(k) For information systems which are deemed to require authentication, information systemsecurity officers must establish a function which prevents users from re-using the sameauthentication information when prompting the user for periodical change of theauthentication information.
(l)

For information systems which are deemed to require authentication and share an ID codewith administrative permissions, information system security officers must establish afunction which requires the users to log on using individual ID codes before logging inusing the shared ID code.

2.2.1.2 Access Control Functions
Compliance Requirements(1) Introducing access control functions[BASIC Requirements](a) For information systems which are deemed to require access control, information systemsecurity officers must establish a function to provide access control.
[ENHANCED Requirements](b) For information systems which are deemed to require access control, information systemsecurity officers must add a function to provide access control based on attributes otherthan those of the user and groups of which the user is a member.
(c) For information systems which are deemed to require access control, information systemsecurity officers must establish a mandatory access control function.
(2) Configuring access control[BASIC Requirements](a) For information systems whose access control cannot be established by employees
themselves, information system security officers must establish access control according to
the Classification and marking of the information stored in the given information system.

5

NISD-K305-101

2.2.1.3 Administrative Functions
Compliance Requirements(1) Introducing administrative functions[BASIC Requirements](a) For information systems which are deemed to require administration, information systemsecurity officers must establish an administrative function.
[ENHANCED Requirements](b) For information systems which are deemed to require administration, information systemsecurity officers must establish least privilege.
(c) For information systems which are deemed to require administration, information systemsecurity officers must establish a function which re-issues authentication information
automatically.
(d) For information systems which are deemed to require administration, information systemsecurity officers must establish a dual locking function.
(2) Granting and managing identification codes and authentication information[BASIC Requirements](a) Administrators must issue identification codes and authentication information only to thesubject who is permitted to use the information system.
(b) When an administrator issues an identification code, he/she must notify the user whether
the code is shared or not.
(c) Administrators must grant (also issue, renew, or change; hereinafter the same in thissection) an identification code with administrative permissions only when suchpermissions are required for the business or business responsibilities.
(d) Administrators must disable the identification code of the employee when he/she no longer
requires the information system. Also, administrators must check for unnecessary
identification codes when adding or deleting identification codes due to personnel changes,etc.
(e) Administrators must make sure the loaned authentication information storage device isreturned from the employee when he/she no longer requires the information system.
(f)Administrators must configure access control to grant the minimum necessary permissions
for the given business responsibilities and needs. Also, administrators must check forinappropriate access control settings when adding or deleting identification codes due topersonnel changes, etc.

6

NISD-K305-101[ENHANCED Requirements](g) Administrators must grant only one identification code per employee for a single
information system.
(h) Administrators must record which identification code is granted to which subject.
Administrators must obtain permission from their information system security officer inadvance when deleting the record.

(i)Administrator must not re-use an identification code for another subject.

2.2.1.4 Audit Trail Management Functions
Compliance Requirements(1) Introducing audit trail management functions[BASIC Requirements](a) For information systems which are deemed to require audit trails, information systemsecurity officers must establish a function which obtains the audit trails.
(b) For information systems for which the information system security officer deems torequire audit trails, the information system security officer must define measures against
the cases where audit trails cannot be or may not be obtained, and establish functions toapply these measures to the information systems as necessary.
(c) For information systems for which the information system security officer deems torequire audit trails, the information system security officer must establish access control on
the obtained audit trails to prevent illegal deletion, falsification, and access.
[ENHANCED Requirements](d) For information systems for which the information system security officer deemed torequire audit trails, the information system security officer must establish a function which
automatically checks, analyzes and report the audit trails for the information systems.
(e) Information systems security officers must establish a function which immediately notifies
the monitoring personnel when any indication of possible information security
infringement is detected from the obtained audit trails for the information systems.
(2) Obtaining and keeping the audit trails[BASIC Requirements](a) For information systems for which the information system security officer deems torequire audit trails, the information system security administrator must obtain the audit
trails using the function established for those information systems.

7

NISD-K305-101(b) For information systems for which the information security officer deems to require audit
trails, the information system security administrator must keep the obtained audit trails
until the expiry date and delete them without delay where the expiry date does not needextended.
(c) For information systems for which the information security officer deems to require audit
trails, the information system security administrator must take designated measures when
the audit trails cannot be or may not be obtained.

2.2.1.5 Assurance Functions
Compliance Requirements(1) Introducing assurance functions[BASIC Requirements](a) For information systems which are deemed to require assurance measures, information
system security officers must establish the assurance functions.

2.2.1.6 Encryption and Electronic Signatures (including Key Management)
Compliance Requirements(1) Introducing encryption and electronic signature functions[BASIC Requirements](a) For information systems which handle confidential information (except written
documents; hereinafter the same in this section), information system security officers must
consider whether an encryption function are required.
(b) For information systems which are deemed to require encryption, information systemsecurity officers must establish an encryption function.
(c) For information systems which handle confidential information, information systemsecurity officers must consider whether a function to add and verify electronic signatures
is required.
(d) For information systems which are deemed to require electronic signatures, information
system security officers must establish a function to add and verify electronic signatures.
[ENHANCED Requirements](e) For information systems which are deemed to require encryption or electronic signatures,information system security officers must establish such functions by assembling

8

NISD-K305-101

encryption modules as components to allow the replacement.
(f)

For information systems which are deemed to require encryption or electronic signature,
information system security officers must enable a selection from multiple algorithms.

(g) For information systems which are deemed to require encryption or electronic signatures,information system security officers must select products certified by the Japan
Cryptographic Module Validation Program in order to assure appropriate implementationof the selected algorithm on the software or hardware, and security of keys andauthentication information used to encrypt, or to add and validate the electronic signature.
(h) For information systems which are deemed to require encryption or electronic signatures,information system security officers must store the keys for decrypting the encrypted
information or for adding electronic signatures in a tamper-proof encryption module inorder to protect them from physical attacks by third parties.
(2) Management concerning encryption and electronic signatures[BASIC Requirements](a) For information systems which are deemed to require electronic signatures, information
system security officers must provide the information or means to validate the electronic
signature to the relying party.
[ENHANCED Requirements](b) For information systems which are deemed to require encryption or electronic signatures,information system security officers must obtain information on how the algorithm
selected for the given system may be compromised where necessary.

9

NISD-K305-101

2.2.2 Threats to Information Security
2.2.2.1 Security Holes
Compliance Requirements(1) Implementing information systems[BASIC Requirements](a) Information system security officers must apply measures against announced security
holes associated with the software deployed on the computer or communication equipment
when it is installed or starting to operate (excluding computers and communicationequipment with no announced security holes; hereinafter the same in this section).
[ENHANCED Requirements](b) Information system security officers must take available measures for computers andcommunication equipment even when they have no announced security holes.
(2) Operating information systems[BASIC Requirements](a) Information system security administrators must obtain information on the announced
security holes associated with the software deployed on computers and communicationequipment under his/her management as required.
(b) When an information system security officer obtains information on security holes
associated with the software deployed on computers or communications equipment under
his/her management, the information system security officer must analyze the risks the
security holes imposes on the information system, determine the following items, andformulate measures against the security hole.
(i)

Necessity of measures(ii)

Methods(iii) Temporary workaround if there is no method available(iv) Effects of measures or temporary workaround on the information system(v)

Measure implementation plan(vi) Necessity of testing measures(vii) Method for testing measures(viii) Measure test plan(c) Information system security administrators must take measures against security holes
based on the measure implementation plan.
(d) Information system security administrators must record the items such are the10

NISD-K305-101

implementation date, work description, and persons in charge when taking the measuresagainst the security hole.
(e) Information system security administrators must obtain a file such as a patch or upgradedsoftware, etc. to plug the security hole (hereinafter referred to as "security update file")
through a reliable source. Also, they must validate the security update file if an integrity
validation procedure is provided.
(f)Information system security administrators must investigate and analyze measures forsecurity holes and software configurations periodically and take measures if any computeror communication equipment is in an inappropriate condition.

(g) Information system security officers must share the obtained information and measuresassociated with security holes with other information system security officers as required.

2.2.2.2 Malware
Compliance Requirements(1) Implementing information systems[BASIC Requirements](a) Information system security officers must install antivirus software, etc. on computers(except for computers on which no antivirus software can operate; hereinafter the same inthis section.)(b) Information system security officers must take measures against malware by using
antivirus software, etc. for all possible infection routes.
[ENHANCED Requirements](c) Information system security officers must install a combination of antivirus software ofdifferent types on possible infection routes of malware.
(d) Information system security officers must take measures to prevent malware fromspreading on possible infection routes.
(2) Operating information systems[BASIC Requirements](a) Information system security administrators must try to collect information on malware,
determine whether any measures are required, and instruct employees to take measures
where necessary.
(b) Information system security officers must confirm and review the status of measuresagainst malware as appropriate.

11

NISD-K305-101

2.2.2.3 Denial of Service Attacks
Compliance Requirements(1) Implementing information systems[BASIC Requirements](a) For information systems which handle vital information (limited to information systems
with computers, communication equipment, or communication lines which are accessed
via the Internet; hereinafter the same in this section), information system security officers
must use the functions, that are implemented on the computers or communicationequipment to provide services, to protect the system from denial of service attacks.
(b) For information systems which handle vital information, information system security
officers must design the systems to minimize the impact of denial of service attacks.
(c) For information systems which handle vital information, information system security
officers must identify the monitoring scope among computers, communication equipment,
and communication lines which may suffer denial of service attacks, and define themonitoring procedure and the retention period of the monitoring records.
(d) For information systems which handle vital information, information system security
officers must establish the response procedure and communication system with thecommunications service provider who provides the Internet connection, on assumption
where measures on computers and communication equipment are not sufficient to avoid
denial of service attacks with a large number of access.
[ENHANCED Requirements](e) For information systems which handle vital information, information system security
officers must implement devices to eliminate or mitigate the impact of denial of service
attacks on the computers, communication equipment, or communication lines.
(f)

For information systems which handle vital information, information system security
officers must secure the means to effectively apply measures against denial of service
attacks.

(g) For information systems which handle vital information, information system security
officers must provide redundancy for computers, communication equipment orcommunication lines that are required to provide services.
(2) Operating information systems[BASIC Requirements](a) For information systems which handle vital information, information system security
administrators must monitor the computer, communication equipment, and communication

12

NISD-K305-101

line in accordance with the monitoring procedure and keep the monitoring records if themonitoring procedure is defined.

2.2.2.4 Stepping Stone
Compliance Requirements(1) Implementing information systems[BASIC Requirements](a) Information system security officers must take measures to prevent information systems(limited to information systems with computers, communication equipment orcommunication lines which are connected to communication lines external to thegovernment facility such as Internet; hereinafter the same in this section) from being used
as a stepping stone.
(b) Information system security officers must design the information systems to minimize theimpact of the system being used as the stepping stone.
[ENHANCED Requirements](c) Information system security officers must define the monitoring procedure to determine
whether information systems are being used as a stepping stone, and the retention periodof the monitoring records.
(2) Operating information systems[ENHANCED Requirements](a) Information system security administrators must monitor information systems inaccordance with the monitoring procedure and keep the monitoring records.

13

NISD-K305-101

Chapter 2.3 Measures for Information System Components
2.3.1 Facilities and Environment
2.3.1.1 Secure Areas where Computers and Communication Equipment are LocatedCompliance Requirements(1) Managing entry and exit
[BASIC Requirements](a) Information system security officers must take measures to prevent suspicious individuals
from entering secure areas.
(b) For information systems that handle classified information, information system security
officers must physically isolate the secure area and take measures to manage entry andexit.
[ENHANCED Requirements](c) Information system security officers must take measures to authenticate persons who entersecure areas.
(d) Information system security officers must take measures to authenticate persons who exitfrom secure areas.
(e) Information system security officers must take measures to prohibit authorized persons
from allowing unauthorized persons to enter or exit from secure areas.
(f)Information system security officers must establish the procedure to authorize persons whoenter secure areas frequently. Information such as the person's name, department, approved
entry date, duration, and reason must be recorded in a document.

(g) Information system security officers must update the above document if there are anychanges to persons who are authorized entry to secure areas. Also, such changes must berecorded.
(h) Information system security officers must take measures to record and monitor all entries
to and exits from secure areas.
(2) Managing visitors and delivery personnel[ENHANCED Requirements](a) When receiving any visitors to secure areas, information system security officers must takemeasures to confirm the name, organization, purpose of the visit, and the name anddepartment of the employee who receives the visit.
(b) When receiving any visitors to secure areas, information system security officers must take

14

NISD-K305-101

measures to record the name, organization, purpose of the visit, the name and departmentof the employee who receives the visit, the date of the visit, and the time of entry and exit.
(c) When receiving any visitors to secure areas, information system security officers must
establish the procedure for the visited employee to examine whether the visitor may enter
the secure area.
(d) Information system security officers must take measures to restrict the area where thevisitors may enter.
(e) Information system security officers must take measures to ensure that the visited
employee accompany the visitor in the secure area.
(f)

Information system security officers must take measures to visually distinguish visitors
and persons who are authorized regular entry.

(g) Information system security officers must apply one of the following measures forexchanging items with delivery personnel.
(i)Instruct such exchange to take place outside secure areas.

(ii)

Restrict the area delivery personnel may enter to where they have no access tocomputers, communication equipment, or storage media and require an employee toaccompany them.

(3) Securing computers and communication equipment[BASIC Requirements](a) For information systems which handle classified information, information system security
officers must take measures to prevent theft and illegal removal of computers which areinstalled and used at a specific location.
[ENHANCED Requirements](b) For information systems which handle classified information, information system security
officers must physically isolate computers and communication equipment from otherinformation systems and prohibit them from sharing the same secure area.
(c) For information systems which handle classified information, information system security
officers must take measures to prevent theft and illegal removal of communicationequipment which are installed and used at a specific location.
(d) For information systems which handle confidential information, information systemsecurity officers must take measures to protect display devices of computers andcommunication equipment from others' eyes.
(e) For information systems which handle confidential information, information systemsecurity officers must take measures to protect cables including power cables andcommunication cables from threats such as damage and eavesdropping.

15

NISD-K305-101(f)

For information systems which handle confidential information, information systemsecurity officers must take measures against information leakage caused byelectromagnetic waves.

(4) Managing security in secure areas[BASIC Requirements](a) Employees must always wear their IDs visible to other employees in secure areas.
[ENHANCED Requirements](b) Employees must obtain approval from their information system security officer before
taking in or out items related to information systems which handle classified information
to and from secure areas.
(c) Information system security officers must keep record of taking in and out items related to
information systems which handle classified information to and from secure areas.
(d) For information systems which handle confidential information, information systemsecurity officers must restrict computers, communication equipment, electromagnetic
storage media, and recording devices (including ones for voice, video, and images) which
are irrelevant to the system to be taken into security areas.
(e) Information system security officers must take measures to monitor the work carried out insecure areas.
(5) Measures against disasters and failures[ENHANCED Requirements](a) For information systems which handle vital information, information system security
officers must take physical measures to protect computers and communication equipmentfrom natural and man-made disasters.
(b) For information systems which handle vital information, information system security
officers must ensure safety of workers and means to shut down the power supply tocomputers and communication equipment as required in the event of disaster or failure insecure areas.

16

NISD-K305-101

2.3.2 Computers
2.3.2.1 Common Measures for Computers
Compliance Requirements(1) Installing computers[BASIC Requirements](a) For computers which handle vital information, information system security officers mustobtain computers with considerations to the required system performance including thefuture perspective.
(b) For information systems which handle classified information, information system security
officers must locate computers in secure areas. However, this is not required for mobile
PCs approved by the information system security officer.
(c) For information systems which handle vital information, information system security
officers must examine whether redundancy configuration is required for computers which
provide services, and must establish the redundancy configuration for the given computers.
(d) Information system security officers must take measures to protect computers andcommunication equipment from illegal operations while employees are away from theirdesks.
(2) Operating computers[BASIC Requirements](a) Employees must not use computers for any purposes other than business purposes.
(b) Employees must take measures to protect computers from illegal operations while they areaway from their desks.
[ENHANCED Requirements](c) Information system security officers must periodically examine the state of all software
products used on computers under their management and make improvements on
computers which are in an inappropriate condition.
(3) Disposing of computers[BASIC Requirements](a) Information system security officers must erase all the information on electromagnetic
storage media in the computer when disposing of a computer.

17

NISD-K305-101

2.3.2.2 Terminals
Compliance Requirements(1) Installing terminals[BASIC Requirements](a) The information system security officer must define a list of software that may be used onterminals. However, information system security officers may list prohibited software
when it is difficult to list permitted software; or, use both lists together.
(b) For mobile PCs which handle classified information, information system security officers
must enable the same protective measures as terminals used within the government facility
even when the mobile PCs are used outside the government facility.
(c) Employees must obtain approval from their information system security officer to use
mobile PCs.
(d) For mobile PCs which handle confidential information, information system security
officers must provide the encryption function for information stored in the electromagnetic
storage media.
(e) For mobile PCs which handle classified information, information system security officers
must define measures to prevent theft and to mitigate damage caused by the theft.
[ENHANCED Requirements](f)

Information system security officers must build information systems using terminals on
which employees cannot save information.

(2) Operating terminals[BASIC Requirements](a) Employees must not use any software other than those permitted on terminals.
(b) Employees must take measures to prevent theft when using mobile PCs which handle
classified information.
(c) When taking mobile PCs which handle confidential information out of the government
facility, employees must examine whether they should encrypt the confidential informationin the electromagnetic storage media in the mobile PC, and encrypt the information if it isdeemed necessary.
(d) Employees must not connect terminals to any communication lines other than those
approved by their information system security officer.
[ENHANCED Requirements](e) Information system security administrators must synchronize terminal clocks with thestandard time of information systems.

18

NISD-K305-101

2.3.2.3 Servers
Compliance Requirements(1) Installing servers[BASIC Requirements](a) When maintenance work on servers is carried out via a communication line, information
system security officers must examine whether the communications should be concealed,and establish a function to conceal transmitted information if it is deemed necessary.
Communications must be concealed if the maintenance work is carried out via acommunication line external to the government facility.
(b) Information system security officers must define software products which are used toprovide services and to operate and manage servers.
(c) If any unapproved server applications are found running on a server, the information
system security officer must stop the use of them. Also, disable any unnecessary functions
even for approved server applications.
[ENHANCED Requirements](d) Information system security officers must uninstall any unapproved software from servers.
(e) Information system security administrators must establish either load distribution or server
redundancy configuration for servers which provide services while handling vital
information.
(2) Operating servers[BASIC Requirements](a) Information system security officers must confirm configuration changes on servers
periodically. Also, they must identify the impact of such changes on the servers and takemeasures.
(b) For servers which handle vital information, information system security administrators
must take necessary measures to restore them.
(c) Information system security administrators must record operations and management ofservers such as the date of the work, the server, work descriptions, and the engineer.
(d) Information system security administrators must synchronize server clocks with thestandard time of information systems.
[ENHANCED Requirements](e) Information system security administrators must monitor the security status of servers.
(f)

For servers which handle vital information, information system security administrators
must monitor the system status to detect any failures.

19

NISD-K305-101

2.3.3 Application Software
2.3.3.1 E-mailCompliance Requirements(1) Introducing e-mail services[BASIC Requirements](a) Information system security officers must configure e-mail servers not to relay unsolicited
e-mails.
(b) Information system security officers must provide a function which authenticates
employees for sending and receiving e-mails from e-mail clients to and from e-mailservers.
(c) Information security officers must take measures to prevent email address spoofing.
(2) Operating e-mail services[BASIC Requirements](a) Employees must use e-mail services which are provided by their government agencies or
outsourced e-mail servers when sending and receiving e-mails containing businessinformation. However, this is not applicable to those who have obtained approval for
information processing by external information systems.
(b) Employees must display received e-mail contents in the way where scripts are notexecuted on the computer.

2.3.3.2 Web
Compliance Requirements(1) Introducing web servers[BASIC Requirements](a) Information system security officers must configure security settings on web servers
appropriately. Measures including the following must be applied as appropriate security
functions.
(i)Appropriately restrict functions of web servers.

(ii)

Appropriately configure access control on information stored on web servers.

(iii) Appropriately manage identification codes.
(iv) Examine risks of information leakage by communication eavesdropping, and provide

20

NISD-K305-101

an authentication function by encryption and electronic certificate where it is deemednecessary.
[ENHANCED Requirements](b) For information systems which handle confidential information, information systemsecurity officers must identify information to be stored on web servers and confirm no
confidential information is stored on these web servers.
(2) Developing web applications[BASIC Requirements](a) Information system security officers must assure appropriate information security by
establishing a function to include security measures in web application development.
Measures including the following must be applied as appropriate security functions(i)

Do not prevent users from checking URL.

(ii)

Appropriately carry out authentication and access control.

(iii) Restrict file paths which are used by web applications.
(iv) Remove any illegal input data.
(v)

Remove any illegal output data.

(vi) Implement safe session management.
[ENHANCED Requirements](b) Information system security officers must implement information systems whose services
through web servers do not rely on(3) Operating web services[BASIC Requirements](a) Employees must configure security on web clients appropriately to assure information
security.
(b) Employees must check the distributor of the software using electronic signatures when
downloading software on a computer running a web client.
(c) Employees must confirm the following when they upload confidential information to an
online form displayed on a website.
(i)

The information is encrypted.

(ii)

The website is legitimately the one provided by the assumed organization.

[ENHANCED Requirements](d) Information system security officers must restrict external websites which can be viewed
by employees and review the restriction periodically.

21

NISD-K305-101

2.3.3.3 Domain Name System (DNS)
Compliance Requirements(1) Introducing DNS[BASIC Requirements](a) Information system security officers must take measures against stoppage of nameresolution on the DNS content server which provides the name resolution service of
information systems which handle vital information.
(b) Information system security officers must define a procedure to operate and manage thedomain information stored on the DNS content server.
(c) Information system security officers must take measures on the DNS cache server tomaintain appropriate response to name resolution requests.
(d) Information system security officers must take measures on the DNS content server toprevent information leakage through the name resolution service when resolving thenames which are internal use only.
[ENHANCED Requirements](e) For DNS servers which provide name resolution service to important information systems,
information system security officers must configure the content server to add electronic
signatures when providing domain name information, and the cache server to verify theelectronic signatures when resolving names.

(2) Operating DNS[BASIC Requirements](a) Information system security officers must maintain consistency of domain information
among servers when installing multiple DNS content servers.
(b) Information system security officers must verify the domain information on the DNS
content server as necessary according to the operational and management procedures ofdomain information.

22

NISD-K305-101

2.3.4 Communication Lines
2.3.4.1 Common Measures for Communication Lines
Compliance Requirements(1) Implementing communication lines[BASIC Requirements](a) Information system security officers must examine the associated risks before
implementing communication lines.
(b) For information systems which handle vital information, information system security
officers must examine and ensure capabilities of the communication lines andcommunication equipment to provide required communication performance including thefuture perspective.
(c) Information system security officers must define software products necessary forcommunication equipment to operate. However, this is not applicable for communicationequipment whose software is difficult to replace.
(d) Information system security officers must group computers that are connected tocommunication lines and separate them on the communication line.
(e) Information system security officers must examine purposes of communications between
the grouped computers, assign communication equipment according to the purposes, andestablish access control and route control.
(f)

For information systems which handle confidential information, information systemsecurity officers must examine whether the communications should be concealed, andestablish a function to conceal communications if it is deemed necessary.

(g) For information systems which handle classified information, information system security
officers must examine physical security of lines for communications and select appropriate
communication lines.
(h) Information system security officers must ensure security of connections ofcommunication equipment which are used for remote maintenance and diagnosis services.
(i)

Information system security officers must install communication equipment in secureareas.

(j)

Information system security officers must resolve the security level and service level at thecontract exchange when using leased line services provided by telecommunications
carriers.

(k) For information systems which handle vital information, information system security
officers must examine whether redundancy configuration is required for communication

23

NISD-K305-101

lines and communication equipment which provide services, and must establish theredundancy configuration for the given communication lines and communicationequipment.
[ENHANCED Requirements](l)

Information system security officers must authenticate the communicating computers.

(2) Operating communication lines[BASIC Requirements](a) Information system security administrators must obtain approval from the information
system security officer when changing software on communication equipment.
(b) Information system security administrators must record operations and management ofcommunication lines and communication equipment such as the date of the work, thegiven communication lines and equipment, and the engineer.
(c) If a situation arises where ensuring information system security is difficult, the information
system security officer must change the configuration from sharing a communication linewith other information systems to using a separate and closed communication line.
(d) Employees must not connect computers and communication equipment to communicationlines without approval from their information system security officer.
(e) Information system security administrators must synchronize clocks on communicationequipment with the standard time of information systems.
[ENHANCED Requirements](f)

Information system security officers must periodically examine the state of all software
products required for operations of communication equipment under their management
and make improvements on communication equipment which are in an inappropriate
condition. However, this is not applicable for communication equipment whose software isdifficult to replace.

(g) Information system security administrators must take measures to protect communicationequipment from illegal operations.
(3) Disposing of communication lines[BASIC Requirements](a) Information system security officers must erase all the information on electromagnetic
storage media in the communication equipment when disposing of communicationequipment.

24

NISD-K305-101

2.3.4.2 Management of Communication Lines in the Government Facilities
Compliance Requirements(1) Implementing communication lines in government facilities[ENHANCED Requirements](a) Information system security officers must take measures to confirm that the computer isapproved for connection to a communication line before logically connecting it to thecommunication line after physically connecting it to the communication line.
(2) Operating communication lines in government facilities[ENHANCED Requirements](a) Information system security officers must review the access control configurations
periodically and at changes in communication requirements.
(b) For information systems which handle vital information, information system security
administrators must confirm and analyze the utilization and status of communication lines
daily to measure or detect degradation or abnormality in the communication lines.
(c) Information system security administrators must monitor the information that is sent or
received via communication lines in the government agency.
(3) Measures on communication lines[BASIC Requirements](a) When implementing a VPN environment, information system security officers must
examine whether measures including the following are required and take measures if it isdeemed necessary.
(i)

Establishing the application procedures for commencing and terminating the use(ii)

Encrypting the information(iii) Identifying the communicating computers or authenticating the users(iv) Obtaining and managing the authentication records(v)

Restricting the scope of communication lines which are accessible via VPN(vi) Assuring the confidentiality of the VPN connection method(vii) Managing the computers which use VPN(b) When implementing a wireless LAN environment, information system security officers
must examine whether measures including the following are necessary, and take measures
if they are deemed necessary. Communications must be encrypted if the wireless LAN
environment handles confidential information.
(i)

Establishing the application procedures for commencing and terminating the use

25

NISD-K305-101(ii)

Encrypting the information(iii) Identifying the communicating computers or authenticating the users(iv) Obtaining and managing the authentication records(v)

Restricting the scope of communication lines which are accessible via the wirelessLAN(vi) Prohibiting connections with others communication lines while being connected to
the wireless LAN(vii) Assuring the confidentiality of the wireless LAN connection method(viii) Managing the computers which are connected to the wireless LAN(c) When implementing a remote access environment using public telephone networks,
information system security officers must examine whether measures including thefollowing are required, and take measures if it is deemed necessary.
(i)

Establishing the application procedures for commencing and terminating the use(ii)

Identifying and authenticating the communicating users or caller numbers(iii) Obtaining and managing the authentication records(iv) Restricting the scope of communication lines which are accessible by remote accessconnections(v)

Prohibiting connections with other communication lines while in remote access(vi) Assuring confidentiality of the remote access method(vii) Managing the computers which is used for remote access

2.3.4.3 Connecting to Communication Lines Outside the Government Facilities
Compliance Requirements(1) Connecting internal lines to external lines[BASIC Requirements](a) Information system security officers must obtain approval from the information security
officer to connect a communication line inside the government facility to a communicationline outside the government facility.
(b) If an information system security officer determined that information system security
cannot be assured if a communication line inside the government facility is connected to acommunication line outside the government facility, he/she must implement a
communication line inside the government facility separate from other internal
communication lines which are shared with other information systems, or separate fromexternal lines.

26

NISD-K305-101(2) Operating communication lines inside the government facilities which are connected tocommunication lines outside the government facilities[BASIC Requirements](a) If a situation arises where ensuring information system security is difficult, the information
system security officer must change the configuration from an internal communication line
which is shared with other information systems, or an external line, to a separate
communication line.
(b) Information system security officers must review the access control configurations
periodically and at changes in communication lines.
(c) For information systems which handle vital information, information system security
administrators must confirm and analyze the utilization and status of communication lines
daily to measure or detect degradation or abnormality in the communication lines.
(d) Information system security administrators must monitor the information that is sent or
received

betweencommunicationlines

insidecommunication lines outside the government facilities.

27

the

government

facilities

andNISD-K305-101

Chapter 2.4 Measures for Individual Issues
2.4.1 Miscellaneous
2.4.1.1 Measures for Introducing IPv6 Technology to Information Systems
Compliance Requirements(1) Measures for vulnerability during the IPv6 transition[BASIC Requirements](a) When implementing a communication function which uses IPv6 technology (hereinafterreferred to as "IPv6 communications") in an information system, information systemsecurity officers must take necessary measures to prevent security threats the IPv6transition imposes on other information systems.
(2) Preventing and monitoring unintended IPv6 communications[BASIC Requirements](a) Information system security officers must take measures for prevent IPv6 communications
on all computers and communication equipment connected to communication lines on
which IPv6 communications are not intended.
[ENHANCED Requirements](b) Information system security officers must monitor communication lines on which IPv6
communications are not intended, and if any IPv6 communications are detected, identify
the device and take necessary measures to shut down the IPv6 communications.

28