Standards for Information Security Measures for theCentral Government Computer Systems(Second Edition)

June 14, 2007

Established by the Information Security Policy Council-1-

Table of Contents
Chapter 1 General ................................................................................................................... 1
1.1.1 Positioning of Standards for Measures........................................................................ 1(1)

Positioning of these Standards for Measures on enhancement of Information

Security Measures for the Central Government Computer Systems ................................ 1(2)

Revising the Standards for Measures ................................................................ 1(3)

Complying with laws and regulations ............................................................... 1

1.1.2 How to use Standards for Measures............................................................................ 2(1)

Relationship of these Standards for Measures and Standards of Government

Agency .................................................................................................................... 2(2)

Scope............................................................................................................ 2(3)

Structure........................................................................................................ 3(4)

Itemized Measures ......................................................................................... 3(5)

Setting Security Levels ................................................................................... 3(6)

Evaluation Procedure...................................................................................... 4

1.1.3 Definition of Terms .................................................................................................. 5
Chapter 2 Building the Organization and System ...................................................................... 10
2.1 Introduction ................................................................................................................. 10
2.1.1 Establishing the Organization and System................................................................. 10
Compliance Requirements ........................................................................................... 10(1)

Designating the chief information security officer............................................ 10(2)

Designating the information security committee .............................................. 10(3)

Designating the chief information security auditors.......................................... 10(4)

Designating the information security officers .................................................. 10(5)

Designating the information system security officers........................................ 11(6)

Designating the information system security administrators .............................. 11(7)

Designating the division/office information security officers............................. 11

2.1.2 Assignment of Roles............................................................................................... 12
Compliance Requirements........................................................................................... 12(1)

Defining the roles that must not be undertaken by the same person.................... 12

2.1.3 Violation and Exceptional Measures......................................................................... 12
Compliance Requirements ........................................................................................... 12(1)

Handling the violations ................................................................................. 12(2)

Exceptional measures ................................................................................... 13

2.2 Operation .................................................................................................................... 15
2.2.1 Education for the Information Security Measures ...................................................... 15
Compliance Requirements ........................................................................................... 15(1)

Educating about the information security measures.......................................... 15(2)

Participating in the educational programs on information security measures ....... 15-2-

2.2.2 Failure Handling .................................................................................................... 16
Compliance Requirements........................................................................................... 16(1)

Advance Preparation for Possible Failure........................................................ 16(2)

Reporting and Taking Emergency Measures on Failures ................................... 16(3)

Cause Investigation and to Prevent the Recurrence of Failure............................ 17

2.3 Evaluation ................................................................................................................... 18
2.3.1 Self-assessment of the Information Security Measures ............................................... 18
Compliance Requirements ........................................................................................... 18(1)

Formulating an annual plan for self-assessment ............................................... 18(2)

Preparing for the self-assessment ................................................................... 18(3)

Conducting the self-assessment...................................................................... 18(4)

Evaluating the result of self-assessment .......................................................... 18(5)

Making improvements based on the self-assessment ........................................ 18

2.3.2 Auditing the Information Security Measures ............................................................. 19
Compliance Requirements ........................................................................................... 19(1)

Formulating the audit plans ........................................................................... 19(2)

Instructing the information security audit........................................................ 19(3)

Formulating the detailed audit plans ............................................................... 19(4)

Requirements for the information security auditor ........................................... 19(5)

Conducting the information security audit....................................................... 19(6)

Reaction based on the results of the information security audit.......................... 20

2.4 Review........................................................................................................................ 21
2.4.1 Reviewing the Information Security Measures .......................................................... 21
Compliance Requirements ........................................................................................... 21(1)

Reviewing the information security measures.................................................. 21

Chapter 3 Measures for Information ........................................................................................ 22
3.1 Information Classification ............................................................................................. 22
3.1.1 Classifying the Information ..................................................................................... 22
Compliance Requirements........................................................................................... 22(1)Classifying the information ........................................................................... 22

3.2 Information Handling ................................................................................................... 23
3.2.1 Creating and Obtaining Information ......................................................................... 23
Compliance Requirements ........................................................................................... 23(1)

Prohibiting creation or obtainment of Information for non-business purposes ..... 23(2)Classifying the information on creation or obtainment and considering marking . 23

(3)

Labeling classification and marking ............................................................... 23(4)

Application of the existing classification and marking...................................... 23(5)

Changing classification and marking .............................................................. 23

3.2.2 Usage of Information.............................................................................................. 23
Compliance Requirements........................................................................................... 24

-3-

(1)

Prohibiting usage for non-business proposes ................................................... 24(2)

Handling the information based on classification and marking .......................... 24(3)

Handling classified information ..................................................................... 24

3.2.3 Maintenance of Information .................................................................................... 24
Compliance Requirements........................................................................................... 24(1)

Maintaining the information based on classification......................................... 24(2)

Information Retention Period......................................................................... 25

3.2.4 Transfer of Information........................................................................................... 25
Compliance Requirements........................................................................................... 25(1)

Gaining approval and notifying of information transfer .................................... 25(2)

Selecting between transmitting and transporting the information ....................... 25(3)

Selecting the transfer means .......................................................................... 26(4)

Protecting the printed information.................................................................. 26(5)

Protecting the electronic records .................................................................... 26

3.2.5 Provision of Information......................................................................................... 27
Compliance Requirements........................................................................................... 27(1)

Releasing the information ............................................................................. 27(2)

Providing the information to others ................................................................ 27

3.2.6 Deleting of Information .......................................................................................... 27
Compliance Requirements........................................................................................... 28(1)

Deleting the electronic records....................................................................... 28(2)

Disposing the written documents ................................................................... 28

Chapter 4 Measures based on Clarifying Information Security Requirements .............................. 29
4.1 Information Security Functions...................................................................................... 29
4.1.1 Authentication Functions ........................................................................................ 29
Compliance Requirements........................................................................................... 29(1)

Introducing the authentication functions ......................................................... 29(2)

Identification code handling .......................................................................... 31(3)

Authentication information handling .............................................................. 31

4.1.2 Access Control Functions........................................................................................ 32
Compliance Requirements........................................................................................... 32(1)

Introducing the access control functions ......................................................... 32(2)

Configuring Access control ........................................................................... 33

4.1.3 Administration Functions ........................................................................................ 33
Compliance Requirements........................................................................................... 33(1)

Introducing the administration functions ......................................................... 33(2)

Granting and managing identification code and authentication information ........ 33(3)

Applying an alternative measure for identification code and authentication

information ............................................................................................................ 34
4.1.4 Audit Trail Management Functions .......................................................................... 35-4-

Compliance Requirements........................................................................................... 35(1)

Introducing the audit trail management functions............................................. 35(2)

Obtaining and keeping the audit trails............................................................. 35(3)

Studying, analyzing, and reporting the obtained audit trails............................... 36(4)

Notifying the users about audit trail management............................................. 36

4.1.5 Assurance Functions............................................................................................... 36
Compliance Requirements........................................................................................... 36(1)

Introducing the assurance functions................................................................ 36

4.1.6 Encryption and Performing Electronic Signatures (including key management)............ 36
Compliance Requirements........................................................................................... 36(1)

Development of systems for encryption and performing electronic signatures..... 36(2)

Introducing the functions for encryption and performing electronic signatures.... 36(3)Management of encryptions and electronic signatures ...................................... 38(4)

Using the encryption function or performing electronic signatures..................... 38

4.2 Threats to Information Security...................................................................................... 40
4.2.1 Security Holes ....................................................................................................... 40
Compliance Requirements........................................................................................... 40(1)

Building the information systems................................................................... 40(2)

Operating the information systems ................................................................. 40

4.2.2 Malware................................................................................................................ 41
Compliance Requirements........................................................................................... 41(1)

Building the information systems................................................................... 41(2)

Operating the information systems ................................................................. 42

4.2.3 Denial of Service Attacks........................................................................................ 42
Compliance Requirements........................................................................................... 42(1)

Building the information systems................................................................... 42(2)

Operating the information systems ................................................................. 43

4.3 Security Requirements of Information Systems ............................................................... 45
4.3.1 Security Requirements of Information Systems ......................................................... 45
Compliance Requirements ........................................................................................... 45(1)

Planning and designing the information systems.............................................. 45(2)

Building, operating, and monitoring the information systems ............................ 45(3)

Moving and disposing of the information systems............................................ 46(4)

Reviewing the information systems ................................................................ 46

Chapter 5 Measures for Components of Information Systems .................................................... 47
5.1 Facilities and Environment ............................................................................................ 47
5.1.1 The secure area where computers and communication equipment are located ............... 47
Compliance Requirements........................................................................................... 47(1)

Managing entry and exit................................................................................ 47(2)

Managing the visitors and delivery personnel .................................................. 47

-5-

(3)

Securing the computers and communication equipment.................................... 48(4)

Managing security in the secure area .............................................................. 49(5)

Measures against disasters and failures ........................................................... 49

5.2 Computers ................................................................................................................... 50
5.2.1 Common Measures for Computers ........................................................................... 50
Compliance Requirements ........................................................................................... 50(1)

Installing the computers ................................................................................ 50(2)Operating the computers ............................................................................... 50(3)

Disposing of the computers ........................................................................... 51

5.2.2 Terminals .............................................................................................................. 51
Compliance Requirements........................................................................................... 51(1)

Installing the terminals.................................................................................. 51(2)

Operating the terminals................................................................................. 52

5.2.3 Server Devices....................................................................................................... 52
Compliance Requirements........................................................................................... 52(1)

Installing the servers..................................................................................... 52(2)

Operating the servers .................................................................................... 53

5.3 Application Software .................................................................................................... 54
5.3.1 Common Measures for Applications provided via Communication Line ...................... 54
Compliance Requirements........................................................................................... 54(1)

Installing the applications.............................................................................. 54(2)

Operating the applications............................................................................. 54

5.3.2 E-mail................................................................................................................... 54
Compliance Requirements........................................................................................... 54(1)

Introducing e-mail service............................................................................. 54(2)

Operating e-mail service ............................................................................... 54

5.3.3 Web ...................................................................................................................... 55
Compliance Requirements........................................................................................... 55(1)

Introducing the Web ..................................................................................... 55(2)

Operating the Web........................................................................................ 55

5.4 Communication Lines................................................................................................... 56
5.4.1 Common Measures for Communication Lines........................................................... 56
Compliance Requirements ........................................................................................... 56(1)

Building communication lines ....................................................................... 56(2)

Operating the communication line.................................................................. 57(3)

Disposing of the communication lines ............................................................ 58

5.4.2 Management of Communication Lines in the Government Facilities ........................... 58
Compliance Requirements........................................................................................... 58(1)

Building the communication lines in the government agencies .......................... 58(2)

Operating the communication line in the government agency............................ 58

-6-

(3)

Measures on the lines.................................................................................... 59

5.4.3 Connecting with Communication lines outside the Government Agency ...................... 60
Compliance Requirements........................................................................................... 60(1)Connecting the communication lines inside the government agency and thecommunication lines outside the government agency .................................................. 60(2)Operating a communication line inside the government agency which is connectedwith a communication line outside the government agency.......................................... 60
Chapter 6 Measures for Individual Consideration ..................................................................... 61
6.1 Information Security Measures for Procurement and Development.................................... 61
6.1.1 Purchasing the equipment, etc. ................................................................................ 61
Scope ........................................................................................................................ 61
Compliance Requirements........................................................................................... 61(1)

Establishing the mechanism to ensure information security in the government

agency ................................................................................................................... 61(2)

Following the procedures for purchasing the equipment, etc. ............................ 61

6.1.2 Outsourcing........................................................................................................... 61
Scope ........................................................................................................................ 62
Compliance Requirements........................................................................................... 62(1)

Establishing the mechanism to ensure information security in the government

agency ................................................................................................................... 62(2)

Establishing the Information Security Measures to be applied to the contractors . 62

(3)

Following the procedure to select the outside contractor ................................... 62(4)

Following the procedure to outsourced work ................................................... 63(5)

Following procedures to terminate the outsourcing .......................................... 64

6.1.3 Software Development ........................................................................................... 64
Compliance Requirements........................................................................................... 64(1)

Establishing the system for software development ........................................... 64(2)

Starting software development....................................................................... 65(3)

Designing the software ................................................................................. 65(4)

Developing the software ............................................................................... 66(5)

Testing the software...................................................................................... 66

6.2 Specific Restrictions ..................................................................................................... 67
6.2.1 Restrictions on Information Processing outside the Government Facility...................... 67
Compliance Requirements........................................................................................... 67(1)

Establishing the Security Measures ................................................................ 67(2)

Gaining approval, notifying, and management................................................. 67(3)

Implementing the Security Measures .............................................................. 68

6.2.2 Restrictions on Information Processing Using Information Systems Not Supplied by theGovernment Agency....................................................................................................... 69
Compliance Requirements........................................................................................... 69

-7-

(1)

Establishing the Security Measures ................................................................ 69(2)

Gaining approval, notifying, and management................................................. 69(3)

Implementing the Security Measures .............................................................. 70

6.3 Miscellaneous .............................................................................................................. 71
6.3.1 Preventing actions that lower the Information Security Level outside the Government
Agency ......................................................................................................................... 71
Compliance Requirements........................................................................................... 71(1)

Establishing the measures ............................................................................. 71(2)

Implementing the measures ........................................................................... 71

6.3.2 Consistent Operation with the Business Continuity Plan (BCP)................................... 71
Scope ........................................................................................................................ 71
Compliance Requirements........................................................................................... 71(1)

Understanding the preparation plan for a BCP in the government ...................... 71(2)

Ensuring consistency between the BCP and the Information Security Measures .. 71(3)

Reporting inconsistency between the BCP and the information security rules ..... 72-8-

Chapter 1 General
1.1.1 Positioning of Standards for Measures(1) Positioning of these Standards for Measures on enhancement of Information Security
Measures for the Central Government Computer Systems
In principle, each government agency must take its own responsibility for measures toensure information security. However, it is necessary to formulate a unified framework toprovide guidance on such measures and raise the level of information security in unison basedon the “Policy for Enhancement of Information Security Measures for the Central
Government Computer Systems (decision by the Information Security Council on Sep 15,
2005)” in order to enhance the information security measures across the board forgovernment agencies. These Standards for Measures will provide the standards for themeasures that each government agency should take to achieve information security and themeasures to further raise the level of information security in the unified framework.
(2) Revising the Standards for Measures
It is important to grasp the changes in circumstances appropriately and review the
information security measures in order to maintain an appropriate level of information
security. It is possible that what and how to add to or revise these Standards for Measures will
be known after each government agency uses these to formulate its own standards ofgovernment agency and operation procedures in view of its characteristics and to evaluate its
information security measures. Also, it is possible that revising information security measuresin these Standards for Measures is required to be made in accordance with development of
information technologies.
With this in mind, these Standards for Measures shall be reviewed periodically and added
to or expanded in order to maintain their applicability in the future. Each government agency
must update its standards of government agency appropriately when these Standards for
Measures are revised.
(3) Complying with laws and regulations
How information and information systems should be handled is also formulated in laws
and regulations (hereinafter referred to as “relevant laws and regulations”). So, besides theseStandards for Measures, such relevant laws and regulations must be conformed to when
information security measures are taken. Because these relevant laws and regulations should
be conformed to regardless of the information security measures formulated, these Standards
for Measures do not specifically mention them. Also, the existing government decisions on
information security measures must be conformed to as well.

-1-1.1.2 How to use Standards for Measures(1) Relationship of these Standards for Measures and Standards of Government Agency

These Standards for Measures provide the standards for the measures that each government
agency should take to achieve information security and the measures to further raise the levelof information security. Each government agency shall review the current information
security rules as needed in order to achieve higher information security than provided for inthese Standards for Measures. Therefore, each government agency must not leave its
standards of government agency unchanged based on these Standards for Measures without
rational reasons. Each government agency must determine what to define in its standards ofgovernment agency in view of its characteristics and update it appropriately by referring tothese Standards for Measures directly, and incorporating the relevant contents of theseStandards for Measures with or without modifications (structure, expressions.)(2) Scope
These Standards for Measures shall be applied as follows:(a) These Standards for Measures are formulated for the purpose of protecting“information.” “Information” in these Standards for Measures means information thatis stored in the information systems, stored in the electronic storage media outside theinformation systems, and written or printed on the documents for information systems.
Unfinished documents are also included within this scope. Information written or
printed on the documents can be electronically recorded information that is describedin the documents (containing information input into the information systems orinformation output from the information systems) and specifications of information
systems.
(b) These Standards for Measures shall be applied to the employees who handle
information and information systems. In these Standards for Measures, “employees”
means government employees and those under a command structure of respective
government agencies who handle information and information systems governed by
the respective government agencies.
(c) In the Standards for Measures, “government agency” means Cabinet Secretariat,
Cabinet Legislation Bureau, National Personnel Authority, Cabinet Office, Imperial
Household Agency, Japan Fair Trade Commission, National Public Safety
Commission (National Police Agency), Financial Services Agency, Ministry ofInternal Affairs and Communications, Ministry of Justice, Ministry of Foreign Affairs,
Ministry of Finance, Ministry of Education, Culture, Sports, Science and Technology,
Ministry of Health, Labor and Welfare, Ministry of Agriculture, Forestry and Fisheries,
Ministry of Economy, Trade and Industry, Ministry of Land, Infrastructure, Transport,
and Ministry of the Environment and Ministry of Defense.

-2-(3) Structure
These Standards for Measures are composed of three levels – chapter, section and item.
These Standards for Measures organize information security measures into the chapters of“Building the Organization and System,” “Measures for Information,” “Measures based on
the Clarified Requirements of Information Security,” “Measures for Components ofInformation Systems,” and ”Measures for Individual Considerations,” and arranges thecontents into sections, then itemizes standards for the measures.
(a) “Building the Organization and System” describes organizational issues such assystem, evaluation procedure, breach, and exceptional measures and also clarifies
operational authority and responsibilities of employees so that the whole organization
can take information security measures.
(b) “Measures for Information” defines compliance requirements at each stage of theinformation lifecycle – creation, use, storage, transfer, provision, and deletion, andalso indicate the measures that employees must always take when they execute theirtasks to protect information.
(c) “Measures based on Clarified Information Security Requirements” explains security
functions such as access control to introduce into the information systems, and also
defines compliance requirements to prevent threats such as security holes, malware,and denial of service attacks in order to describe measures to take for the information
systems.
(d) “Measures for Components of Information Systems” defines compliance requirements
in order to describes measure to take for the information systems in view of theindividual characteristics and lifecycle of information systems such as computers andcommunication lines.
(e) “Measures for Individual Consideration” defines compliance requirements forindividual consideration that need specific attention in terms of information security
such as procurement, development, and information processing outside thegovernment agency.
(4) Itemized Measures
These Standards for Measures set compliance requirements for measures each government
agency should take by individual item.
(5) Setting Security Levels
The information security measures that should be taken depend on the importance of theinformation assets to protect or threats that exist. Also, the measures must be strong enoughfor the characteristics of information systems and tasks. With this in mind, these Standards for
Measures set the strength level for each measure to meet compliance requirements. This levelis called “the level of a measure” and is formulated as follows:(a) “BASIC Requirements”: measures that must be taken for the information to protect-3-and the information systems that handle such information(b) “ENHANCED Requirements”: measures that should be taken for especially important
information and the information systems that handle such information if the respective
government agency considers them required.
By following the above compliance requirements, each government agency shall takemeasures that satisfy or exceed the BASIC Requirements. Each government agency mustevaluate the risks in view of the characteristics of information systems and tasks in order toselect an appropriate level for each compliance requirement.
(6) Evaluation Procedure
It is essential that information security measures are continuously feasible without delay
but not transient. Therefore, each government agency must confirm that the following
requirements are met based on these Standards for Measures by conducting information
security auditing periodically or as need arises.
(a) The standards of government agency conform to these Standards for Measures(confirming compliance in design)(b) Actual operations conform to the standards of government agency (confirming
compliance in operation)(c) The standards of government agency are appropriate and efficient for the risks, or not
unfeasible (confirming the adequacy in design)(d) Actual operations are appropriate and efficient for the risks (confirming the adequacyof operations).
Particularly, the most important purpose of information security auditing at eachgovernment agency is to confirm compliance in design and operation. In the case that any
improvements that it believes necessary in terms of validity of design and operation are foundin the course of the auditing, it is desirable to put it on a list of concerns. In these Standards
for Measures, compliance requirements are formulated along with the person who should
execute the tasks. So, each employee shall conduct a self-assessment of how well themeasures are taken based on his or her role. It is essential for each employee to fulfill his or
her role to implement information security measures and conducting self-assessment helps tooperate with valid measures. To achieve this goal, each government agency shall grasp how
well the measures are implemented by conducting an auditing as to whether the
self-assessment is adequate and how well compliance in operation is achieved.
In principle, each government agency must take responsibility for implementing its own
information security measures. However, in order to promote information security measures
for government agencies across the board, it must report to the National Information Security
Center about how well the measures are implemented and the results of auditing. Then,
National Information Security Center will inspect and evaluate how well the information
security rules for each government agency are formulated and measures are implemented
based on the evaluation metrics related to these Standards for Measures periodically or as-4-needed. The scope of applicable information systems shall be discussed and determined by
the National Information Security Center and each government agency.

1.1.3 Definition of Terms
z
z

z
z

z

z

z
z

z
z
z

z
z
z

“Access control” means to restrict objects to which a subject is allowed to have access.
“Secure area” means the inside of an office or a server room in which computers andcommunication equipment are located, where the measures against information security
violations caused by outside hackers and disasters are implemented physically andenvironmentally.
“Contractor” means a person who undertakes all or a part of the processing tasks on
information systems such as planning, development, maintenance, and operation.
“Delivery personnel” means a person whose purpose is to receive or pass items toemployees working in a secure area and who does not need to enter the secure area. Suchexchanges of items can occur in courier services and delivery of office equipment, etc.
“Outsourcing” means to order all or a part of the processing tasks on information systems
such as planning, development, maintenance, and operation to the personnel outside thegovernment agency.
“Availability” means to have a status in which a person who is allowed to accessinformation can access the information and the related assets without being interrupted
when he or she needs to do so.
“Availability class-1 information” means the information that is not availability class-2
information (except written documents.)“Availability class-2 information” means the information that is handled in the tasks of thegovernment agency (except written documents) and can infringe citizens’ rights or have an
impact (except minor ones) on the stable operation of tasks of the government agency ifdamaged, lost, or made unavailable.
“Integrity” means to have a state in which information is not damaged, altered, or deleted.
“Integrity class-1 information” means the information that is not integrity class-2
information (except written documents.)“Integrity class-2 information” means the information that is handled in the tasks of thegovernment agency (except written documents) and can infringe citizens’ rights or have an
impact (except minor ones) on accurate operation of tasks of the government agency ifaltered, wrongly described, or damaged.
“Equipment, etc.” means information equipment and software.
“Confidentiality” means a state in which only a person who is allowed access can accessthe information.
“Confidentiality class-1 information” means the information that is not confidentiality

-5-

z

z
z

z

z

z

z
z
z
z
z

z

class-2 information or confidentiality class-3 information.
“Confidentiality class-2 information” means the information that is handled in the tasks ofthe government agency and does not require so much confidentiality as confidential
documents but the leakage thereof can infringe citizens’ rights or hinder the operation oftasks of the government agency.
“Confidentiality class-3 information” means the information that is handled in the tasks ofthe government agency and requires as much confidentiality as confidential documents.
“Shared identification code” means an identification code that is shared by multiple
subjects. In principle, a single identification code is granted to a single subject; however, it
can be shared by multiple subjects if there are any restrictions on the information system orin consideration of how they are used. Such an identification code is called a shared
identification code.
“Storage media” means media on which information is recorded or described. Storage
media include paper or other tangible objects which contain information perceptible by thehuman senses through writing, documents and other letters and figures (hereinafter referred
to as “written documents”) and records created through methods imperceptible by thehuman senses, such as through electronic methods, magnetic methods or others, that areprovided for information processing by computers (hereinafter referred to as “electronicstorage media”). Electronic storage media include embedded electronic storage media thatare built in computers and communication equipment and external electronic storage media
such as an external hard disk, CE-R, DVD, MO, USB memory, and flash memory.
“Administration” means to manage the information for authentication (including
identification code and authentication information) and the granting of information for
permission of access control.
“Announced security hole” means a security hole that can be known to everyone andincludes one announced by software or hardware manufacturer and vendors and one
announced by security-related organizations such as the JPCERT Coordination Center.
“Service” means a set of functions that is composed of a single or multiple functions
provided to the connected computer by an application running on a server.
“Least privilege” means a function to limit the spectrum where administrative rights can be
exercised to the minimum extent necessary for the administrative task.
“Identification” means to identify the subject that accesses an information system.
“Identification code” means a code that an information system recognizes to identify the
subject. A User ID is a typical identification code.
“Important specifications” means specifications related to an information system that arenecessary for the appropriate management of the relevant information system and themissing or leakage thereof may hinder the operation of tasks of the government agency.
“Subject” means a person who accesses the information systems or other information
systems and a device. A subject is supposed to be human in principle; however, other

-6-

z

z
z

z
z
z

z

z
z

z
z

information systems and devices can be subjects when multiple information systems anddevices work in coordination.
“Authentication” means to verify whether the subject that presents an identification code islegitimate or the one that is granted the identification code. The information system
recognizes the subject as legitimate if the identification code and authentication
information are presented in a correct way and authentication is successful. Though being“authenticated” means to be proved officially or by a third party, ”authentication” in theseStandards for Measures does not always mean such proof.
“Authentication information” means information that a subject presents to an information
system in order to become authenticated. A password is typical authentication information.
“Authentication information storage device” means a device that stores authentication
information so that a legitimate subject can own or hold it. In the case that anauthentication method based on ownership is used, the information system recognizes the
subject as legitimate if it has this.
A magnetic strip card and IC card are typical authentication information storage devices.
“Standards of government agency” means information security standards that are
applicable to all information assets of the respective government agencies.
“Information system” means a computer system that provides information processing andcommunications.
“Information security rules” means the standards of government agency and the operation
procedures that provide step-by-step instructions on how to execute the measuresformulated in the standards of government agency in specific information systems andtasks.
“Information transfer” means to transmit electronically recorded information and totransport electronic storage media and written documents that contain information outside
the government agency.
“Legal employee” means an employee who is designated to execute administrative tasks byappointment.
“Software” means procedures and orders to operate a computer that are written in a form
that computers can understand. An operating system and applications running on theoperating system can be viewed as software in a broad sense.
“Terminal” means a computer that an employee directly operates (including an operating
system and connected peripheral devices) such as a PC and a PDA.
“Communication line” means a mechanism by which multiple computers are connected tosend or receive information in a prescribed communication protocol. A communication line
which is established by connecting a line and communication equipment is called aphysical communication line, and a communication line which is formulated over thephysical communication line and can exchange information in a prescribed communication
protocol is called a logical communication line.

-7-

z

z
z

z

z
z

z

z

z

z
z

“Communication equipment” means a device that is located to connect the lines and used
to control the information exchanged by computers via a line. Repeater hubs, switchinghubs, routers, and firewalls are included.
“Computers” means computers in general and includes operating systems, servers
including connected peripheral devices, and terminals.
“Marking” is information to indicate restrictions on how to handle the information(meaning measures to secure appropriate handling of information such as “do not copy,”“internal use only,” “do not re-distribute,” “encryption required,” and “destroy after
reading,” etc.)“Multiple factors authentication / composite authentication” is an authentication method inwhich multiple factors of knowledge, ownership, and biological information are used toauthenticate.
“Outside the government agency” means outside the organization or building managed by
the government agency that legal employees belong to.
“Communication line outside the government agency” means a logical communication line
which computers that are not managed by the government agency are connected with and isused for communications between such computers regardless of what physicalcommunication lines (wired/wireless, real/virtual, managed by the government
agency/other organizations) or communication equipment are used.
“Information processing outside the government agency” means doing information
processing required to execute the administrative tasks outside the organization or building
managed by the government agency. This includes offline processing as well as online
processing by connecting from outside the government agency to the information systemsof the government agency that legal employees belong to.
“Information systems not supplied by the government (unsupplied information system)”means the information systems that are not the ones supplied by the government agency
which legal employees belong to. These include private PCs and the information systems
provided to loan employees working in the relevant government agency by the originalorganization.
“Information processing using information systems not supplied by the government” means
doing information processing required to execute the administrative tasks using unsupplied
information systems. This includes not only using the devices directly but also using theservices provided by the devices. A service here means one such as an e-mail service forprivate use. Transferring business e-mail messages required to execute the administrative
tasks to a privately used e-mail service and vice versa are the examples.
“Inside the government agency” means inside the organization or building managed by thegovernment agency which legal employees belong to.
“Communication line inside the government agency” means a logical communication line
which computers that are managed by the government agency are connected with and is

-8-

z
z

z

z

z
z
z
z
z

z
z

used for communications between such computers regardless of what physicalcommunication lines (wired/wireless, real/virtual, managed by the government
agency/other organizations) or communication equipment are used.
“Malware” means software in general which brings a result unwanted for computer users,
such as computer viruses and spyware.
“Malware definition file” means the data which antivirus software, etc. uses to determine
malware.
“Labeling, etc.” means to put information into a state in which all persons who handle it
can have a common understanding of its classification. The classification must be shownfor each item of information in principle. However, this includes any measures to make acommon understanding of classification of the information. For specific information
systems, it is also deemed as labeling, if the rule, etc. clearly states classification of
information stored in the information system and the rule is notified to all persons who use
the information system.
“Mobile PC” means a terminal that is movable as needed for business purposes regardlessof terminal shape. A laptop PC that is used at a specific place is not a mobile PC.
“Vital information” means availability class-2 information.
“Confidential information” means confidentiality class-2 information and confidentiality
class-3 information.
“Classified information” means confidential information, critical information, and vital
information.
“Critical information” means integrity class-2 information.
“Exceptional measures” means that an employee takes alternative measures required inorder to continue executing his or her administrative tasks appropriately, or, if there is arational reason for doing so, reports and obtains permission not to meet compliancerequirements in the case that complying with the relevant information security rules isdifficult.
“Login” means an action in which a subject requests authentication. Because login isfollowed by authentication, validity of the subject is unknown at the login stage.
“Logon” means the status in which the subject that has requested authentication by login isvalidated by the information system.

-9-

Chapter 2 Building the Organization and System
2.1 Introduction
2.1.1 Establishing the Organization and System
Compliance Requirements(1) Designating the chief information security officer[BASIC Requirements](a) A chief information security officer must be designated.
(b) The chief information security officer must direct the tasks for information security
measures in the respective government agency.
(c) The chief information security officer must designate a person who has in-depth
knowledge and specialized experience in information security as the chief information
security advisor as needed.
(2) Designating the information security committee[BASIC Requirements](a) The chief information security officer must establish the information security
committee and designate a chairperson and members of the committee.
(b) The information security committee must formulate the standards of government
agency for information security and gain approval from the chief information security
officer.
(3) Designating the chief information security auditors[BASIC Requirements](a) The chief information security officer must designate the chief information security
auditors.
(b) The chief information security auditors must direct the tasks for the audit under the
direction of the chief information security officer.
(4) Designating the information security officers[BASIC Requirements](a) The chief information security officer must determine the management unit to be used
to implement the information security measures and designate an information security
officer for each unit. The head of information security officers must be designated togive directions to the information security officers.
(b) The information security officer must give directions for the administrative tasks for
information security measures in the unit he or she governs.
(c) The head of the information security officers must develop administrative procedures- 10 -

for employment, job termination, and job transfer that occur in implementing
information security measures.
(d) The information security officer must periodically ensure that administrative
procedures for employment, job termination, and job transfer that occur in
implementing information security measures are followed.
(e) The chief information security officer must report the designating and changing of any
information security officers to the head of information security officers.
(f) The head of information security officers must formulate a network for all information
security officers.
(5) Designating the information system security officers[BASIC Requirements](a) The information security officer must designate information system security officers
for the information systems in the unit he or she manages.
(b) The information system security officer must direct the administrative tasks for
information security measures for the information systems he or she manages.
(c) The information security officer must report the designating and changing of any
information system security officers to the head of information security officers.
(d) The head of information security officers must formulate a network for all information
system security officers.
(6) Designating the information system security administrators[BASIC Requirements](a) The information system security officer must designate an information system security
administrator for each unit required for the administrative tasks for the information
system he or she manages.
(b) The information system security administrator must implement information security
measures for the administrative tasks he or she manages.
(c) The information system security officer must report the designating and changing of
any information system security administrators to the head of information security
officers.
(d) The head of information security officers must formulate a network for all information
system security administrators.
(7) Designating the division/office information security officers[BASIC Requirements](a) The information security officer must designate a division/office information
security officer for each division/office.

(b) The division/office information security officer must direct the administrative tasks for
information security measures in the division/office he or she manages.

- 11 -

(c) The information security officer must report the designating and changing of any
division/office information security officers to the head of information security
officers.
(d) The head of information security officers must formulate a network for all
division/office information security officers.

2.1.2 Assignment of Roles
Compliance Requirements(1) Defining the roles that must not be undertaken by the same person[BASIC Requirements](a) In the context of the implementation of information security measures, the following
roles must not be undertaken by the same employee.
(i) The applicant for approval or permission and the approval or permission authority(hereinafter referred to as “approval authority, etc.”)(ii) The auditee and the auditor(2) Approval or permission by supervisors[BASIC Requirements](a) The employee must apply for approval with the supervisor of the approval authority, etc.
when it is found inappropriate for the relevant approval authority, etc. to make a decisionof approval or permission (hereinafter referred to as “approval, etc.”) in the light of theirofficial authority. In this case, when approval is obtained from the supervisor of theapproval authority, etc., it is not required to obtain approval from the approval authority,etc.
(b) In the case that the employee is granted approval, etc. in the preceding case, he or she musttake necessary measures in accordance with requirements for approval authority, etc.

2.1.3 Violation and Exceptional Measures
Compliance Requirements(1) Handling the violations[BASIC Requirements](a) The employee must report to the information security officer who is responsible for the
information security rules in the case of finding any serious breach of them.
(b) The information security officer must instruct the violator or the pertinent persons to takenecessary measures to maintain information security in the case of being informed of or
finding any serious breach of the information security rules.

- 12 -

(c) The information security officer must report to the chief information security officer inthe case of being informed of or finding any serious breach of the information security
rules.
(2) Exceptional measures[BASIC Requirements](a) The information security committee must designate the person who judges whether therequest for applying any exceptional measures should be allowed or denied (hereinafterreferred to as “the judge”) and define the judgment procedure.
(b) The employee must request for the approval for exceptional measures to the judge byfollowing the formulated procedures. However, the employee can make this request after
the fact promptly in the case that the exceptional measure is immediately needed forexecuting his or her tasks and the immediate taking of alternative measures that are notprovided for in the information security rules or the violation of the rules are unavoidable.
The employee must clarify information including the following:(i) Requester information (name, department, contact)(ii) Portion of information security rules which the exceptional measure is requestedfor (the title of rule and article, etc.)(iii) Period for applying the exceptional measure(iv) Description of the exceptional measure (an alternative measure, etc.)(v) Reporting procedure for terminating the exceptional measure(vi) Reason for requesting the exceptional measure(c) The judge must review the request for applying an exceptional measure made by theemployee in accordance with the formulated judgment procedure and approve ordisapprove the request. Also, when the judge makes a decision, he or she must formulatea request process record including the following information and present it to the chief
information security officer.
(i) Name of the judge (name, title, department, contact)(ii) Request information••

Requester information (name, department, contact)
Portion of information security rules which the exceptional measure isrequested for (the title of rule and article, etc.)• Period for applying the exceptional measure• Description of the exceptional measure (an alternative measure, etc.)• Reporting procedure for terminating the exceptional measure• Reason for requesting the exceptional measure(iii) Result•••

Approved or disapproved
Reason for approval or disapprovalPortion of information security rules which the exceptional measure is- 13 -

approved for• Period of the approved exceptional measure• Description of the exceptional measure (an alternative measure, etc.)• Reporting procedure for terminating the exceptional measure(d) The employee must report to the judge who is responsible for the exceptional measure
when he or she terminates the approved exceptional measure. However, this reporting is
not required if the judge decides so.
(e) The judge must check whether the requestor has reported terminating the approved
exceptional measure on its expiration and instruct the requestor to report it, and takenecessary measures. However, this reporting is not required if the judge decides so.
(f) The chief information security officer must formulate the ledger of request process
records for exceptional measures and provide this to the head of information security
auditors on their request for reference purposes.

- 14 -

2.2 Operation
2.2.1 Education for the Information Security Measures
Compliance Requirements(1) Educating about the information security measures[BASIC Requirements](a) The head of information security officers must educate the employees about
information security rules.
(b) The head of information security officers must examine educational contents on
information security rules for the employees and formulate educational materials.
(c) The head of information security officers must plan and develop the plan to educate on
the information security measures and organize its implementation system so that theemployees can participate in at least one education program per year.
(d) The head of information security officers must plan and develop the contents andsystem for education on the information security measures and organize theimplementation system so that any employee who starts working or transfers toanother department can participate in an educational program at their new workplace
within three months.
(e) The head of information security officers must establish the system to manage theachievement of participation of the employees on information security measures.
(f) The head of information security officers must inform the division/office information
security officer of the achievement of participation of each employee on information
security measures.
(g) The division/office information security officer must advise the employee who has notparticipated in any educational program for information security measures. In the casethat the employee does not take his or her advice, the division/office information
security officer must report this to the head of information security officers.
(h) The head of information security officers must report the achievement of participationof each employee on information security measures to the chief information security
officer and the information security committee once a year.
[ENHANCED Requirements](i) The head of information security officers must plan the contents for training on theinformation security measures for the employees, and organize the system regarding
the information security rules.
(2) Participating in the educational programs on information security measures[BASIC Requirements](a) The employee must participate in at least one educational program per year on
information security measures in accordance with the plan to educate on the- 15 -

information security measures.
(b) The employee must ask the division/office information security officer how they canparticipate in an educational program on information security measures at his or her
new workplace when they start working or transfer to another department.
(c) The employee must report the reason to the head of information security officers
through the division/office information security officer in the case that he or shecannot participate in an educational program on information security measures for any
reason that he or she is not responsible for.
[ENHANCED Requirements](d) The employee must participate in a training program on information security measures
if participating in such a training program is formulated in the policy.

2.2.2 Failure Handling
Compliance Requirements(1) Advance Preparation for Possible Failure[BASIC Requirements](a) The chief information security officer must establish the system to prevent the damage
from increasing and recover from the failure (including incidents and failures. This ishereinafter referred to as “failure”) in the case of any failures that can breach
information security.
(b) The head of information security officers must establish the failure report procedurethat the employee uses to report to the information security officer and notify theprocedure to all the employees.
(c) The head of information security officers must establish the failure handlingprocedure.
(d) For the information systems that are considered especially important for the tasks, thehead of information security officers must prepare the emergency network withinformation including emergency contacts and means of communication for the
responsible information system security officer and the responsible information systemsecurity administrator, and message contents.
[ENHANCED Requirements](e) The head of information security officers must establish a point of contact to receive
information about failure from outside the government agency and announce theaccess to the contact to parties outside the government agency.
(2) Reporting and Taking Emergency Measures on Failures[BASIC Requirements](a) In the case that the employee comes to know that any failure has occurred, he or she- 16 -

must notify the relevant party and report to the information security officer inaccordance with the reporting procedure formulated by the head of information
security officers.
(b) The employee must confirm whether the failure handling procedure exists and follow
the procedure if possible.
(c) In the case that any failure has occurred and no relevant failure handling procedure
exists or it is unknown whether such a procedure exists, the employee must try to
prevent the damage from increasing until they are instructed how to handle it. The
employee must follow instructions when he or she receives any.
(3) Cause Investigation and to Prevent the Recurrence of Failure[BASIC Requirements](a) In the case that any failure has occurred, the information security officer must
investigate the cause of failure and prevent the recurrence, then report to the chief
information security officer in writing.
(b) In the case that the chief information security officer receives a report of any failurefrom the information security officers, he or she must examine the failure report andtake necessary measures to prevent a recurrence.

- 17 -

2.3 Evaluation
2.3.1 Self-assessment of the Information Security Measures
Compliance Requirements(1) Formulating an annual plan for self-assessment[BASIC Requirements](a) The head of information security officers must formulate an annual plan for
self-assessment and obtain approval from the chief information security officer.
(2) Preparing for the self-assessment[BASIC Requirements](a) The information security officer must establish the self-assessment form andprocedure for each employee.
(3) Conducting the self-assessment[BASIC Requirements](a) The information security officer must instruct the employees to conduct
self-assessment in accordance with the annual self-assessment plan formulated by thehead of information security officers.
(b) The employee must conduct self-assessment using the self-assessment form andprocedure instructed by the information security officer.
(4) Evaluating the result of self-assessment[BASIC Requirements](a) The information security officer must confirm that the employees have conducted
self-assessment and evaluate the results.
(b) The head of information security officers must confirm that the information security
officer has conducted self-assessment and evaluate the results.
(c) The head of information security officers must report the result of self-assessment tothe chief information security officer.
(5) Making improvements based on the self-assessment[BASIC Requirements](a) The employee must make any improvements that he or she believes possible within
the scope of his or her authority based on the results of self-assessment, then report
this to the information security officer.
(b) The chief information security officer must evaluate the results of self-assessment as awhole, and instruct the information security officers to make improvements as needed.

- 18 -

2.3.2 Auditing the Information Security Measures
Compliance Requirements(1) Formulating the audit plans[BASIC Requirements](a) The head of information security auditors must formulate the annual plan for
information security audit and gain approval from the chief information security
officer.
(2) Instructing the information security audit[BASIC Requirements](a) The chief information security officer must instruct the head of information security
auditors to conduct an audit in accordance with the annual plan for information
security audit.
(b) The chief information security officer must instruct the head of information security
auditors to conduct audits that are not defined in the annual plan for information
security audit as needed to respond to changes in information security conditions.
(3) Formulating the detailed audit plans[BASIC Requirements](a) The head of information security auditors must formulate the individual audit plans inorder to conduct audits in accordance with the annual plan for information security
audit and the instructions for auditing to respond the changes in information security
conditions.
(4) Preparation for the information security audit[BASIC Requirements](a) The head of information security auditors must select and appoint a person necessary
for the audit work as an information security auditor from among those who are
independent from the auditee.
(b) The head of information security auditors must partly outsource the audit work to a
supplier outside the government agency as needed.
(5) Conducting the information security audit[BASIC Requirements](a) The information security auditor must conduct audits under the directions of the headof information security auditors based on the audit plan.
(b) The information security auditor must confirm that the standards of government
agency comply with these Standards for Measures.

- 19 -

(c) The information security auditor must confirm that the procedure complies with thestandards of government agency.
(d) The information security auditor must confirm that the actual operations by the auditee
are in compliance with the information security rules by confirming the adequacy ofself-assessment, etc.
(e) The information security auditor must document audit working papers.
(f) The head of information security auditors must formulate the audit report based on theaudit working papers and submit it to the chief information security officer.
(6) Reaction based on the results of the information security audit[BASIC Requirements](a) The chief information security officer must instruct the information security officer in
the auditee workplace to react to any problems indicated in the audit report.
(b) The chief information security officer must instruct the information security officers inother departments to investigate whether similar problems exist and to solve them if
any if he or she believes that it is highly likely that the departments other than theauditee one pose similar challenges or problems and quick investigation is required
based on the audit report.
(c) The information security officer must develop the improvement plan for the problems
for which resolution is requested by the chief information security officer based on theaudit report, etc., and report it to the chief information security officer.
(d) The chief information security officer must evaluate the validity of existing
information security rules and order a review as needed based on the results of theaudit.

- 20 -

2.4 Review
2.4.1 Reviewing the Information Security Measures
Compliance Requirements(1) Reviewing the information security measures[BASIC Requirements](a) The person who established the information security rules must consider whether
reviewing the rules is required as need arises and if it is required, then he or she must
review them.
(b) In the case that the employee finds any issues or problems in the information security
rules, he or she must consult with the person who established them.
(c) The person who establishes the information security rules must take necessary
measures when he or she is consulted with regard to any issues or problems regarding
the rules.

- 21 -

Chapter 3 Measures for Information
3.1 Information Classification
3.1.1 Classifying the Information
Compliance Requirements(1) Classifying the information[BASIC Requirements](a) The information security committee must establish the standards for designating andlabeling classification and marking in terms of confidentiality, integrity, andavailability of electronic records and confidentiality of written documents for the
information used in the tasks.

- 22 -

3.2 Information Handling
3.2.1 Creating and Obtaining Information
Compliance Requirements(1) Prohibiting creation or obtainment of Information for non-business purposes[BASIC Requirements](a) The employee must not create or obtain any information for the purpose other than
executing his or her governmental business(2) Classifying the information on creation or obtainment and considering marking[BASIC Requirements](a) In the case that the employee creates information, he or she must classify it based on
its confidentiality, integrity, and availability and consider whether marking is required.
(b) In the case that the employee obtains and starts to manage the information created by
the person outside the government agency, he or she must classify it based on its
confidentiality, integrity, and availability and consider whether marking is required.
(3) Labeling classification and marking[BASIC Requirements](a) The employee must label the classification of information in a way that can beunderstood by the person who is allowed to view it and also label the marking as
needed.
(4) Application of the existing classification and marking[BASIC Requirements](a) The employee must apply the existing classification and marking in the case that he or
she quotes any existing information in the new information.
(5) Changing classification and marking[BASIC Requirements](a) In the case that the employee thinks that any information requires re-classification, heor she must consult the person who created or obtained it. If it is required, then the
consulted person must re-classify the relevant information appropriately.
(b) In the case that the employee thinks that any information requires review of marking,he or she must consult the person who created or obtained it. If it is required, then the
consulted person must re-mark the relevant information appropriately.

3.2.2 Usage of Information- 23 -

Compliance Requirements(1) Prohibiting usage for non-business proposes[BASIC Requirements](a) The employee must not use any information for a purpose other than executing his or
her tasks.
(2) Handling the information based on classification and marking[BASIC Requirements](a) The employee must handle information appropriately in accordance with theclassification labeled on the information. In the case that marking is also labeledbeside the classification, the instructions for marking must be followed.
(3) Handling classified information[BASIC Requirements](a) The employee must not take classified information outside the government agency forthe purpose other than executing his or her tasks.
(b) The employee must not leave classified information unattended.
(c) The employee must not make copies of confidentiality class-3 information more thannecessary.
(d) The employee must not distribute confidential information more than necessary.
[ENHANCED Requirements](e) For confidentiality class-3 information, the employee must clearly indicate the period
during which it should be treated as confidentiality class-3 information. Even during
this period, in the case that the employee thinks changing it to a lower classification isrequired, he or she must take the steps required for re-classification.
(f) The employee must give a serial number on the written document in which
confidentiality class-3 information is printed and clarify where it is kept.

3.2.3 Maintenance of Information
Compliance Requirements(1) Maintaining the information based on classification[BASIC Requirements](a) The employee must provide appropriate access control on classified information stored
in the electronic storage media.
(b) The employee must manage the electronic storage media appropriately in accordancewith the classification of the information stored.
(c) For written documents containing information that is input into or output from the- 24 -

(d)

(e)

(f)

(g)

information systems, the employee must manage the written document containing
confidential information or important specifications.
The employee must consider whether encryption is required in the case that he or she
stores confidential information in the electronic storage media and if it is required,
then he or she must encrypt it.
The employee must consider whether performing an electronic signature is required in
the case that he or she stores critical information in the electronic storage media and if
it is required, then he or she must perform an electronic signature.
For electronic records or important specifications which are critical information orvital information, the employee must consider whether making a back-up or copy isrequired and if it is required, then he or she must make a back-up or copy of them.
For back-ups or copies of electronic records or important specifications which are
critical information or vital information, the employee must consider whether
contingency planning is required and if so, then he or she must take appropriate
measures to prevent all sites from being impacted by a disaster.

(2) Information Retention Period[BASIC Requirements](a) The employee must keep the information stored in the electronic storage media until
the retention period expires in the case that such a period is set and delete it without
delay in the case that the period does not require extension.

3.2.4 Transfer of Information
Compliance Requirements(1) Gaining approval and notifying of information transfer[BASIC Requirements](a) The employee must gain approval from the division/office information security officer
in the case that he or she transfers confidentiality class-3 information, integrity class-2
information, availability class-2 information, or important specifications.
(b) The employee must notify the division/office information security officer in the casethat he or she transfers electronic records of confidentiality class-2 information andintegrity class-1 information as well as availability class-1 information or written
documents including confidentiality class-2 information. However, this notification is
not required for information transfer for which the division/office information security
officer decides it unnecessary.
(2) Selecting between transmitting and transporting the information[BASIC Requirements]- 25 -

(a) The employee must select to transmit or transport electronic records of confidential
information in consideration of safety and notify the division/office information
security officer. However, this notification is not required for transfer of electronic
records of confidentiality class-2 information and integrity class-1 information as well
as availability class-1 information, for which the division/office information security
officer decides it unnecessary.
(3) Selecting the transfer means[BASIC Requirements](a) The employee must select the means to transfer confidential information or important
specifications in consideration of safety and notify the division/office information
security officer. However, this notification is not required for transfer of electronic
records of confidentiality class-2 information and integrity class-1 information as well
as availability class-1 information or written documents including confidentiality
class-2 information, for which the division/office information security officer decides
it unnecessary.
(4) Protecting the printed information[BASIC Requirements](a) In the case that the employee transports a written document including confidential
information or important specifications, he or she must take appropriate security
measures in accordance with the classification of information, etc.
(5) Protecting the electronic records[BASIC Requirements](a) In the case that the employee transfers electronic records of confidential information,
he or she must consider whether protection by password is required and if it isrequired, then he or she must set a password for it.
(b) In the case that the employee transfers electronic records of confidential information,
he or she must consider whether encrypting the information is required and if it isrequired, then he or she must encrypt it.
(c) In the case that the employee transfers electronic records of confidential information,
he or she must consider whether performing an electronic signature is required and if it
is required, then he or she must perform an electronic signature to the information.
(d) In the case that the employee transfers electronic records of confidential information,
he or she must consider whether back-ups are required and if they are required, then heor she must make a back-up of the information.
(e) In the case that the employee transfers electronic records of vital information, he or
she must consider whether any measures are required such as transferring the same
electronic records on different routes so as to prepare for a possible hindrance due to- 26 -

lost or missing data or delays in transfer to the destination. If it is required, then he or
she must take necessary measures.
[ENHANCED Requirements](f) In the case that the employee transfers electronic records of confidential information,
he or she must encrypt it in a way to provide the encryption strength required, split itinto pieces, and transfer it using different routes.

3.2.5 Provision of Information
Compliance Requirements(1) Releasing the information[BASIC Requirements](a) The employee must confirm that the information is classified into confidentiality
class-1 information when he or she releases the information.
(b) The employee must take measures to prevent the inadvertent leak of information fromadded pieces, etc. when he or she releases electronic records.
(2) Providing the information to others[BASIC Requirements](a) In the case that the employee provides confidentiality class-3 information, integrity
class-2 information, availability class-2 information, or important specifications to theperson outside the government agency, he or she must gain approval from thedivision/office information security officer.
(b) In the case that the employee provides electronic records of confidentiality class-2
information and integrity class-1 information as well as availability class-1
information or written documents including confidentiality class-2 information to theperson outside the government agency, he or she must notify the division/office
information security officer. However, this notification is not required for information
provision for which the division/office information security officer decides it
unnecessary.
(c) In the case that the employee provides classified information or important
specifications to the person outside the government agency, he or she must takemeasures to make sure that, on the part of that person, the relevant classified
information is treated based on classification thereof.
(d) In the case that the employee provides electronic records, he or she must takemeasures to prevent inadvertent leak of information from added pieces, etc.

3.2.6 Deleting of Information- 27 -

Compliance Requirements(1) Deleting the electronic records[BASIC Requirements](a) In the case that the employee disposes of electronic storage media, he or she must
make all the information difficult to restore (hereinafter referred to as to “delete”).
(b) In the case that the employee provides the electronic storage media to others, he or she
must delete unnecessary confidential information stored in the electronic storage
media.
[ENHANCED Requirements](c) The employee must delete the confidential information stored in the electronic storage
media in the case that he or she is required to do so considering the environment, etc.
(2) Disposing the written documents[BASIC Requirements](a) The employee must dispose the written document containing confidential information
in a way to make it difficult to restore.

- 28 -

Chapter 4 Measures based on Clarifying Information Security
Requirements
4.1 Information Security Functions
4.1.1 Authentication Functions
Compliance Requirements(1) Introducing the authentication functions[BASIC Requirements](a) The information system security officer must consider whether authentication isrequired for every information system. He or she must determine that an information
system that handles classified information requires authentication.
(b) The information system security officer must provide functions for identification andauthentication for the information systems for which authentication is required.
(c) In the case that authentication information must be kept secret, the information systemsecurity administrator must manage to keep the authentication information unknown toothers for the information systems for which authentication is required.
(i) The authentication information must be encrypted in the case that it is stored.
(ii) The authentication information must be encrypted in the case that it iscommunicated.
(iii) If the authentication information cannot be encrypted in the case that it is stored orcommunicated, the user must be notified that it is not encrypted when he or she
sets, changes, or provides (enters) authentication information.
(d) For the information systems for which authentication is required, the information
system security officer must establish a function to prompt users to change
authentication information periodically in the case that he or she requires such changes
to users along with either of the following functions:(i) A function to check whether the users change the authentication information
periodically(ii) A function to refuse continued use of the information system in the case that theusers do not change the authentication information periodically(e) For the information systems for which authentication is required, the information
system security officer must establish a function to stop authentication using therelevant authentication information or authentication information storage device or tostop use of information systems using a corresponding identification code in the casethat he or she recognizes that the authentication information or authentication
information storage device is used or can be used by another party.
(f) For the information systems for which authentication is required, the information
system security officer must establish the following functions in the case that he or she- 29 -

uses authentication method by knowledge:(i)
A function to let the users set their own authentication information(ii) A function to keep the authentication information set by the users in a state inwhich other parties cannot know it easily(g) For the information systems for which authentication is required, the information
system security officer must meet all the applicable requirements in the case that he or
she uses an authentication method other than that based on knowledge, ownership, or
biological information, after examining whether the following are applicable or not in
defining the requirements.
(i) Any subject other than the legitimate subject must not be accepted (prevention ofincorrect permission).
(ii) The legitimate subject must not be denied for any reasons for which it is not
responsible (prevention of false denial).
(iii) The legitimate subject must not be able to grant (including issuance, renewal, andchange; hereinafter the same in this section) or lend its authentication information
to other parties easily (prevention of substitution).
(iv) The authentication information must not be easily duplicated (prevention of
duplication).
(v) There must be means to invalidate logons individually at the discretion of theinformation system security administrator (assurance of invalidation).
(vi) The authentication must be available whenever necessary, without any
interruption (assurance of availability).
(vii) In the case that any information or device needs to be provided from outside to
add new subjects, such information or devices can be sufficiently provided during
the life of the information system (assurance of continuity).
(viii)The authentication information must be able to re-issued to the legitimate subject
in a secure manner if the authentication information granted to it cannot be used(assurance of re-issuance).
(h) The information system security officer must not use the relevant biologicalinformation for the purpose other than that agreed by the user in advance if he or she
uses authentication method based on biological information. Also, he or she must be
careful not to invade the privacy of the user in using the relevant biologicalinformation.
[ENHANCED Requirements](i) For the information systems for which authentication is required, the information
system security officer must establish a function to perform multiple factors
authentication method.
(j) For the information systems for which authentication is required, the information
system security officer must establish a function to notify the information for the last
logon to the user who has logged on.

- 30 -

(k) For the information systems for which authentication is required, the information
system security officer must establish a function to detect or prevent any attempts at
illegitimate logon.
(l) For the information systems for which authentication is required, the information
system security officer must establish a function to display a notification about the useof the information system before the user login to the information system.
(m) For the information systems for which authentication is required, the information
system security officer must establish a function to prevent the users from re-using thesame authentication information as that previously used in the case that he or she
requires periodic changes in authentication information.
(n) For the information systems for which authentication is required, the information
system security officer must establish a function to require that the users logon using
an individual identification code before they login using the identification code in thecase that the identification code with administrative rights is shared.
(2) Identification code handling[BASIC Requirements](a) The employee must not use the information system using an identification code otherthan the identification code granted to him or her.
(b) The employee must not grant or lend the identification code granted to him or her toany other parties.
(c) The employee must not leave the identification code that has been granted to him or
her in a state in which it can be known by the parties who do not need to know it.
(d) The employee must notify the information system security administrator in the casethat he or she does not need to use the identification code any longer. However, thisreporting is not always required if the information system security officer has statedthat individual reporting is not required.
[ENHANCED Requirements](e) The employee who is granted an identification code with administrative rights must
use it only when he or she executes the tasks as an administrator.
(3) Authentication information handling[BASIC Requirements](a) In the case that authentication information is used or can be used by others, theemployee must report this to the information system security officer or the information
system security administrator immediately.
(b) In the case that the information system security officer or the information systemsecurity administrator receives a report that authentication information has been used
or can be used by others, he or she must take necessary measures.
(c) In the case that the employee uses authentication method based on knowledge, he or- 31 -

she must meet the following items(i) The employee must keep his or her authentication information unknown to othersin handling.
(ii) The employee must not tell what his or her authentication information is.
(iii) The employee must try to remember his or her authentication information.
(iv) The employee must select authentication information that cannot be easily
guessed when he or she set it.
(v) In the case that the employee is instructed to change authentication information
periodically by the information system security administrator, he or she must doso.
(d) In the case that the employee uses authentication method based on ownership, he or
she must meet the following requirements:(i) The employee must take security measures so that the authentication information
storage device is not used in an unintended manner.
(ii) The employee must not grant or lend his or her authentication information storage
device to others.
(iii) The employee must manage not to lose the authentication information storage
device. In the case that it is lost, he or she must report this to the information
system security officer or the information system security administrator.
(iv) In the case that the employee does not need to use the authentication information
storage device any longer, he or she must return this to the information systemsecurity officer or the information system security administrator.

4.1.2 Access Control Functions
Compliance Requirements(1) Introducing the access control functions[BASIC Requirements](a) The information system security officer must consider whether access control isrequired for every information system. He or she must determine that an information
system that handles classified information requires access control.
(b) For the information systems for which access control is required, the information
system security officer must establish a function to provide access control.
[ENHANCED Requirements](c) For the information systems for which access control is required, the information
system security officer must add a function to provide access control based on theattributes other than those of the user and the group the user belongs to.
(d) For the information systems for which access control is required, the information
system security officer must establish a function to Mandatory Access Control (MAC).

- 32 -

(2) Configuring Access control[BASIC Requirements](a) The employee must configure necessary access control using the functions installed on
the information system in accordance with the classification and marking of theinformation stored in the information system.

4.1.3 Administration Functions
Compliance Requirements(1) Introducing the administration functions[BASIC Requirements](a) The information system security officer must consider whether administration isrequired for every information system. He or she must decide that an information
system that handles classified information requires administration.
(b) For the information systems for which administration is required, the information
system security officer must establish a function to provide this administration.
[ENHANCED Requirements](c) For the information systems for which administration is required, the information
system security officer must establish a function of the least privilege.
(d) For the information systems for which administration is required, the information
system security officer must establish a function to re-issue authentication information
automatically.
(e) For the information systems for which administration is required, the information
system security officer must establish a dual locking function.
(2) Granting and managing identification code and authentication information[BASIC Requirements](a) For the information systems for which administration is required, the information
system security officer must decide to approve or disapprove the use of the shared
identification code for each information system.
(b) For the information systems for which administration is required, the information
system security officer must clearly establish the procedures for administration
including the following:(i) The procedure to validate that the applicant is the legitimate subject if a subject
makes a request for administration(ii) The initial distribution procedure and the change manager procedure ofauthentication information(iii) The setting procedure and the change control procedure for access control- 33 -

information(c) For the information systems for which administration is required, the information
system security officer must designate a person who is responsible for theadministration.
(d) The person doing administration must issue identification codes and authentication
information only to the subject that has gained approval of using the information
system.
(e) In the case that the person doing administration issues an identification code, he or she
must notify the users whether the code is shared or not.
(f) The person doing administration must grant (including issuance, renewal, and change;
hereinafter the same in this section) the identification code with administrative rights
only in the case that such identification code is required to execute the business orbusiness responsibilities.
(g) The person doing administration must invalidate the identification code of an
employee in the case that the employee does not need to use it any longer. Also, he or
she must check whether unnecessary identification codes exist in the case that he or
she adds or deletes an identification code due to personnel changes, etc.
(h) The person doing administration must have the employee return the authentication
information storage device provided when the employee does not need to use it any
longer.
(i) The person doing administration must configure access control only within theminimum necessary scope considering the business responsibilities and needs. Also,
he or she must check whether inappropriate access control settings exist in the casethat he or she adds or deletes an identification code due to personnel changes, etc.
[ENHANCED Requirements](j) The person doing administration must grant a single identification code to an
employee for a single information system.
(k) The person doing administration must keep a record of which subject the identification
codes have been granted to. In the case that the person doing administration destroys
the record, he or she must gain approval from the information security officer inadvance.
(l) The person doing administration must not grant an identification code that has alreadybeen granted to one subject to any other subjects.
(3) Applying alternative measures for identification code and authentication information[BASIC Requirements](a) For the information systems for which administration is required, in the case that the
information system security administrator receives a request for approval of using analternative measure because the employee cannot use the identification code, he or she
must confirm that the applicant is a legitimate user and consider whether the- 34 -

alternative measure is required, and if it is required, then he or she must provide it.
(b) For the information systems for which administration is required, in the case that the
information system security officer or the information system security administrator
receives a report of unauthorized use of an identification code, he or she must
invalidate the system use with the identification code.

4.1.4 Audit Trail Management Functions
Compliance Requirements(1) Introducing the audit trail management functions[BASIC Requirements](a) The information system security officer must consider whether audit trails are required foreach information system.
(b) For the information systems for which audit trails are required, the information systemsecurity officer must establish a function to collect the audit trails.
(c) For the information systems for which audit trails are required, the information systemsecurity officer must define information items for each event in order to collect theaudit trails and the retention period of the audit trails.
(d) For the information systems for which audit trails are required, the information systemsecurity officer must define a strategy to deal with the case where the audit trails
cannot be obtained or may be unobtainable and establish a function to handle thesituation for the information system as needed.
(e) For the information systems for which audit trails are required, the information systemsecurity officer must provide access control to prevent the obtained audit trails frombeing deleted, falsified, or accessed illegally.
[ENHANCED Requirements](f) For the information systems for which audit trails are required, the information systemsecurity officer must establish a function to aid automatic checking, analyzing, andreporting of the audit trails for the information system.
(g) The information system security officer must establish a function on the information
system to notify any events that indicate possible information security infringement to
the monitoring personnel, etc. immediately if such events are found in the obtained
audit trails.
(2) Obtaining and keeping the audit trails[BASIC Requirements](a) For the information systems for which audit trails are required, the information systemsecurity administrator must record the audit trails using the function established for the
information system by the information system security officer.

- 35 -

(b) For the information systems for which audit trails are required, the information systemsecurity administrator must define the period for which the obtained audit trails are
kept and keep it until the period expires, and delete it without delay in the case that theperiod does not require extension.
(c) For the information systems for which audit trails are required, the information systemsecurity administrator must deal with the situation basaed on the defined coping
strategy in the case that the audit trails cannot be obtained or may be unobtainable.
(3) Studying, analyzing, and reporting the obtained audit trails[ENHANCED Requirements](a) For the information systems for which audit trails are required, the information
security officer or the information system security officer must study and analyze theobtained audit trails periodically or as need arises, then take necessary information
security measures or report to the head of information security officers or the
information security officer.
(4) Notifying the users about audit trail management[BASIC Requirements](a) For the information systems for which audit trails are required, the information security
officer or the information system security officer must explain that the audit trails can beobtained, maintained, checked, and analyzed to the information system security
administrator and the users in advance.

4.1.5 Assurance Functions
Compliance Requirements(1) Introducing the assurance functions[BASIC Requirements](a) The information system security officer must consider whether the assurance measures
are required for the information systems that handle classified information.
(b) For the information systems for which assurance measures are required, theinformation system security officer must establish the assurance functions.

4.1.6 Encryption
management)

andPerforming

Electronic

Signatures(including

Compliance Requirements(1) Development of systems for encryption and performing electronic signatures- 36 -

key

[BASIC Requirements](a) The head of information security officers must define the algorithm andimplementation system for encryption and performing electronic signatures atgovernment agencies.
(b) In the case that the head of information security officers selects an algorithm, he or she
must examine required security and reliability and select an algorithm contained in theencryption list recommended by e-government if possible. When he or she newly
introduces (including renews) an algorithm for encryption and performing electronic
signatures, it is required to select one from the recommended list. In the case that it ispossible to select multiple algorithms, it is required to select at least one algorithm
from the recommended list.
(c) For the key to use to decrypt the encrypted information (excluding written documents;
hereinafter the same) or perform an electronic signature, the head of information
security officers must define production procedures, the expiration date, disposal
procedures, and renewal procedures of the key, and procedures to deal with the
problem in the case that the key is exposed (hereinafter referred to as “management
procedures, etc. of the key”).
(d) For the key to use to decrypt the encrypted information or perform an electronic
signature, the head of information security officers must define the retention method
and retention place (hereinafter referred to as “retention method, etc. of the key”).
[ENHANCED Requirements](e) The head of information security officers must define the method to make a back-up of
the key to use to decrypt the encrypted information or method to escrow the key(hereinafter referred to as “back-up method, etc. of the key”).
(2) Introducing the functions for encryption and performing electronic signatures[BASIC Requirements](a) The information system security officer must consider whether encryption functions
are required for the information systems that handle confidential information (except
written documents (hereinafter the same in this section)).
(b) For the information systems for which encryption is required, the information systemsecurity officer must establish a function to provide encryption.
(c) The information system security officer must consider whether performing anelectronic signature is required for the information systems that handle criticalinformation.
(d) For the information systems for which performing an electronic signature is required,
the information system security officer must establish a function to provide anelectronic signature.
[ENHANCED Requirements](e) For the information systems for which encryption or performing an electronic- 37 -

signature is required, the information system security officer must configure thecryptographic module as a component so that it can be replaced.
(f) For the information systems for which encryption or performing an electronic
signature is required, the information system security officer must allow for theselection of multiple algorithms.
(g) For the information systems for which encryption or performing an electronic
signature is required, the information system security officer must appropriately
implement the selected algorithm in the software or hardware and select products thathave obtained authentication based on cryptographic module tests and theauthentication system so as to protect the key to use to decrypt the encrypted
information or to apply an electronic signature, identification code, and authentication
information.
(h) For the information systems for which encryption or performing an electronic
signature is required, the information system security officer must store the key to use
to decrypt the encrypted information or to perform an electronic signature in thecryptographic module with tamper-resistance in order to protect it from physicalattacks by a third party.
(3) Management of encryptions and electronic signatures[BASIC Requirements](a) For the information systems for which performing an electronic signature is required,
the information system security officer must provide the information or a measure tovalidate the electronic signature to the signature examiner.
[ENHANCED Requirements](b) In the case that the information system security officer decides that an encryption or
performing an electronic signature is required, he or she must collect information
about the compromise risks of the algorithm selected for the information system as theneed arises.
(4) Using the encryption function or performing electronic signatures[BASIC Requirements](a) In the case that the employee transfers confidential information or saves it in anelectronic storage medium, he or she must consider whether encryption is required and
if it is required, then he or she must encrypt it in accordance with the definedalgorithm and implementation system.
(b) In the case that the employee transports critical information or saves it in an electronicstorage medium, he or she must consider whether performing an electronic signature isrequited and if it is required, then he or she must perform an electronic signature inaccordance with the defined algorithm and implementation system.
(c) The employee must appropriately manage the key to use to decrypt the encrypted- 38 -

information or to apply an electronic signature in accordance with the definedmanagement procedures, etc. and retention method, etc. of the key.
[ENHANCED Requirements](d) The employee must make a back-up of the key to use to decrypt the encrypted
information in accordance with the defined back-up method, etc. of the key.

- 39 -

4.2 Threats to Information Security
4.2.1 Security Holes
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) For computers and communication equipment (except computers and communicationequipment without announced security hole information; hereinafter the same in thissection), the information system security officer must collect device information
required to respond to security holes and put it on a document.
(b) The information system security officer must take measures to respond to theannounced security holes relating to software used in the computers or communicationequipment when such computers or communication equipment are built or start
operating.
[ENHANCED Requirements](c) For the information systems that handle vital information, the information systemsecurity officer must install computers and communication equipment in a redundantconfiguration so that the services can continue to be provided without disruption when
action is taken in response to security holes.
(d) The information system security officer must take available measures for computersand communication equipment even in the case that there is no information about theannounced security holes.
(2) Operating the information systems[BASIC Requirements](a) The information system security officer must update the documents that include device
information required to respond to the security holes in the case that the configurationof computers and communication equipment has been changed.
(b) The information system security administrator must obtain information about theannounced security holes relating to software used on the computers andcommunication equipment which he or she is responsible for as need arises.
(c) In the case that the information system security officer obtained the security hole
information with regard to software used on the computers and communicationequipment which he or she is responsible for, he or she must analyze the risks that the
security holes pose to the information systems, determine the following, and formulate
a security hole response plan.
(i)
Need of response(ii) Response procedure(iii) Temporary workaround procedure in the case that no response procedure exists- 40 -

Effects of response or temporary workaround procedures on the information
systems(v) Response implementation schedule(vi) Need of response testing(vii) Response testing procedure(viii) Response testing plan
The information system security administrator must take measures against security
holes based on the security hole response plan.
The information system security administrator must record the items including date,work description, and worker for the measure against security holes that has beentaken.
The information system security administrator must obtain a file to use to solve theproblem of security holes such as a patch or updated software version, etc. (hereinafterreferred to as “security update file”) in a reliable manner. Also, he or she must validate
integrity of the security update file in the case that any validation procedure isprovided.
The information system security administrator must investigate and analyze measures
for security holes and software configurations periodically and respond in the case thathe or she finds any computers or communication equipment in an inappropriate state.
The information system security officer must share the obtained information about the
security holes and the measures with other information system security officers asneeded.
(iv)

(d)
(e)

(f)

(g)

(h)

4.2.2 Malware
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) The information security officer must define the daily activities including advice to theemployees to prevent the presence of malware.
(b) The information system security officer must install antivirus software, etc. on thecomputers (except for the computers which do not accept any antivirus software, etc.;
hereinafter the same in this section.)(c) The information system security officer must take measures against malware by using
antivirus software, etc. for all imaginable routes for the malware.
[ENHANCED Requirements](d) For all the imaginable routes of malware, the information system security officer must
install antivirus software etc. from different manufacturers in combination.
(e) The information system security officer must take measures to prevent malware from- 41 -

spreading by communications.
(2) Operating the information systems[BASIC Requirements](a) The information system security administrator must try to collect information about
malware and decide whether any response is required, and instruct the employees totake measures as needed.
(b) The employee must not execute the executable files detected as malware by antivirus
software or load the data files into any applications.
(c) The employee must always keep the applications and malware definition files usedwith antivirus software updated.
(d) The employee must enable the automatic malware detection function provided byantivirus software, etc.
(e) The employee must check for malware in all the electronic files using antivirus
software, etc. periodically.
(f) The employee must check whether there is an infection by malware when he or she
loads external data or software into the computers or provides data or software
externally.
(g) The employee must try to prevent infection by malware using software security
functions.
(h) The information security officer must examine and review as appropriate how wellmeasures against malware are implemented.
[ENHANCED Requirements](i) The information security officer must establish the system to receive assistance fromexternal experts in the case that the measures against malware that have been taken are
insufficient.

4.2.3 Denial of Service Attacks
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) For the information systems which handle vital information (limited to information
systems with computers, communication equipment or communication lines accessed
via the Internet; hereinafter the same in this section), the information system security
officer must use the functions provided on the computers and communicationequipment that are necessary to provide services to protect against denial of service
attacks.
[ENHANCED Requirements]- 42 -

(b) The information system security officer must build the information system so that the
impact would be minimized in the case that a denial of service attack occurs.
(c) For the information systems which handle vital information, the information systemsecurity officer must identify the monitoring scope and define the monitoringprocedure and monitoring records’ retention period for the computers, communicationequipment, or communication lines which suffer denial of service attacks.
(d) For the information systems that handle vital information, the information systemsecurity officer must introduce any countermeasure device necessary to eliminate or
mitigate the impact of denial of service attacks on the computers, communicationequipment, or communication lines.
(e) For the information systems that handle vital information, the information systemsecurity officer must maintain effective measures to protect against denial of service
attacks.
(f) For the information systems that handle vital information, the information systemsecurity officer must install the computers, communication equipment orcommunication lines that are required to provide services in a redundant configuration.
(g) For the information systems which handle vital information, the information systemsecurity officer must consider that computers and communication equipment alone
cannot protect from a denial of service attack caused by large-scale access andestablish a response procedure and correspondence procedure in cooperation with theprovider of the communication lines which are connected to the Internet when denialof service attacks occur.
(2) Operating the information systems[ENHANCED Requirements](a) For the information systems that handle vital information, the information systemsecurity administrator must monitor the computer, communication equipment, andcommunication line in accordance with the monitoring procedure and keep themonitoring record.

4.2.4 Stepping stone
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) The information system security officer must take measures to prevent the information
systems (limited to information systems with computers, communication equipment orcommunication lines connected to communication lines extending out of thegovernment facility such as Internet-related lines; hereinafter the same in this section)- 43 -

from being used as a stepping stone.
(b) The information system security officer must build the information system so that the
impact would be minimized in the case that the information system is used as a
stepping stone.
[ENHANCED Requirements](c) The information system security officer must define the monitoring procedure tomonitor whether the information system is being used as a stepping stone or not andthe retention period of the monitoring records.
(2) Operating the information systems[ENHANCED Requirements](a) The information system security administrator must monitor the information system inaccordance with the monitoring procedure and keep the monitoring record.

- 44 -

4.3 Security Requirements of Information Systems
4.3.1 Security Requirements of Information Systems
Compliance Requirements(1) Planning and designing the information systems[BASIC Requirements](a) The information system security officer must require the person who is responsible for
information systems to establish the system to maintain security throughout theirlifecycle.
(b) The information system security officer must decide the security requirements of theinformation systems.
(c) The information system security officer must define the measures in purchasing(including leasing) equipment, etc., developing software, configuring the information
security functions, protecting against the threats to information security, and handlingmeasures for components of information systems in order to meet the security
requirements of information systems.
(d) In the case that the information system security officer recognizes any important
security requirements for the information system to be built, he or she must request fora security target (ST) evaluation and confirmation to the third-party organization for
the relevant information system. However, in the case that he or she updates theinformation system or the specification changes in the process of development and thechanges in important security requirements are found to be only minor in the reviewed
security target, such evaluation and confirmation are not always required.
(e) The information system security officer must define the installation procedure andenvironmental requirements in terms of information security when the information
system he or she has built goes into the operation phase.
[ENHANCED Requirements](f) In the case that the information system security officer recognizes any important
security requirements for the information system to be built, he or she must define therequired security function for the device and software products to be procured basedon the security function designed to meet the requirement. In the case that multiple
products meet the function and other requirements, he or she must select one that iscertified according to Japan Information Technology Security Evaluation andCertification Scheme for this security function as a component of the information
system.
(2) Building, operating, and monitoring the information systems[BASIC Requirements](a) The information system security officer must use the information security measures- 45 -

that have been formulated based on the security requirements to build, operate, andmonitor the information systems.
(3) Moving and disposing of the information systems[BASIC Requirements](a) In the case that the information system security officer moves or disposes of theinformation systems, he or she must consider whether deleting or saving theinformation, or disposing or reusing the information systems is required and takeappropriate measures in either case.
(4) Reviewing the information systems[BASIC Requirements](a) The information system security officer must consider as appropriate whether
reviewing the information security measures for the information systems is required,and if it is required, then he or she must carry out the review and take appropriate
measures.
(5) Establishing the information system ledger[BASIC Requirements](a) In the case that the information system security officer newly builds or updates theinformation system, he or she must report to the head of information security officers
about the information to be handled in the relevant information system and matters
including classification of the information.
(b) For all information systems, the head of information security officers must establish aledger containing the information to be handled in the relevant information system andmatters including classification of the information.

- 46 -

Chapter 5 Measures for Components of Information Systems
5.1 Facilities and Environment
5.1.1 The secure area where computers and communication equipment are locatedCompliance Requirements(1) Managing entry and exit
[BASIC Requirements](a) The information system security officer must take measures to prevent suspicious
individuals from entering the secure area.
(b) For the information systems that handle classified information, the information systemsecurity officer must physically isolate the secure area and take measures to manage
entry and exit.
[ENHANCED Requirements](c) The information system security officer must take measures to authenticate the persons
who enter the secure area.
(d) The information system security officer must take measures to authenticate the persons
who exit the secure area.
(e) The information system security officer must take measures to prohibit theauthenticated persons from letting unauthenticated persons enter or exit the securearea.
(f) The information system security officer must establish the procedure to approve thepersons who enter the secure area continuously. Also, he or she must establish the
document to record information including the person’s name, department, approved
entry date, entry period, and rationale.
(g) In the case that there are any changes in the persons who have gained approval ofentering the secure area, the information system security officer must update the above
document with the changes. Also, he or she must record these changes.
(h) The information system security officer must take measures to record and monitor all
entries to and exits from the secure area.
(2) Managing the visitors and delivery personnel[ENHANCED Requirements](a) In the case that there is any visitor to the secure area, the information system security
officer must take measures to confirm the name, department, purpose of the visit, andthe name and department of the employee who receives the visit.
(b) In the case that there is any visitor to the secure area, the information system security
officer must take measures to record the name, department and purpose of the visit, thename and department of the employee who receives the visit, the date of the visit, and- 47 -

(c)

(d)
(e)
(f)
(g)

the time of entry and exit.
In the case that there is any visitor to the secure area, the information system security
officer must establish the procedure by which the visited employee examines whether
the visitor may enter the secure area.
The information system security officer must take measures to limit the area where thevisitors can enter.
The information system security officer must take measures so that the visited
employee attends to the visitor in the secure area.
The information system security officer must take continuous measures to identify thevisitors and the persons who have gained approval of entering by appearance.
In the case that exchange of items with delivery personnel occurs, the information
system security officer must set either requirements:(i) Such exchange must be done outside the secure area.
(ii) In the case that the delivery personnel enter the secure area, such exchange must
be done in the area where computers, communication equipment, and storage
media cannot be touched and the employee must be in attendance.

(3) Securing the computers and communication equipment[BASIC Requirements](a) For the information systems that handle classified information, the information systemsecurity officer must take measures to prevent the stealing or illegal moving of thecomputers to be located and used at a specific location.
[ENHANCED Requirements](b) For the information systems that handle classified information, the information systemsecurity officer must isolate computers and communication equipment from otherinformation systems physically and not locate them in the same secure area.
(c) For the information systems that handle classified information, the information systemsecurity officer must take measures to prevent the stealing or illegal moving of thecommunication equipment to be located and used at a specific location.
(d) The information system security officer must take measures to protect the computersand communication equipment against illegal operation while the employee is awayfrom them.
(e) For the information systems that handle confidential information, the information
system security officer must take measures to protect the display of computers andcommunication equipment from others’ eyes.
(f) For the information systems that handle confidential information, the information
system security officer must take measures to protect the cables including power
cables and communication cables used in the information systems against threats
including damage and sniffing.
(g) For the information systems that handle confidential information, the information- 48 -

system security officer must take measures against information leakage caused byelectronic waves.
(4) Managing security in the secure area
[BASIC Requirements](a) The employee must always keep his or her ID badge visible to other employees in the
secure area.
[ENHANCED Requirements](b) The employee must bring the items used in the information systems that handle
classified information into or out of the secure area after gaining approval from theinformation system security officer.
(c) The information system security officer must record the bringing into or out of the
secure area of items used in the information systems that handle classified
information.
(d) For the information systems which handle confidential information, the information
system security officer must restrict bringing computers, communication equipment,
electronic storage media, and recording devices (including the ones to record voice,video, and image) that are not used in the information systems into the secure area.
(e) The information system security officer must take measures to monitor the work donein the secure area.
(5) Measures against disasters and failures[ENHANCED Requirements](a) For the information systems that handle vital information, the information systemsecurity officer must take physical measures to protect computers and communicationequipment against natural and human-induced disasters.
(b) For the information systems which handle vital information, the information systemsecurity officer must take measures to stop power feeding to the computers andcommunication equipment as needed as well as assure the security of workers in thecase that any disaster or failure occurs in the secure area.

- 49 -

5.2 Computers5.2.1 Common Measures for Computers
Compliance Requirements(1) Installing the computers[BASIC Requirements](a) The information system security officer must establish the rule to maintain computer
security.
(b) The information system security officer must establish the document to identify the
responsible employees and users of every computer.
(c) For the computers that handle vital information, the information system security
officer must consider and ensure the system capabilities to provide the performancerequired from the relevant computer in the future.
(d) The information system security officer must consider whether any information
security function is necessary for the computer or not.
(e) For the computer for which an information security function is required, theinformation system security officer must set the relevant function.
(f) The information system security officer must take measures to protect the computersagainst the announced security holes which exist in the operating system andapplications running on the computer (except the ones without announced security
hole information).
(g) The information system security officer must take measures to protect the computers(except for the computers which do not have any antivirus software, etc.) against
malware.
(h) The information system security officer must establish the documents used for thecomputers.
(i) For the information systems that handle classified information, the information systemsecurity officer must locate the computer in a secure area. However, this is not
required for mobile PCs in the case that he or she gains approval from the information
security officer.
[ENHANCED Requirements](j) For the computers that handle vital information, the information system security
officer must install the computers that are required to provide services in a redundantconfiguration.
(2) Operating the computers[BASIC Requirements](a) The information system security administrator must manage operation of thecomputers based on the rule to maintain security.

- 50 -

(b) The information system security officer must review the rule to maintain computer
security appropriately. Also, if there is any change to the relevant rule, he or she mustrecord it.
(c) The employee must not use the computers for the purpose other than executing his or
her tasks.
(d) In the case that the information system security officer has changed the responsible
employees or users of the computers, he or she must update the document to identify
the new responsible employees or users of the computers. Also, he or she must record
such changes.
(e) The information system security officer must take measures to protect the computersagainst the announced security holes in order to maintain an appropriate computer
security level.
(f) The information system security officer must take measures to protect the computersagainst malware in order to maintain an appropriate computer security level.
(g) In the case that the information system security officer has changed any computerconfiguration, he or she must update the documents used for the computers with thechanges. Also, he or she must record such changes.
[ENHANCED Requirements](h) The information system security officer must periodically examine the state of each
item of software used on the computers within his or her control and make
improvements if any computers are found to be in an inappropriate state.
(3) Disposing of the computers[BASIC Requirements](a) In the case that the information system security officer disposes of the computers, heor she must delete all the information stored in the electronic storage media of thecomputer.

5.2.2 Terminals
Compliance Requirements(1) Installing the terminals[BASIC Requirements](a) The information system security officer must define a list of software that may be used
for the terminals. However, in the case that it is difficult to list the allowed software,
he or she can list the denied software or list both of the allowed and the denied
software.
(b) The information system security officer must enable the protection measures in themobile PCs that handle classified information to be used outside the government- 51 -

agency so that they can operate with the same protection measures as the terminals to
be used inside the government agency.
(c) The employee must gain approval from the information system security officer in thecase that he or she needs to use a mobile PC.
(d) The information system security officer must add a function to encrypt the information
saved in the electronic storage media for mobile PCs that handle confidential
information.
(e) The information system security officer must define the measures to prevent theft forthe mobile PCs that handle classified information.
[ENHANCED Requirements](f) The information system security officer must build the information systems using theterminals that do not allow the employees to save the information.
(2) Operating the terminals[BASIC Requirements](a) The employee must not use any other software than that which he or she is allowed touse on the terminal.
(b) In the case that the employee uses the mobile PCs that handle classified information,
he or she must take measures to prevent theft.
(c) For the mobile PCs that handle confidential information, in the case that the employee
takes the mobile PCs outside the government agency, he or she must consider whether
encrypting the confidential information saved in the electronic storage media of themobile PC is required and if it is required, then he or she must encrypt it.
(d) The employee must not connect his or her terminal to communication lines other thanthose to which the information system security officer has given approval forconnecting.
[ENHANCED Requirements](e) The information system security administrator must synchronize the terminal timewith the standard time in the information systems.

5.2.3 Server Devices
Compliance Requirements(1) Installing the servers[BASIC Requirements](a) In the case that the information system security officer maintains the server via acommunication line, he or she must consider whether encrypting the sent or received
information is required and if it is required, he or she must encrypt it.
(b) The information system security officer must define the software to be used to provide- 52 -

services and to operate and manage the servers.
(c) In the case that the information system security officer finds that any server
application that is not included in the allowed software is running, he or she must stop
the relevant server application. Also, even in the case that the server application is
included in the allowed software, he or she must disable the functions that are not
used.
[ENHANCED Requirements](d) The information system security officer must uninstall any software that is notincluded in the allowed software from the servers.
(2) Operating the servers[BASIC Requirements](a) The information system security officer must confirm the changes in the configurationof servers periodically. Also, he or she must identify the impact of the changes on theservers and take measures.
(b) The information system security administrator must take necessary measures to restore
the servers that handle vital information.
(c) The information system security administrator must record the information including
the date of work, the server, the work description, and the worker for the operation andmanagement of the server.
(d) The information system security officer must consider whether audit trails are requiredon the server and if it is required, then he or she must collect it.
(e) The information system security administrator must synchronize the time of servers
with the standard time of the information systems.
[ENHANCED Requirements](f) The information system security administrator must monitor the security state of theservers to detect any events including illegal activities or use.
(g) For the servers that handle vital information, the information system security
administrator must monitor the system status of the relevant server to detect any
failures, etc.
(h) For the servers that handle vital information, the information system security
administrator must balance the load of the servers required to provide services overmultiple servers.

- 53 -

5.3 Application Software
5.3.1 Common Measures for Applications provided via Communication Line
Compliance Requirements(1) Installing the applications[BASIC Requirements](a) The information system security officer must define the rule to maintain security of theservices to be provided via a communication line.
(2) Operating the applications[BASIC Requirements](a) The information system security administrator must operate and manage the systems
daily and periodically based on the rule related to the maintenance of security of theservices.
(b) The employee must not use the services that are provided via a communication line forprivate purposes.

5.3.2 E-mailCompliance Requirements(1) Introducing e-mail service[BASIC Requirements](a) The information system security officer must configure the e-mail servers so that
unsolicited bulk e-mail cannot be relayed.
[ENHANCED Requirements](b) The information system security officer must establish a function to authenticate theemployees when the e-mail client sends or receives messages to or from the e-mailserver.
(2) Operating e-mail service[BASIC Requirements](a) In the case that the employee sends or receives e-mail messages that contain
information that is related to business, he or she must use the e-mail service provided
by the e-mail server that is operated or outsourced by each government agency that heor she belongs to. However, this is not always required if he or she has gained
approval for information processing in unsupplied information systems.
(b) The employee must display any e-mail message he or she receives as text in thee-mail client.

- 54 -

5.3.3 Web
Compliance Requirements(1) Introducing the Web[BASIC Requirements](a) In the case that the users enter strings, etc. in the services provided using the Web
servers, the information system security officer must sanitize input data.
(b) The information system security officer must build the information systems so that the
Web servers do not send to the Web clients any information that could be utilized inattacks.
(c) For the information systems which handle confidential information, the information
system security officer must identify the information to protect against sniffing,consider whether encryption is required, and if it is required, then he or she must
encrypt the information for the services provided using the Web servers.
[ENHANCED Requirements](d) For the information systems that handle confidential information, the information
system security officer must identify the information to be stored on the Web servers
and confirm that the relevant servers do not contain any confidential information.
(e) The information system security officer must use the digital certification to ensure thevalidity of Web servers.
(2) Operating the Web[BASIC Requirements](a) In the case that the employee downloads software to the computers on which a Webclient is running, he or she must confirm the source of the software using an electronic
signature.
[ENHANCED Requirements](b) The information system security officer must limit the Web pages from outside thegovernment agency that the employees can browse and review the limit periodically.

- 55 -

5.4 Communication Lines
5.4.1 Common Measures for Communication Lines
Compliance Requirements(1) Building communication lines[BASIC Requirements](a) The information security officer must establish the rule related to the maintenance of
security of communication lines and communication equipment.
(b) In the case that the information system security officer builds a communication line,
he or she must consider the risks in doing so.
(c) For the information systems that handle vital information, the information systemsecurity officer must consider and ensure the system capabilities to provide
performance required for the relevant communication lines and communicationequipment for the future.
(d) The information system security officer must establish the documents to be used forthe communication lines and communication equipment.
(e) For all commucication lines and communication equipment, the information security
officer must establish the documents to specify the persons who manage them.
(f) The information security officer must define the software necessary forcommunication equipment to be operated. However, this is not required in the case ofcommunication equipment for which it is difficult to change software.
(g) The information system security officer must group the computers that are connectedwith the communication line and separate them on that communication line.
(h) The information system security officer must consider the communication
requirements among the grouped computers and use the communication equipment
and provide access control and route control in accordance with the communication
requirements.
(i) For the information systems that handle confidential information, the information
system security officer must consider whether encryption of the confidential
information sent or received using the communication line is required and if it isrequired, then he or she must encrypt it.
(j) For the information systems that handle classified information, the information systemsecurity officer must consider the security of physical lines used for thecommunication line and select appropriate ones.
(k) The information system security officer must ensure security of the connections thatare used in the services for remote maintenance or diagnosis work for thecommunication equipment.
(l) The information system security officer must take measures to protect thecommunication equipment against the announced security holes in the communication- 56 -

equipment.
(m) The information system security officer must locate the communication equipment in
the secure area.
(n) In the case that a private line service provided by a carrier is used, the information
system security officer must stipulate the items including security and service levels in
the agreement.
(o) The information system security officer must consider whether audit trails are required
for the communication equipment and if it is required, then he or she must collect it.
[ENHANCED Requirements](p) The information system security officer must authenticate the communicating
computers.
(q) For the information systems that handle vital information, the information systemsecurity officer must install the communication line or communication equipment thatis required to provide the services in a redundant configuration.
(2) Operating the communication line
[BASIC Requirements](a) The information system security officer must manage the information including theidentification code of computers that use the communication line, combinations ofcomputer users and user identification codes, and user department of thecommunication line.
(b) In the case that the information system security officer has made any changes in theconfigurations or settings for items including communication line, communicationequipment, access control, or identification code, he or she must update the documents
used for the communication line and communication equipment. Also, he or she mustrecord such changes.
(c) In the case that the information system security officer has changed the persons who
manage communication lines or communication equipment, he or she must reflect thechange in the documents to specify the persons who manage the communication lines
or communication equipment. Also, he or she must keep a record of the change.
(d) In the case that the information system security administrator changes the software of
the communication equipment, he or she must obtain approval from the information
system security officer.
(e) For the management of operation of communication lines and communicationequipment, the information system security administrator must record matters such as
operated communication lines and communication equipment, the date and contents of
the operation, and operators.
(f) The information system security officer must confirm the configurations or settings foritems including communication line, communication equipment, access control, or
identification code periodically. Also, he or she must identify the impact of the- 57 -

changes on the security of the communication line and take appropriate measures.
(g) In the case that security of the information system is difficult to ensure for any reason,
the information system security officer must change the communication line from theshared configuration to the independent and closed configuration.
(h) The employee must not connect computers and communication equipment that are notapproved by the information system security officer to the communication line.
(i) The information system security officer must take measures to protect thecommunication equipment against the announced security holes to maintain an
appropriate security level for the communication equipment.
(j) The information system security administrator must synchronize the time of thecommunication equipment with the standard time of the information systems.
[ENHANCED Requirements](k) The information system security officer must periodically examine the conditions of
all the software necessary for the operation of communication equipment which he or
she is responsible for, and when any equipment under inappropriate conditions isfound, then he or she must work to improve the relevant inappropriate conditions.
However, this is not required in the case of communication equipment for which it isdifficult to change software.
(3) Disposing of the communication lines[BASIC Requirements](a) In the case that the information system security officer disposes of the communicationequipment, he or she must delete all the information stored in the electronic storage
media of the communication equipment.

5.4.2 Management of Communication Lines in the Government Facilities
Compliance Requirements(1) Building the communication lines in the government agencies[ENHANCED Requirements](a) The information system security officer must take measures to confirm that thecomputers that are physically connected with the communication equipment havegained approval for connecting with the communication line before they are logicallyconnected with the communication line.
(2) Operating the communication line in the government agency[ENHANCED Requirements](a) The information system security officer must review the configurations of access
control when he or she changes the communication requirements and periodically.

- 58 -

(b) For the information systems that handle vital information, the information systemsecurity administrator must confirm and analyze the utilization and state of thecommunication line daily to measure or detect any degradation or abnormality in thecommunication line.
(c) The information system security administrator must monitor the information that issent or received via the communication line in the government agency.
(3) Measures on the lines[BASIC Requirements](a) In the case that the information system security officer builds the VPN environment,
he or she must consider whether measures including the following are required and if
it is required, then he or she must take any of such measures.
(i)
Establishing the procedures to start or stop using the VPN environment(ii) Encrypting the information(iii) Identifying the communicating computers or authenticating the users(iv) Obtaining and managing the authentication records(v) Limiting the scope of communication lines which are accessible via VPN(vi) Assuring the confidentiality in the VPN connection method(vii) Managing the computers which use VPN(b) In the case that the information system security officer builds the wireless LAN
environment, he or she must consider whether measures including the following are
required and if it is required, then he or she must take any of such measures.
(i)
Establishing the procedures to start or stop using the LAN environment(ii) Encrypting the information(iii) Identifying the communicating computers or authenticating the users(iv) Obtaining and managing the authentication records(v) Limiting the scope of communication lines which are accessible via wirelessVPN(vi) Prohibiting connection with another communication line while connecting withthe wireless LAN(vii) Assuring the confidentiality in the wireless LAN connection method(viii) Managing the computers which connect with the wireless LAN(c) In the case that the information system security officer builds the remote accessenvironment via the public telephone network, he or she must consider whether
measures including the following are required and if it is required, then he or she musttake any of such measures.
(i)
Establishing the procedures to start or stop using the remote access environment(ii) Identifying and authenticating the communicating users or caller numbers(iii) Obtaining and managing the authentication(iv) Limiting the scope of communication lines which are accessible by remote- 59 -

access(v) Prohibiting connecting with another communication line while accessing
remotely(vi) Assuring confidentiality in the remote access method(vii) Managing the computers which access remotely

5.4.3 Connecting with Communication lines outside the Government Agency
Compliance Requirements(1) Connecting the communication lines inside the government agency and the communicationlines outside the government agency[BASIC Requirements](a) The information system security officer must gain approval from the information
security officer to connect a communication line inside the government agency with acommunication line outside the government agency.
(b) In the case that the information security officer decides that the security of theinformation systems cannot be ensured when the communication line in thegovernment agency is connected with a communication line outside the government
agency, he or she must change the communication line inside the government agency
or the communication line outside the government agency from the sharedconfiguration to the independent configuration.
(2) Operating a communication line inside the government agency which is connected with acommunication line outside the government agency[BASIC Requirements](a) In the case that the information system security officer decides that security of theinformation systems cannot be ensured when a communication line in the government
agency is connected with a communication line outside the government agency, he or
she must change the communication line inside the government agency or thecommunication line outside the government agency from the shared configuration to
the independent configuration.
(b) The information system security officer must review the configurations for access
control when he or she changes the communication line and periodically.
(c) For the information systems that handle vital information, the information systemsecurity administrator must confirm and analyze the utilization and state ofcommunication lines daily to measure or detect degradation or abnormality in thecommunication line.
(d) The information system security administrator must monitor the information that is sent or
received via the communication lines in the government agency.

- 60 -

Chapter 6 Measures for Individual Consideration
6.1 Information Security Measures for Procurement and Development
6.1.1 Purchasing the equipment, etc.
Scope
This applies to purchases (including leases; hereinafter the same) of the equipment, etc.

Compliance Requirements(1) Establishing the mechanism to ensure information security common in the government
agencies[BASIC Requirements](a) The head of information security officers must formulate the selection criteria for theequipment, etc.
(b) The head of information security officers must formulate the confirmation and test
procedure for the equipment, etc. in terms of information security measures.
(2) Procedures for purchasing the equipment, etc.
[BASIC Requirements](a) In the case that the information system security officer selects the equipment, etc., heor she must consider whether the equipment, etc. meets the selection criteria andutilize the results to make a selection.
(b) In the case that the equipment, etc. is delivered, the information system security officer
must confirm that the delivered equipment, etc. meets the selection criteria for theequipment, etc. and add the confirmation to the inspection.
(c) The information system security officer must consider whether maintenance andcheck-up in terms of information security measures is required after the equipment, etc.
is delivered, and if it is required, then he or she must clarify the maintenance andcheck-up requirements and sign an agreement with the manufacturer of the equipment,
etc. or other service provider.
(d) In the case that there are required specifications for security functions to satisfy the
security requirements and the purchase is made by comprehensive evaluation of
bidders, the information system security officer must select the equipment, etc basedon whether it is certified according to Japan Information Technology Security
Evaluation and Certification Scheme.

6.1.2 Outsourcing- 61 -

ScopeThis is applied to the information processing tasks out of the job functions provided based on
Article 29 of the Accountancy Act which stipulates leases, contracts, and other agreements, including
the following items:zSoftware development (programming, system development, etc.)z

Information processing (statistics, tabulation, data entry, media conversion, etc.)z

Leasingz

Examination and research (examination, research, investigation, etc.)

Compliance Requirements(1) Establishing the mechanism to ensure information security common in the government
agencies[BASIC Requirements](a) The head of information security officers must establish the criteria to determine thescope of information systems that can be outsourced and the scope of information
assets that may be accessed by the contractors.
(b) The head of information security officers must establish the selection procedure andselection criteria.
[ENHANCED Requirements](c) The head of information security officers must establish the procedure to evaluate theinformation security level of the contractor based on the international standards inorder to select a contractor more stringently.
(2) Clarifying the Information Security Measures to be implemented by the contractors[BASIC Requirements](a) The information system security officer or the division/office information security
officer must clarify the information security measures that the contractor must
implement in the outsourced work and notify the candidate contractors in advance.
(b) The information system security officer or the division/office information security
officer must formulate the response procedure in the case information security isviolated in contracted work and notify the candidate contractors in advance.
(c) The information system security officer or the division/office information security
officer must establish a procedure to check how well the information security
measures are implemented by the contractor and the response procedure in the eventof poor implementation, and notify them to the candidate contractors in advance.
(3) Selecting the outside contractor[BASIC Requirements](a) The information system security officer or the division/office information security
officer must select the contractor based on the selection procedure and selection- 62 -

criteria.
[ENHANCED Requirements](b) The information system security officer or the division/office information security
officer must check the information security level of the candidate contractors inaccordance with the procedure to evaluate the information security level of thecontractor based on the international standards and utilize it to make a selection.
(4) Contracts pertaining to outsourced work
[BASIC Requirements](a) The information system security officer or the division/office information security
officer must sign an outsourcing agreement with the contractor that stipulates
implementation of the information security measures in the contracted work,
nondisclosure (including prohibiting use of information for non-business purposes),
response procedures in the case of information security breaches, procedures to check
implementation of information security measures, or response procedures in the caseof poor implementation of information security measures. Also, he or she should
include the following items in the agreement as needed:(i) To take steps to make the contractor undergo the information security audit(ii) To take steps to make the contractor secure the service level(b) The information system security officer or the division/office information security
officer must clarify the responsibilities of both parties for the outsourcing agreement,
build consensus, and request the contractor to present the confirmation note, etc. about
how the information security measures will be implemented and managed. Also, he or
she must include the following description in the confirmation note, etc. as needed:(i) Specification of the person who engages in the outsourced work(ii) Detailed work that the person does in order to implement the information security
measures(c) The information system security officer or the division/office information security
officer must judge whether to renew the outsourcing agreement based on the selection
procedure and selection criteria on a case-by-case basis but must not take the decision
to renew lightly.
(d) The information system security officer or the division/office information security
officer must consider whether to change the services that are provided by thecontractor (including maintaining and improving the basic policy for information
security, operation procedures, and management procedure) based on the selection
procedure and selection criteria.
(e) The information system security officer or the division/office information security
officer must prohibit the contractor from subcontracting all or part of the outsourced
work to a third party. However, this is not always required if the information systemsecurity officer or the division/office information security officer receives explanations- 63 -

from the contractor and decides that information security is ensured measures to betaken to protect against the potential dangers from subcontracting.
(5) Procedures in implementing the outsourcing[BASIC Requirements](a) In the case that the employee provides classified information or important
specifications to the contractor, he or she must provide only the minimum necessary
information and take the following measures.
(i) In the case that the employee provides information to the contractor, he or she
must provide it in a safe delivery method and record the provision of theinformation.
(ii) In the case that the provided information becomes unnecessary for the contractor
due to the termination of the outsourcing, etc., the employee must have them
return, dispose, or delete the information without fail.
(b) In the case that information security is violated in contracted work, the information
system security officer or the division/office information security officer must have thecontractor take necessary measures in accordance with the defined response
procedure.
(c) The information system security officer or the division/office information security
officer must check how the information security measures are implementated by thecontractor in accordance with the defined procedure.
(6) Procedures to terminate the outsourcing[BASIC Requirements](a) The information system security officer or the division/office information security
officer must confirm the information security measures implemented in the outsourced
work when he or she terminates the outsourcing and adds the confirmation to theinspection.

6.1.3 Software Development
Compliance Requirements(1) Establishing the system for software development[BASIC Requirements](a) The information system security officer must require the person who is responsible for
information systems to establish the system for software development designed tocomply with the information security measures (to meet compliance requirements of(2) to (5).)(b) In the case that the information system security officer outsources software- 64 -

development, he or she must select necessary information security measures (orcompliance requirements of (2) to (5)) that should be implemented by the contractor
and ensure that such implementation is assured by the contractor.
(2) Starting software development[BASIC Requirements](a) The information system security officer must define the procedure and environment
for each phase of software development in terms of information security.
(b) The information system security officer must consider whether separating theinformation system that is used for software development and testing from theoperating information system is required in terms of information security and if it isrequired, then he or she must separate them.
(3) Designing the software[BASIC Requirements](a) The information system security officer must consider whether any security function isrequired, and if it is required, then he or she must design the function appropriately
and clearly describe it in the design document based on the analysis of measured
dangers connected with the information assets to be used in the operation of thesoftware to be developed and the classification of information that is handled by thesoftware.
(b) The information system security officer must consider whether a function to manage
the security functions for operation of the software to be developed is required, and if
it is required, then he or she must design the management function appropriately andclearly describe it in the design document.
(c) The information system security officer must define the scope and procedure of review
to confirm the validity of information security in software design and review it
accordingly.
(d) The information system security officer must consider whether a function to confirm
the validity of information security in the data processed or input-output by thesoftware to be developed is required and if it is required, then he or she must design
the function appropriately and clearly describe it in the design document.
(e) In the case that there are any important security requirements for the software to be
developed, the information system security officer must request a security target (ST)evaluation and confirmation by the third-party organization for the purpose of thedesign of security functions to meet them. However, in the case that he or she
undergoes the ST evaluation and confirmation for the information system that contains
the relevant software or updates the software, or the specification changes in theprocess of development and the changes in important security requirements are foundto be only minor in the reviewed security target, such evaluation and confirmation are- 65 -

not always required.
(4) Developing the software[BASIC Requirements](a) The information system security officer must protect against unnecessary access andmake a back-up of the source code that is formulated by the software developer.
(b) The information system security officer must define the rule for coding in terms of
information security.
[ENHANCED Requirements](c) The information system security officer must define the scope and procedure of review
to confirm the validity of the formulated source code and review it accordingly.
(5) Testing the software[BASIC Requirements](a) The information system security officer must consider whether any testing is requiredin terms of security, and if it is required, then he or she must define the items andprocedure of testing and conduct the test.
(b) The information system security officer must record the test that is conducted in termsof information security.

- 66 -

6.2 Specific Restrictions
6.2.1 Restrictions on Information Processing outside the Government Facility
Compliance Requirements(1) Establishing procedures on the security measures[BASIC Requirements](a) The head of information security officers must define the procedures on security
measures for processing classified information outside the government agency.
(b) The head of information security officers must define the procedures on security
measures for bringing the information systems that handle classified information
outside the government agency.
(2) Gaining approval, notifying, and management[BASIC Requirements](a) In the case that the employee processes confidentiality class-3 information, integrity
class-2 information, or availability class-2 information outside the government agency,
he or she must gain approval from the information system security officer or thedivision/office information security officer.
(b) In the case that the employee processes outside the government agency informationthat is confidentiality class-2 information and integrity class-1 information as well asavailability class-1 information, he or she must notify the information system security
officer or the division/office information security officer.
(c) The information system security officer and the division/office information security
officer must record processing of classified information that is done outside thegovernment agency.
(d) In the case that the information system security officer or the division/office
information security officer does not receive a report of expiration when the approved
period for processing confidentiality class-3 information, integrity class-2 information,
or availability class-2 information outside the government agency expires, he or she
must confirm the state and take appropriate measures. However, this is not always
required if the person who has given approval does not require reporting.
(e) In the case that the notified period expires for processing outside the government
agency information that is confidentiality class-2 information and integrity class-1
information as well as availability class-1 information, the information system security
officer or the division/office information security officer must confirm the state andtake appropriate measures as needed.
(f) In the case that the employee processes classified information outside the government
agency, he or she must process the minimum information required for executing his or
her tasks.

- 67 -

(g) In the case that the employee brings the information systems that handle
confidentiality class-3 information, integrity class-2 information, or availability class-2
information outside the government agency, he or she must gain approval from theinformation system security officer or the division/office information security officer.
(h) In the case that the employee brings outside the government agency the information
systems that handle information that is confidentiality class-2 information andintegrity class-1 information as well as availability class-1 information, he or she must
notify the information system security officer or the division/office information
security officer.
(i) The information system security officer and the division/office information security
officer must record bringing the information systems that handle classified information
outside the government agency.
(j) In the case that the information system security officer or the division/office
information security officer does not receive a report of expiration when the approved
period for bringing confidentiality class-3 information, integrity class-2 information,
or availability class-2 information outside the government agency expires, he or she
must confirm the state and take appropriate measures. However, this is not always
required if the person who has given approval does not require reporting.
(k) In the case that the notified period expires for bringing outside the government agency
information that is confidentiality class-2 information and integrity class-1 information
as well as availability class-1 information, the information system security officer orthe division/office information security officer must confirm the state and takeappropriate measures as needed.
(l) In the case that the employee brings the information systems that handle classified
information outside the government agency, he or she must take the minimum amountof information systems required for executing his or her tasks.
(3) Implementing the Security Measures[BASIC Requirements](a) The employee must take the security measures that are formulated for processingclassified information outside the government agency.
(b) In the case that the approved period for processing confidentiality class-3 information,
integrity class-2 information, or availability class-2 information outside thegovernment agency expires, the employee must report this to the person who has given
approval. However, this is not always required if the person who has given approval
does not require reporting.
(c) The employee must take the security measures that are formulated for bringing theinformation systems that handle classified information outside the government agency.
(d) In the case that the approved period for bringing the information systems that handle
confidentiality class-3 information, integrity class-2 information, or availability class-2- 68 -

information outside the government agency expires, the employee must report this tothe person who has given approval. However, this is not always required if the person
who has given approval does not require reporting.

6.2.2 Restrictions on Information Processing Using Information Systems Not
Supplied by the Government Agency
Compliance Requirements(1) Establishing procedures on the Security Measures[BASIC Requirements](a) The head of information security officers must define the procedures on security
measures for processing classified information using the information systems not
supplied by the government (unsupplied information systems).
(2) Gaining approval, notifying, and management[BASIC Requirements](a) In the case that processing class-3 information, integrity class-2 information, oravailability class-2 information using the unsupplied information systems is required,the employee must gain approval from the information system security officer or thedivision/office information security officer.
(b) In the case that it is required, using the unsupplied information systems, to process
information that is confidentiality class-2 information and integrity class-1 information
as well as availability class-1 information, the employee must notify the information
system security officer or the division/office information security officer.
(c) The information system security officer and the division/office information security
officer must record processing of classified information which is done using theunsupplied information systems.
(d) In the case that the information system security officer or the division/office
information security officer does not receive a report of expiration when the approved
period for processing class-3 information, integrity class-2 information, or availability
class-2 information using the unsupplied information systems expires, he or she must
confirm the state and take appropriate measures. However, this is not always required
if the person who has given approval does not require reporting.
(e) In the case that the notified period expires for processing, using the unsupplied
information systems, information that is confidentiality class-2 information andintegrity class-1 information as well as availability class-1 information, theinformation system security officer or the division/office information security officer
must confirm the state and take appropriate measures as needed.

- 69 -

(3) Implementing the Security Measures[BASIC Requirements](a) In the case that the employee processes classified information using the unsupplied
information systems, he or she must take the security measures that are formulated forthe relevant information systems.
(b) In the case that the approved period for processing class-3 information, integrity
class-2 information, or availability class-2 information using the unsupplied
information systems expires, the employee must report this to the person who hasgiven approval. However, this is not always required if the person who has given
approval does not require reporting.

6.2.3 Measures in Introducing IPv6 technology to Information Systems
Compliance Requirements(1) Vulnerability caused by mechanism for IPv6 transfer[BASIC Requirements](a) In the case that the information system security officer introduces communications
utilizing IPv6 technology (hereinafter referred to as “IPv6 communications”) to theinformation systems, he or she must take necessary measures to prevent mechanism
for the IPv6 transfer from posing any threat to information security.
(2) Prevention and monitoring of unintended IPv6 communications[BASIC Requirements](a) For all computers and communication equipment connected to communication lines
for which IPv6 communications are not intended, the information system security
officer must take measures to prevent IPv6 communications.
[ENHANCED Requirements](b) The information system security officer must monitor communication lines for which
IPv6 communications are not intended, and when any IPv6 communications aredetected, he or she must identify the equipment and take necessary measures to cut off
the IPv6 communications.

- 70 -

6.3 Miscellaneous
6.3.1 Preventing actions that lower the Information Security Level outside theGovernment Agency
Compliance Requirements(1) Establishing procedures on the measures[BASIC Requirements](a) The head of information security officers must define the procedures for measures toprevent actions that would lower the level of information security outside thegovernment agency.
(2) Implementing the measures[BASIC Requirements](a) In principle, the employee must take measures to prevent actions that would lower thelevel of information security outside the government agency.

6.3.2 Consistent Operation with the Business Continuity Plan (BCP)
ScopeThis applies to the government agencies that establish or will establish a BCP.
Compliance Requirements(1) Understanding the preparation plan for a BCP in the government[BASIC Requirements](a) The chief information security officer must establish the system so that the information
security committee is kept regularly informed of a government agency BCP
preparation plan via the head of information security officers.
(b) In the case that the head of information security officers understands the preparation
plan for a BCP in the government agency, he or she must report it to the information
security committee, and as needed, to the information security officer, the information
system security officers and the division/office information security officers.
(2) Ensuring consistency between the BCP and the Information Security Measures[BASIC Requirements](a) In the case that the information security committee establishes a BCP or the standardsof government agency, it must ensure the consistency between the BCP and thestandards of government agency.
(b) In the case that there is any preparation plan for a BCP in the government agency, thehead of information security officers, the information security officer, the information- 71 -

system security officer, and the division/office information security officer must
consider whether each information system is related with the relevant BCP.
(c) In the case that there is any preparation plan for the BCP in the government agency,
the head of information security officers, the information security officer, theinformation system security officer, and the division/office information security officer
must establish the following common procedures based on the BCP and the standardsof government agency for the information systems that they believe are related withthe relevant BCP.
(i) In order to operate common requirements for the BCP and the standards ofgovernment agency consistently during normal operation, necessary reviews must
be conducted for the common procedures in information security measures.
(ii) In order to understand compliance requirements of information security measuresthat can prevent the BCP and standards of government agency from being
implemented in the case of failure and enable consistent operation, the proceduresfor failure handling must be formulated.
(3) Reporting inconsistency between the BCP and the information security rules[BASIC Requirements](a) In the case that there is any preparation plan for a BCP in the government agency and

it is difficult to determine whether a measure should be taken or not because ofinconsistent requirements between the BCP and the information security rules, theemployee must notify the relevant parties and, in order to receive further instructions,
report this to the information security officer using the reporting procedure for failure
handling which the head of information security officers has established.

- 72 -