Common Standards Group for Cybersecurity
Measures for
Government Agencies and Related Agencies（※）（※）Common Standards Group includes:•
Common Model of Cybersecurity Measures for Government
Agencies and Related Agencies•
Common Standards for Cybersecurity Measures for
Government Agencies and Related Agencies•Guidelines for Formulating Measures Criteria for
Government Agencies and Related Agencies

National Center of Incident Readiness and Strategy for
Cybersecurity (NISC)
Cabinet Secretariat
Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

Cybersecurity Measures for All Government Agencies• At NISC, through the formulation of common rules (Common Standards), audit/ monitoring, education/ training, etc., thePDCA cycle of all government agencies, etc. is appropriately implemented to comprehensively strengthen cybersecurity
measures.

Commonrules

Ministries,agencies andIAAs, ...

・International Standards
・Lessons of the past, etc.

Common Standards Group

ISMAP

Cybersecurity Strategic Headquarters

Formulation ofcybersecurity policy

Cybersecurity Measures Promotion Council(CISO Liaison Committee)

Provision of information

Call forAttention, etc.

Decision-making bodies

Informationsystem[Chair: Chief Cabinet Secretary][Chair: Deputy Chief Cabinet Secretary (Secretariat)]

PDCA

Full-time Deputy Director General
Council for Cybersecurity Measures Promotion(CISO Liaison Secondary Committee)

Operation rules,
structure (CSIRT, etc.)

G-SOC(Cross-sectional
Audit andmonitoring andmonitoring
information Penetration testgathering)(Pseudo attack)Management Audit

Education and Training
・Cybersecurity Study Sessions
・Incident Response Training(Verification of the functioning of structures and the regimes)
Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

1

Role of Common Standards for Cybersecurity Measures for Government Agencies and Related
Agencies• Common Standards are the unified framework for cybersecurity of government
agencies and incorporated administrative agencies.
• It shows the baseline of cybersecurity of government agencies and related
agencies, etc., and it is possible to take higher measures at the discretion ofeach organization.
Each agencies can adopt
higher cybersecurity measures

Levelofcybersecurity

Baseline
provided by theCommonStandards

Baseline(Old)

Raising theoverall levelAgenciesABCDEF

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

2

What are Government Common Standards?
 Government Common Standards are an integrated framework to improve information security level of Government
Agencies and Incorporated Administrative Agencies based on the Basic Act on Cybersecurity.
 Government Common Standards define a baseline for information security measures to be implemented by Government
Agencies and Related Agencies.
 Government Agencies and Incorporated Administrative Agencies formulate information security policy for each organization incompliance with the Government Common Standards considering characteristics of information handled by the organization.
This is intended to ensure that a certain information security level in any Government Agencies and Related Agencies is maintained.
The Basic Act on Cybersecurity（Act No. 104 of 2014）（Excerpt）
Act 26 Functions under Jurisdiction of the Headquarters（Omitted）(ii) establishing the standards of cybersecurity measures for national administrative organs, incorporated administrative
agencies and designated corporations, and promoting the implementation of the evaluation (including audit) of measures basedon the standards and other measures taken based on the standards
Common Model of Cybersecurity Measures for Government Agencies andRelated Agencies（July 4, 2023 Headquarter Revision）(Excerpt）

Measures higher
than the CommonStandards can be
implemented at thediscretion of eachorganization

Information
securitylevel

Article 6 Agencies, etc. shall establish basic policies and standards for countermeasures
based on the characteristics of their own organizations.
(Omitted)
３ The countermeasure standards shall conform to the Common Standards and shall be
stipulated to enable information security measures that are the same as or higher thanthe Common Standards.

Each organization

Baseline definedby CommonStandards Group

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

3PDCA cycle of the Government Agencies and Related Agencies as a whole• Ensure the information security of Government Agencies and Related Agencies as a whole by appropriately implementing
the PDCA cycle of individual organizations and the PDCA cycle of the Government Agencies and Related Agencies as awhole through the operation of Common Standards Group.
Cybersecurity StrategyHeadquarters
・Formulate or revise CommonStandards Group (except forGuideline for Establishing Standards
for Measures
・Formulate basic policy relating toaudit, publish the audit result
・Direct efforts of the wholegovernment agencies
・Report the check and audit results
・Report the incident information
・Create the draft of common
standards group (except for
Guideline for EstablishingStandards for Measures )National Center of Incident
Readiness and Strategy for
Cybersecurity (NISC)
・Check and audit the efforts situationof the whole government agencies
from comprehensive, objective andunited points of view
・Formulate or revise the Guideline for
Establishing Standards for Measures

Common Standards
Group
Advise efforts policy(such as improvement)

Government
Agencies

Implementation andPlan・Formulate government
agencies’ policy andpolicy promotion plan

PDCA

・Check, audit
・Provide information

Describe the information
security measures in midterm objective and others

Operations

PDCA
・Report the measures
implementation
situation and incident
information
・Report the evaluation
results of competent
incorporated
administrative agencies

Measures of competent
government agencies including
Common Standards group

・Education
training・Technicalmeasures
・Other efforts
based on theplan

Assessment andReview

・Check and audit theimplementation situation
・Improve based on theassessment result
・Evaluate and review
・Review the resource
allocation

PDCA
Report the implementation
situation of information
security measures
Evaluation by Act on General
Rules for Incorporated
Administrative Agencies, etc.

Evaluation of implementation (including audit)

Incorporated
Administrative
Agencies

Implementation andPlan

・Formulate policy ofincorporated
administrative agencies
・Describe theinformation security
measures in annual
plan, etc.

PDCAOperations

・Measures
based on thepolicies ofcompetent
government
agencies

Assess and Review

・Measures based on thepolicies of competent
government agencies

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

4

Background of the Revision
 Government Common Standards Group (※) is an integrated framework to improve information security level of Government Agencies andIncorporated Administrative Agencies based on the Basic Act on Cybersecurity.（※）It consist of Common Model, Common Standards and Guideline.
 The review of Government Common Standards Group is based on the recent situation and includes strengthening of measures for subcontractors
and software in consideration of increasing risks of cyber attack for supply chain and strengthening of measures of servers redundancy inconsideration of increasing use of cloud services and the characteristics of latest DDoS attacks.
Clarification of measures for subcontractors (e.g. outsourced
maintenance of information systems)•The event of leakage of information of Government Agencies contracted out to a subcontractor occurred. The risks ofcyber-attack that exploits vulnerabilities of supply chain have increased with the complication of supply chain.

Clarification of information security measures whenusing cloud services•Revision Point 「３．Strengthening of information security measures when using software」

Cyber-attacks targeting software are getting more complicated and sophisticated. Such attacks exploit improper
configuration of software and the update of the proper network monitoring software. Because security measures whenusing software are strengthened by Government Agencies in US, they also need to be strengthened in Japan.

Strengthening of measures in considerationof threats and technology trends•

Revision Point 「２．Strengthening of measures in consideration of increasing use ofcloud services」

Use of cloud services by Government Agencies has increased. Strengthening of security is required through a series ofprocesses of procurement, development, operation and disposal. The measures for secure use of the cloud services suchas SNS need to be validated.

Strengthening of information security
measures when using software•Revision Point 「１．Strengthening of information security measures
for supply chain」

Revision Point 「４．Strengthening of cyber resilience and measures in consideration of threats
and technology trends」

Facing increasing DDoS attacks that may lead to the malfunction of web sites, the security measures for such attacks needto be strengthened. Facing increasing Ransomware attacks, the security measures related to information systems
protection, recovery and backup need to be strengthened for Government Agencies.
Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

5

Point of the Revision①
Current（2021 Edition）

Point of the Revision

1. Strengtheningof information
security
measures for
supply chain○ General information security
controls for subcontractors
are stipulated.

 To protect government information when subcontracting tasks, security
measures (※) for subcontractors such as access controls, log
management and monitoring, referring to NIST supply chain controls,
are included in the contract and their implementation is required
throughout the consignment period.

2. Strengtheningof measures inconsideration ofincreasing use ofcloud services○ The cloud services forhandling confidential
information are selectedfrom the ISMAP cloudservices list.

(※) The following eight types of security measures are stipulated referring to NIST
SP800-171①Establishment and maintenance of incident response capabilities, ②Entity
authentication and access control, ③Acquisition and monitoring of logs, ④Physicalprotection of equipment, etc, ⑤Notification and control of personnel, ⑥Assetmanagement・risk evaluation, ⑦Protection of system integrity, ⑧Verification, evaluation ,and review of security measures○ The cloud services not forhandling confidential
information are evaluatedconsidering the risks ofusing it.

 As ISMAP is expanded to Incorporated Administrative Agencies and theoperation of ISMAP-LIU starts, it is clearly stated that the cloud services
for handling confidential information are selected from the ISMAP
cloud service list.

（in the exceptional case that cloud services are selected not from ISMAP cloud services
list, for example, because cloud services in the list do not have the required functions, itis necessary for CISO to ensure that the selected cloud services meet the requirements
and controls of ISMAP.） Even for the cloud services for not handling confidential information,
appropriate measures to use cloud services securely such as entity
authentication and access control are implemented. For the use ofcloud services without procurement, an advice about measures is soughtfrom NISC based on an agreement on use of external service withoutprocurement.

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

6Point of the Revision②
3. Strengtheningof information
securitymeasures whenusing software

4. Strengtheningof cyber
resilience andmeasures inconsideration ofthreats andtechnology
trendsCurrent（2021 Edition）

Point of the Revision○ Software and equipment areprocured according to IT
procurement arrangement.

 Clearly stated as essential to respond based on IT procurement
arrangement for equipment procurement. Regarding critical software (※),
security measures to ensure information security level during operationsuch as maintenance of configuration procedures, training, and regularcheck of configuration are implemented.

○ Measures against software
vulnerabilities are regularly
implemented at the start ofthe operation and during theoperation○ According to characteristics
of information systems, theimplementation of multifactor authentications,monitoring function, backup
and recovery training areevaluated.
○ Enabling the functions todeal with DDoS attacks isimplemented.

（※）the software with critical security functions to control information systems such as
control of terminals and servers, integrated entity authentication management, asset
management, and network monitoring Software vulnerabilities management such as vulnerabilities assessment isstrengthened at the start of operation of servers and terminals.
 With cyber attack in mind, security measures to protect and recover
information systems are implemented.

（monitoring of information systems, the implementation of multi-factor authentications in
the case that advanced entity authentications is required for administrator authority of cloudservice, preparing recovery procedures, appropriate backup, review of backup requirements
and recovery procedures, prepared for information security incidents）

 In consideration of the latest DDoS attacks, the dedicated devices andservice to treat them are implemented and servers, communicationlines are redundant, and formulation of monitoring policy andcollection of threat information are conducted.
 To respond to increasing use of cloud services with the implementation ofzero-trust architecture in mind, continuous assessment and verificationof access to information assets and new technical methods to permit
and deny access according to trust are stipulated.

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

7Point of the Revision③
5. Strengtheningof crossorganizationalsecurity
measures andsecuring
measuresaccording to theimportance ofinformation
systems

Current（2021 Edition）

Point of the Revision○ The result of information
security review is reported
to CISO.（The regularprogress report is notstipulated）

 Regarding cross-organizational improvements identified by audit, CISO
receives progress reports regularly, monitors the progress ofimprovements based on the result of audit and controls the entireorganization.

○ Security measures for
Incorporated Administrative
Agencies are implemented
at their judgement.
○ Security measures for theinformation systems aredefined at judgement ofGovernment Agencies andmay differ in its degree.

 To support information security measures of Incorporated Administrative
Agencies, the required system is prepared for the Government
Agencies. The Incorporated Administrative Agencies seek advices fromthe Government Agencies about the items that require specific expertise.
 The concept of “classification of informationsystem” is introduced. Advanced measures suchas real time log analysis is required for theinformation systems that are more critical thancore business systems in addition to basic measures
for all information systems.

AdvancedMeasure
Basic Measure
LMHSystem Importance

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

8

（Reference）History of Revisions of Government Common Standards GroupThe Basic Act on Cybersecurity （ Act No. 104 of 2014) Based on Article 26 Item 1.2, Standards forcybersecurity for national administrative organizations was formulated. They have been revised every twoyears to steadily evolve the foundation of the required security measures considering trends in cybersecurity.
Establishment of Cybersecurity Strategic Headquarters・National Centerof Incident Readiness and Strategy for Cybersecurity (NISC)（January 2015）2016 Edition (31 August 2016 Cybersecurity Strategic Headquarters Decision）
 Incorporated Administrative Agencies and Designated Corporations were added to the scope in addition to Government Agencies.
 The policy focused on strengthening of information security management was added so that information security measures can be implemented appropriately inIncorporated Administrative Agencies.
 Considering occurrences of information security and trends in cyber-attack, the policy related to advance preparation such as a formulation of CSIRT,
strengthening of protection of information systems assuming Advanced Persistent Threat by malware infection was added.

2018 Edition（25 July 2018 Cybersecurity Strategic Headquarters Decision ） User-oriented measures was added to allow nation to use government services securely through web sites so on.
 The policy related to effective operation of PDCA cycle for the autonomous capacity building of government agencies was prepared.
 The policy that allows the mobile devices with certain security measures to access network to conduct operation was added.

2021 Edition（7 July 2021 Cybersecurity Strategic Headquarters Decision ） Considering the controls standard of ISMAP, the description of the measures and approaches to be implemented by cloud service users were added.
 Considering major cyber attacks, latest information security cases and security measures, the advanced security measures such as CDN and EDR weredescribed.

※１：CDN（Contents Delivery Network）※２：EDR（Endpoint Detection and Response）

 Regarding the information security measures for diverse work styles, a criteria for the measures to be implemented by Government Agencies was clarified.

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

9Thank you for your attention.

Know, Protect and Continue

https://www.nisc.go.jp/

Copyright (c) 2024 National center of Incident readiness and Strategy for Cybersecurity (NISC). All Rights Reserved.

10