Report of the Council of Expertson the Usage of Cloud Computing
by Financial Institutions

November 2014
The Center for Financial Industry Information Systems

Contents
Introduction ............................................................................................................................. 1
I. Characteristics of Cloud Computing.................................................................................... 3
1. Definition of Cloud Computing ........................................................................................ 3
2. Benefits and Risks of Cloud Computing ......................................................................... 4(1) Benefits ...................................................................................................................... 4(2) Risks .......................................................................................................................... 4
II. Basic Approach to Risk Management ................................................................................ 6
1. Establishment of Policies, Etc. for Cloud Computing Usage and Risk Management .... 6
2. Application of the Risk-Based Approach ........................................................................ 7(1) Overview of the Risk-Based Approach ...................................................................... 7(2) Examples ................................................................................................................... 8
1) Deciding Risk Management Measures ................................................................... 82) About Availability and Confidentiality ...................................................................... 93) Points to Consider ................................................................................................. 10
III. Specific Risk Management Measures .............................................................................. 11
1. Risk Management Measures ......................................................................................... 11(1) At the Use Examination ........................................................................................... 121) Selection of Provider (Due Diligence on Cloud service provider) ......................... 122) Data Residency ..................................................................................................... 13(2) On the Contract Signing .......................................................................................... 141) Agreement on the Service Level ........................................................................... 142) Information Disclosure by the Cloud service provider .......................................... 163) Outsourcing to Multiple Cloud service providers .................................................. 174) Re-Entrusting Management .................................................................................. 17(3) During Operations of Cloud Services ...................................................................... 191) Data Encryption, Etc.............................................................................................. 192) Failure/Replacement of Storage Equipment, Etc.................................................. 20(4) On Contract Expiry (or Termination) ........................................................................ 221) Data Erasure ......................................................................................................... 22
2) Vendor Lock-In ...................................................................................................... 22
2. Audits, Etc. of Cloud service providers ......................................................................... 24(1) On-Site Audits and Monitoring by the Client Financial Institution ........................... 24(2) The Client Financial Institution Entering the Cloud service provider's Facilities ..... 25(3) Third-Party Audits .................................................................................................... 27(4) Inspections, Etc. by Financial Regulators ............................................................... 28
3. Dealing with Incidents ................................................................................................... 30(1) Pre-Incident and Post-Incident Measures ............................................................... 30(2) Ensuring Traceability ............................................................................................... 30
Closing Remark .................................................................................................................... 31
List of Members and Observers of the "Council of Experts on the Usage of Cloud
Computing by Financial Institutions" .................................................................. 32iReference Materials ............................................................................................................. 34[Figure A] Usage Status of Cloud Computing ...................................................................... 34[Figure B] Results of Hearings by the FISC ......................................................................... 41[Figure C] Public Cloud Usage Examples ............................................................................ 42[Figure D] The Handling of Cloud Services Under the "FISC Security Guidelines"(Supplements to the 8th Edition).............................................................................. 48[Figure E] Definition of Outsourcing Under the Financial Services Agency's Supervisory
Guidelines ................................................................................................................ 49[Figure F] Risks That Should Be Considered for Usage of Cloud Computing by Financial
Institutions ................................................................................................................ 50[Figure G] Examples of System/Data Classification Based on Significance ....................... 52[Figure H] List of Risk Management Measures (Examples) ................................................ 53[Figure I] High-Confidentiality Data (Examples) ................................................................... 54[Figure J] Practical Guidance on Safety Management Measures for the Guidelines on
Personal Information Protection in the Financial Industry ....................................... 55ii

Introduction
Cloud computing may seem like a new term but is actually quite old. Eight years havealready passed since the term "cloud computing" began to be used in 2006, and cloudcomputing has become increasingly important as a base for IT services and solutions. Cloudcomputing is generally recognized to offer benefits such as cost reductions through the sharingof resources and economies of scale, speedy system delivery, and reductions in systemmanagement effort. In 2008, the U.S. government, as part of its basic strategy for IT
procurement and usage, introduced the Cloud First policy, which mandates the use of the public
cloud as the first option in order to sharply consolidate data centers, and many companies
around the world have followed this way of thinking. The use of cloud computing has also been
growing in Japan. In particular, when the Great East Japan Earthquake struck, the widespreaduse of cloud computing as the infrastructure for confirming the safety of loved ones and sharing
information led to the recognition of the fundamental benefits of cloud computing. As a result,the number of companies introducing cloud computing in various industries has grown sharply
in recent years. It can be thought of as a natural course of action for companies to reduce systemmanagement effort through the building of IT infrastructure by effectively making use of cloudcomputing and other outside resources, allowing them to strategically shift human resources tocore businesses.
The Center for Financial Industry Information Systems (FISC) began conducting full-scale
research of cloud computing in fiscal 2009. By looking at the status of cloud computing usage
by financial institutions, organizing the risks and taking other steps, it has periodically released
investigative reports.1 The results show that financial institutions are generally cautious about
using cloud computing, especially the "public cloud," in which multiple customers share
services. The main reasons cited include concerns about the protection of customer information
data and other aspects of information security, service reliability and concerns about laws andregulations. According to tabulated results (Reference Materials "[Figure A] Usage Status of
Cloud Computing") that are based on the survey "Study on Trends and Status of Security
Measures on Computer Systems for Banking and Related Financial Institutions," which the
FISC conducted in fiscal 2014, 16% of all financial institutions are actually using a public cloud,have plans, or are considering to use. A breakdown by type of business reveals that while manylarge banks and insurance companies are using public clouds, the percentage of usage is low
among small and midsize financial institutions.2
The use of cloud computing by financial institutions as a whole is growing. Reference
Materials [Figure A] shows changes in the overall usage of cloud computing (including thoseplanning and considering adoption), and reveals that the percentage has increased from about
20% in fiscal 2010 to 37% in fiscal 2013. Furthermore, of this number, the use of the public
cloud is also growing in many fields, mainly for front-end information systems (sales support
systems, e-mail, internal information sharing, e-learning systems, etc.). Separate hearings by
FISC found that we are starting to see widespread use of public clouds in operations that deal
with customer information, such as customer management (please refer to Reference Materials"[Figure C] Public Cloud Usage Examples").3
1

The results of research activities were published as the report "Issues and Outlook for Cloud Computing" in fiscal
2009, the research report "Notes Related to the Usage of the Internet and Cloud Computing During Reconstruction
From the Recent Disaster" and the report "Security Assurance and Outsourcing Management for Cloud Computing by
Financial Institutions" in fiscal 2011, and the research report "Trends and Issues for Regulation and Supervision of
Financial Institutions for Cloud Computing Users" in fiscal 2013.
2
Please refer to Reference Materials "[Figure B] Results of Hearings by the FISC." Hearings were also conducted on
the reasons that cloud computing is not being used, revealing such general issues as the handling of personal
information as well as such issues specific to financial institutions as control of cloud service providers, audits andinspections, and the handling of data after it has finished being used.
3
The effects of using the public cloud, as shown in Reference Materials [Figure C], include benefits of ordinary1Cloud computing technologies and services are constantly advancing, so more financial
institutions may actively use cloud computing in an effort to provide better financial services
and strengthen competitiveness. In order to promote usage of cloud computing in a soundmanner in Japan's financial industry, we believe that the parties concerned, including financial
institutions and cloud service providers, must have broad discussions about the benefits andrisks of cloud computing as well as appropriate risk management and contract management,
leading to a shared recognition and understanding.4
Based on awareness of these issues, the FISC established the Council of Experts on the Usageof Cloud Computing by Financial Institutions (hereinafter referred to as the "Council") inaccordance with an inquiry by the FISC President. The Council was comprised of members that
included academics and officials from financial institutions and cloud service providers as well
as observers from government agencies and other organizations. The Council discussed how
financial institutions of Japan can make the most of the potential of cloud computing
technologies after correctly ascertaining their characteristics and their risks, as well as properly
managing these risks. Furthermore, the Council considered what the best security measureswould be for supporting such efforts. The conclusions of the Council are outlined in this report.

cloud computing -- cost reductions, speedy system introduction, and improved convenience and functionality -- andthe strengthening of security, which has been considered a concern.
4
The FISC conducted a revision (Supplements to the 8th Edition) of the "FISC Security Guidelines on Computer
Systems for Banking and Related Financial Institutions" ("FISC Security Guidelines") in March 2013, creating[O-108] as standards for the usage of cloud services (Reference Materials "[Figure D] The Handling of Cloud
Services Under the 'FISC Security Guidelines' (Supplements to the 8th Edition)"). However, in this latest revision,
this matter was designated as an issue that will continue to be considered, with the document stating: "Cloud services
are advancing every day, and while there are such benefits as cost reductions and speedy introduction, cloud services
are expected to be used for important operations and are expected to entail risks exclusive to cloud services, therefore
this revision shall be considered a provisional document that deals with issues and problems that have become
apparent, and is in no way a final document."2

I. Characteristics of Cloud Computing
1. Definition of Cloud Computing
While there are various definitions and views of cloud computing, the Council has decided toadopt the definition given by the National Institute of Standards and Technology (NIST) of the
U.S., which is shown below ([Figure 1]).5[Figure 1] The Definition of Cloud Computing by the NIST
Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to ashared pool of configurable computing resources (e.g., networks, servers, storage, applications, andservices) that can be rapidly provisioned and released with minimal management effort or service
provider interaction.
Source: NIST "SP 800-145, The NIST Definition of Cloud Computing." Summarized by FISC.

The NIST classifies cloud computing into such deployment models as (1) "private cloud,"which is provisioned for exclusive use by a single organization, (2) "public cloud," which isshared by multiple users, and (3) "community cloud," which is shared by a specific group oforganizations. Of these, the Council discussed the "public cloud," which has more of a
resource-sharing characteristic than the others.6
Furthermore, it is natural to regard the use of a public cloud as outsourcing all or part of theadministration of information processing necessary for conducting business, i.e., system
operation, maintenance and development, to a cloud service provider. Therefore, the Council
has concluded that this should be treated as a form of "outsourcing," just as financial supervisors
in other countries do.7 Since financial institutions bear the final responsibility to customers andsettlement systems, they would not be able to avoid responsibility if the cloud service provider
that provides service to the financial institution causes a problem that results in a negative
impact on the customer or others.8

5Refer to The NIST Definition of Cloud Computing (Special Publication 800-145).
(http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)
6
As a general rule, the Council did not discuss anything other than the public cloud based on the view that theexisting framework for outsourcing management can be applied as is in many cases based on their characteristics such as the fact that the range of users of resources is limited to individuals or financial institutions - and due to thebelief that the results of this Council can also be applied.
7
The definition of outsourcing under the Financial Services Agency's supervisory guidelines (Reference Materials"[Figure E] Definition of Outsourcing Under the Financial Services Agency's Supervisory Guidelines") also statesthat it "includes cases in which banks outsource administrative work necessary to conduct their business (including
cases in which actual conditions can be considered equivalent to outsourcing despite the absence of an outsourcing
contract, and cases in which the outsourced work or other work is conducted overseas)."8
Some Council members argued that, "the public cloud can take the form of 'usage' instead of 'outsourcing,' so
perhaps risk management should be considered for approaches other than outsourcing." Financial institutions that use
cloud services still bear the responsibility for operations as a whole, so appropriate risk management on their part,such as ascertaining the actual conditions of cloud services, will be necessary.

32. Benefits and Risks of Cloud Computing
When considering whether to use cloud computing, it is important for financial institutions tofully understand the benefits and risks.

(1) Benefits
Some of the benefits of cloud computing are shown below in [Figure 2]. The various benefits
include: cost reductions, a decrease in system management effort, scalability and flexibility, andthe provision of business continuity.
[Figure 2] Benefits of Cloud Computing (Examples)
Cost reductions

System costs can be expected to decrease due to economies of scale under aresource-sharing scheme.

Quicker deliveries andshorter systemdevelopment periods

The time until service launch and system development periods can beshortened because the time needed for the introduction and configuration of
resources can be sharply reduced compared to when the users procure andconfigure their own IT infrastructure.

Reduction in system
operation effort

Users can reduce management effort by outsourcing system maintenanceand other operations to service providers.

Scalability/flexibility

Users are able to start small, use systems temporarily, withdraw immediately
and have other options, so this may help to reduce opportunity losses andsecure first-mover advantages.

On-demand self service

Users can control the usage and stopping of servers and other equipment on
their own, eliminating wasted usage of resources.

Improved convenienceand functionality

Users can enjoy a drastic improvement in convenience and functionality
because new technologies are introduced quickly. Furthermore, cloudcomputing has a high affinity with mobile devices, social networking
services, etc., which facilitates data exchange and information-sharing withthose inside and outside the company.

Business continuity

If the service is based on the usage of multiple resources that are
geographically dispersed, it would offer high business continuity in casesome facilities are affected by disasters or other conditions.

(2) Risks
Risk management specific to cloud computing needs to be considered because of various
unique factors, including the fact that cloud computing is a resource-sharing scheme and that
depending on the service, the relationship of contracts and responsibility becomes complex
since multiple cloud service providers will be involved. Examples of key risks that need to beconsidered for risk management are shown in [Figure 3] below (Details are outlined in
Reference Materials "[Figure F] Risks That Should Be Considered for Usage of Cloud
Computing by Financial Institutions").

4

[Figure 3] Cloud Computing Risks (Examples)
Risk

Category*

Details

Impact ofdifference in legal
systemsLegalsystem(3)

Differences in demands for the protection of privacy and otherfactors depending on the country (jurisdiction) could hampercountermeasures in the event that trouble occurs or for the transferof personal data.

Information
leakage risk

Technical(7)

There is a risk of remaining data leaking because of the difficultyof completing data erasure either by physically destroying or
degaussing hardware like disk media when the service ends.

Technical(8)

Unlike an on-premises environment, this framework is based on
the transmission of data over the network, which will cause abigger risk of data leaking during data transmission.

Concerns about
real time andavailability

Operation(11)

Increased traffic for other users could result in a shortage ofresources for processing one's own users, possibly leading to poor
response and system shutdown, so the expected level of service
may not be guaranteed.

Insufficient
incident handling

Governance(18)

Cloud service providers place weight on cost-saving and the quick
start of a service, so they may be reluctant to provide more thanstandardized user support. As a result, they may not disclose
information that users need for risk management or sufficiently
respond to any incidents.

* The numbers in the "Category" column correspond to the order of these risks in Reference Materials "[Figure F] Risks That
Should Be Considered for Usage of Cloud Computing by Financial Institutions."

However, depending on the cloud computing service type, all of the risks listed in Reference
Materials [Figure F] do not necessarily apply, and the degree of risk differs. When actuallyusing a cloud, one needs to carefully examine the service details and evaluate whether the risks
listed in Reference Materials [Figure F] exist as well as the level of those risks.
Furthermore, cloud technologies are constantly evolving, so while it is possible that somerisks may be reduced, new risks could also emerge. Risks related to cloud computing should be
re-evaluated in a timely and appropriate manner while keeping in mind that there may be
unknown weaknesses related to as-yet unrecognized technologies, new threats, changes in theexternal environment, including regulations and laws, and other factors.

5II. Basic Approach to Risk Management
Making Business Decisions Through a Risk-Based Approach
Cloud computing offers various benefits, as stated earlier, so financial institutions would be
able to reduce costs or quickly deliver new systems in line with any changes in businessconditions. However, there are risks, such as service shutdown due to system failure andbankruptcy of the cloud service provider as well as the leakage of customer information fromthe cloud environment, and if these risks materialize, they could have a major impact on manycustomers and the financial institution itself. For this reason, financial institutions must conduct
appropriate risk management by taking the characteristics of cloud computing into consideration.
Below is the basic approach to risk management involving cloud computing.

1. Establishment of Policies, Etc. for Cloud Computing Usage andRisk Management
Before a financial institution uses cloud computing, it is important for those involved - theexecutive or senior management and divisions concerned with the systems, users (businessdivisions, etc.) and system risk management - to understand and recognize the benefits and risksof cloud computing and then establish policies on a basic cloud computing usage or for risk
management, involving executive or senior management.
To that end, the financial institution should first decide the purpose of using cloud computing
and the scope of operations and systems that will switch to the cloud. In particular, a financial
institution that is considering cloud computing should fully examine internally, for example, (1)what operations and systems to realize with cloud computing based on the company's own IT
strategies, etc., (2) how much of those can be concentrated in a particular cloud service provider
or cloud service, and (3) how much of the remaining risks can be tolerated; and then decide theirappetite for risk and other matters related to cloud computing.
Furthermore, it is important for a company to clearly establish a companywide
decision-making process related to the introduction of cloud computing, and then permeate thisthroughout the company. For example, a situation that should be avoided is for a user division(such as a business division) to introduce cloud computing without the involvement andknowledge of the systems and risk management divisions, which could lead to the saving ofimportant data in locations outside of the company before the situation is noticed.
In addition, since cloud computing takes the form of "outsourcing," it would be preferable tocreate risk management policies, etc. for cloud computing by taking into account existing
policies and standards for outsourcing management. The effectiveness of risk management
measures in the risk management system should be reviewed periodically and changes should
be made if necessary.

62. Application of the Risk-Based Approach(1) Overview of the Risk-Based ApproachThis report's understanding of the "risk-based approach" is as follows.
First, the characteristics and significance of operations that will use cloud computing(including system processing) are analyzed and ascertained based on such criteria as system
availability and data confidentiality.9 In cases that important operations will be implemented byusing cloud computing, appropriately strict risk management needs to be implemented, but on
the other hand, for relatively less important operations that will use cloud computing, a financial
institution could decide to employ moderate risk management depending on the characteristics
and significance of those operations. It is important for financial institutions to employ this kindof "risk-based approach" to create appropriate risk management measures based on businessdecisions. A visual representation of this risk-based approach is shown in [Figure 4].
While there are cases in which the significance of operations and systems are evaluateddirectly based on such evaluation axes as availability and confidentiality, some financial
institutions will evaluate significance based on their own criteria (e.g., the type of data handled,
recovery time objective, and the range of impact in case of a system failure), and this could
result in the same decision as evaluating significance based on such evaluation axes asavailability and confidentiality. Each financial institution needs to decide the axes or criteria forevaluating significance based on their own risk management policy and other factors.
[Figure 4] Overview of a Risk-Based Approach[Axes/Criteria for Evaluating Significance][System Significance]
Evaluation Axes

Evaluation Criteria

Availability

High[Evaluation Criteria for
Significance]
Confidentiality- Type of data handled- Recovery time objective- Range of impact in case of
system failure- Range of usage- Etc.

[Level of Risk
Management Measures]
StrictMediumLow

Integrity

9

Moderate

Criteria other than availability and confidentiality for evaluating the significance and characteristics of operations
include data integrity (no altering or loss of data). While it is possible to evaluate significance comprehensively basedon multiple criteria, this could result in a highly complicated scheme, so in this chapter we used two criteria to keep
the discussion simple.

7

(2) Examples
1) Deciding Risk Management Measures
Actual examples of how to set the levels of risk management measures based on its
significance of systems under a risk-based approach are shown in [Figure 5] below.
Two examples are shown below for setting risk management measures. In the first example,
the significance of systems are evaluated based on both availability and confidentiality, which
are two axes that the systems require, and then risk management measures are set based on
significance. In the second example, the significance of systems is evaluated based on either
availability or confidentiality, and then risk management measures are set based on significance.
[Figure 5] Setting Risk Management Measures Using a Risk-Based Approach (Examples)
Example 1: Risk Management Measures Based on a Comprehensive Evaluation of Multiple
Axes (Availability & Confidentiality)
System SignificanceComprehensive
evaluation ofavailability &confidentiality

High (core IT fields)
Medium (semi-core IT
fields)Low (non-core IT fields)

Level of Risk Management Measures(e.g., audits)
Audits, etc. led by the financial institution are necessary
Audits, etc. led by the financial institution are necessary in
part
Audits, etc. led by the cloud service provider are adequate

Example 2: Risk Management Measures Based on an Evaluation of One Axis
System SignificanceHigh
Availability

Low
High

Confidentiality

Low

Level of Risk Management Measures(e.g., SLA for availability and data erasure for confidentiality)
Appropriate SLA that meets the financial Institute requirements on availability
and service level is necessary
Contract based on the standard service agreement presented by the cloud service
providerUpon termination of the agreement, irreversible physical or logical data
erasure10 is necessary
Data erasure is not necessary

a. Example of Comprehensive Evaluation
In [Figure 5], Example 1 shows cases in which the significance of systems is evaluatedcomprehensively by combining the availability and confidentiality axes, with the scope anddepth of risk management measures changing in accordance with the significance level. In thisexample, significance was grouped into three grades (high/medium/low) and levels were set for"audits, etc." (on-site audits and monitoring by the client financial institution and third-party
audits) based on the significance grade.
b. Example of Individual Evaluation
In Example 2, the significance level of systems (two stages of high/low in this case) is notevaluated comprehensively but rather based on either the availability or confidentiality axis,
with the scope and depth of risk management measures changing in accordance with thesignificance level. In the risk management items, the use of "SLA" is employed as an example
for the availability axis and "data erasure" is used for the confidentiality axis.
10

Regarding "logical data erasure," please refer to "III-1.-(4) [Figure 16] Logical Erasure of Data that Meets Certain
Conditions."

8

The matrix for the system significance levels of the "comprehensive evaluation" describedabove have been outlined in Reference Materials "[Figure G] Examples of System/Data
Classification Based on Significance." Usually, "core IT fields," in which system availability
and confidentiality are both high, have the highest significance and require strict risk
management. Meanwhile, "non-core IT fields" have low significance, so moderate risk
management may be sufficient. "Semi-core IT fields" fall in between the other two. This
classification into "core IT fields," "semi-core IT fields" and "non-core IT fields" is notstandardized, and they are listed here as reference so that each financial institution can decidesystem significance and risk management based on its own business characteristics and risk
management policies, etc. Therefore, some financial institutions may decide to set evennarrower fields. Furthermore, the levels for risk management measures for each field also are
not standardized, so financial institutions have discretion to decide these as well.
As examples for risk management measures, "audits, etc." (Example 1) and "SLA/data
erasure" (Example 2) were used above, but a more detailed list of ways to set risk management
measures is provided in Reference Materials "[Figure H] List of Risk Management Measures(Examples)." In this table, those risk management items that state "comprehensive evaluation"in the "standard" column are items in which risk management measures are set based on acomprehensive evaluation as described in a. above. Furthermore, those that state"confidentiality" or "availability" in the "standard" column are those that set risk management
measures based on an individual evaluation as described in b. above.
2) About Availability and Confidentiality
Systems that require high availability (high-availability systems) are assumed to be systems
that affect customers or transactions, such as core-banking systems and fund-settlement
systems.
Furthermore, data that requires high confidentiality (high-confidentiality data) likely includes
information that could have a large effect on business if leaked and trade secrets that must be
strictly managed under law (for specific examples, please refer to Reference Materials "[FigureI] High-Confidentiality Data (Examples)"). Based on the risk-based approach, systems that
handle "high-confidentiality data" could have some latitude in the level of risk management
required. Systems that include personal information would have high confidentiality, but
uniform risk management may not be required because of differences in the data characteristics,
data volume, the environment in which the data is handled, the expected impact of a data leakand other factors.
For example, a conference room reservation system may record the names of customers,
which are regarded to be confidential information. But one may be able to decide not to employ
strict risk management for that system based on the impact caused by leakage of that data,considering that the data is fragmentary.
Email systems also record names, but since this data is stored in a database and because
emails can contain personal information and other important information, a decision to require
strict risk management would be appropriate. However, if the user financial institution had
implemented rules prohibiting the entry of highly confidential information, including insider
information and credit card data in the bodies of emails and in attachments, and if these rules arebeing properly managed, then it may be possible to simplify the management level required forthe system provided by the cloud service provider, based on the view that a large portion of therisks are being managed by the financial institution side. Naturally, it may be possible for a large
portion of the risk management for email systems to be entrusted to cloud service providers, andfor cloud service providers to implement risk management measures such as those based on

9encryption technologies, which are mentioned later, with the financial institutions to examine
whether those measures are appropriate.
In this way, it is important to consider the risk management level by taking into consideration
in a comprehensive manner the risks associated with the data itself, internal management by thefinancial institution side, and measures implemented by the cloud service provider side.
3) Points to Consider
As stated above, Reference Materials [Figure G] shows examples of system significancelevels, or three fields (core IT fields, semi-core IT fields and non-core IT fields) in whichsignificance was determined based on the two axes of availability and confidentiality. Risk
management levels will usually differ between fields, as mentioned earlier, but one should also
keep in mind that risk management levels required within the same field are not determineduniformly.
For example, [Figure 6] is a simplified version of Reference Materials [Figure G], with theshaded areas basically considered "core IT fields." Among the core IT fields, "Core I" is a field
in which high risk management for both availability and confidentiality is required, "Core II" isa field in which high risk management is required for only confidentiality (requirement foravailability is relatively low), and "Core III" is a field in which high risk management isrequired for only availability (requirement for confidentiality is relatively low).

Confidentiality[Figure 6] Differences in Risk Management Levels within the "Core IT Field"
Availability
High
Low
High

Low

Core I

Core III

Core II
Requirement for confidentiality is low,
so a comprehensive decision can bemade not to require a strict evaluation
regarding confidentiality.

Management levels for each risk management item should be evaluated independently. For
example, systems defined as "Core III" in [Figure 6] are defined as core IT fields, but of the risk
management items in Reference Materials [Figure H], all the items for which a comprehensive
evaluation should be conducted based on both availability and confidentiality do not necessarily
require the most strict management (furthest on the left in the table) uniformly. In another example,
in the Due diligence of Cloud Service Provider at the use examination in Reference Materials[Figure H], the necessity for disclosure of detailed information regarding evaluation items related toconfidentiality is not that high.
Please note that Reference Materials [Figure G] and Reference Materials [Figure H] are justexamples of standards to employ when setting the ranges for simplifying risk management
based on the risk-based approach. Financial institutions should consider risk management
measures by using these reference materials and other information just as a reference.

10III. Specific Risk Management Measures
This chapter summarizes risk management measures from three viewpoints: (1) risk
management measures for the selection of cloud service providers and the ascertaining of actual
conditions for their systems and data, in addition to other activities, (2) verification of whether
cloud service providers are conducting effective management/operation in accordance with
contracts, SLA, etc. (through audits, etc. of cloud service providers), and (3) incident handling.
Regarding each risk management measure, the section "a. Management Measures" shows
examples of the application of strict, high-level risk management that is thought to be necessary
for processing extremely important operations (i.e., operations that require high availability or
confidentiality) via the public cloud. The section "b. Moderate Risk Management" lists
approaches for simplifying risk management based on the significance of systems andoperations.11[Figure 7] Overview of Risk Management Measures
Entrance Management

Settle policies
for cloudusage & risk
management

At the use
examination

On the contract
signing• Selection ofprovider• Data residency• Service level• Info disclosure• Multiple
providers• Re-entrustment
management

1.(1)Intermediate Management

Exit Management

During operations

On contract expiry(or termination)• On-site audits / monitoring• Third-party audits• Data erasure• Vendor lock-in

2.

• Data encryption, etc.
• Failure/replacement ofstorage equipment, etc.

1.(2)

1.(3)

Incident handling (before and after incidents)

1.(4)
3.

1. Risk Management Measures
When using cloud computing, systems and data are placed outside the company, so the range
and depth of information that can be ascertained directly by the user is narrow compared tosystems configured on-premise, which means that they are less likely to come under internal
governance. For this reason, when financial institutions use the cloud for very importantbusinesses, they should ascertain the actual conditions of cloud computing from various
viewpoints - e.g., the cloud service provider's job performance capabilities and risk management
system, the contents and level of services offered, and data residency - so that as much as
possible no portion remains as a "black box".
Below are details of risk management measures for each phase: (1) At the Use Examination,(2) On the Contract Signing, (3) during operations of cloud services, and (4) On Contract Expiry(or Termination).

11

In Reference Materials [Figure G], the examples for risk management measures for "core IT fields" are believed tocorrespond to "a. Management Measures" while those for "semi-core IT fields" and "non-core IT fields" are believed
to correspond to "b. Moderate Risk Management."11

(1) At the Use Examination
1) Selection of Provider (Due Diligence on Cloud service provider)
A public cloud service is a resource-sharing service based on the concept of "multiple users
enjoying cost benefits by using common functions," so if the actual functions and service levels
are not what the financial institution had expected before introducing the service, then it would
be very difficult to make changes later. For this reason, it is important for those considering the
introduction of cloud services to pay close attention and perform due diligence.
a. Management Measures
Risks should be analyzed and recognized from the viewpoint of such factors as theavailability and confidentiality required of operations that will be moved to Cloud and also fromthe viewpoint of company management. Then, after considering the risk management levels
required for those operations, a cloud service provider with sufficient ability to carry out therelevant services properly should be selected. At that time, it is necessary to perform due
diligence based on information about the cloud service provider's qualifications and job
performance capabilities, internal controls, and the status of risk management ([Figure 8]).12
Some cloud service providers are reluctant to disclose information before the signing ofcontracts, but one should consider seeking disclosure by signing a nondisclosure agreement inadvance if necessary.
Furthermore, since cloud computing is a relatively new technology, it may be difficult toacquire trustworthy information based on business histories, but it is important to evaluate acloud service provider from various angles by looking at such factors as service reputation andtrack record.
[Figure 8] Important Evaluation Items When Performing Due Diligence (Examples)
Track record and technological prowess involving operations expected to use cloud computing 13
Business continuity (corporate strength/profitability, human resource base, CEO's
capability/business strategy, and BCM/data backup in case of disasters)
3. Service availability, data security (protection of confidentiality), and integrity
4. Status of internal controls, risk management, etc. within the cloud service provider (including
re-entrustment management), and whether the cloud service provider has received external audits
and acquired various certificates
5. Stance regarding information disclosure
6. Policy towards acceptance of on-site audits
7. Data Residency (place where the data is stored or may be stored)
8. Ease of linking with existing systems, data migration to new systems, etc.
9. Support structure (support desk, response in case of failure [securing traceability, etc.])
10. Balance between expected damage (direct damage & indirect damage) in case an incident occurs
and the maximum compensation for damages offered by the cloud service provider
11. How the cloud service provider deals with the ending of usage (vendor lock-in risks, data
erasure, etc.)
12. When signing a contract that spells out that all or part of the handling of personal data will bedone by the cloud service provider, compliance with the "Standards for Selecting Outsourcing
Contractors Concerning the Protection of Personal Information" (please refer to Reference
Materials [Figure J]) as defined in section III of the "Practical Guidance on Safety Management
Measures for the Guidelines on Personal Information Protection in the Financial Industry."1.
2.

Note: The evaluation items listed above should be examined by fully taking into consideration the details and conditions stated in"III. Specific Risk Management Measures."12

In the case of a public cloud, which is a resource-sharing service, a cloud service provider may not comply withrequests from individual customers for changes to the contents of standard contracts, SLA, etc. Financial institutions
should confirm in advance if they will be able to negotiate such change requests for especially important matters.
13
Technological prowess would include such evaluation items as the cloud service provider's specialty regarding theoperations that will be outsourced by the financial institution and whether the cloud service provider conducts stabledevelopment/operations related to its business.

12b. Moderate Risk Management
When the significance of operations that will use cloud computing is not necessarily high, thefinancial institution may decide to simply conduct an objective evaluation by looking at a cloudservice provider's public information, reputation within the industry, track record, etc.
2) Data Residency
Some cloud service providers conduct operations and manage data using multiple data
centers located around the world. Depending on their policies, cloud service providers may bereluctant to disclose the location of their data centers, but financial institutions need to take into
account such factors as which country's laws would be applied in case of a dispute, or whether
business continuity would be affected in the event that local authorities seize data for theirinvestigation. In particular, ascertaining the location of data stored/being proceeded is evenmore important when outsourcing important operations.
a. Management Measures(a) During Normal Times
When conducting operations that require high availability or when processing/accumulating/storing highly confidential customer information, the client financial institution
needs to ascertain the region (country, state, etc.) to the extent that it can identify the laws thatwill be applied to the cloud service, by taking into consideration the possibility that local
authorities will browse data, or order submission of data, etc. Even in cases where the data isdispersed, it is necessary to ascertain in which country or region the data may be stored, for thesame reason.14(b) When an Incident Occurs or There is an On-Site Audit
When an incident such as an information leak occurs, the specific location of data centers orother facilities will naturally become necessary for inspections of those facilities. The same
holds true in cases in which the client financial institution needs to conduct an on-site audit.
(c) When Data is Stored Overseas
When data is stored overseas, costs and communication methods for on-site audits should beconsidered as shown in [Figure 9].
[Figure 9] Points to Consider When Data is Stored Overseas
Time/costs for on-site
audits of data centers

On-site audits could take a long time and personnel costs could become
high. For this reason, there may be many cases in which audits areoutsourced to local auditing firms.

Communication methods
when dealing with failure

In cases that a financial institution's personnel for dealing with failure haveinsufficient local language skills, then it becomes necessary to clarify inthe contract such matters as Japanese-language support and whether the
cloud service provider will set up a failure-support desk at its Japanesebranch.

b. Moderate Risk Management
Differences may arise in the necessity to ascertain location data and required detail of suchdata depending on the characteristics and significance of operations that use cloud computing.
From the viewpoint of risk profiles, when outsourcing operations that are not deemed important,
information about the data residency is not that important.
14

For mission-critical systems that require high availability and confidentiality, such as core-banking systems, theexact locations of data centers should be confirmed in order to ascertain their location status and other factors.

13

(2) On the Contract Signing
1) Agreement on the Service Level
A contract with a cloud service provider usually includes an SLA,15 but many standard SLAs
only offer a reduction of service usage fees if the actual uptime is lower than the specified
standard monthly uptime, for example. For this reason, the signing of contracts that include
standard SLAs may be insufficient for systems that require high uptime, such as online
processing for core-banking systems.
Cloud service providers have as clients not only financial institutions but companies fromvarious other industries as well. Cloud service providers can therefore sometimes be reluctant tosign separate SLAs based on the view that preparing contracts with different content for eachclient company is not efficient. Meanwhile, when financial institutions outsource especially
important operations, a high service level is required in light of the significance of theoperations to society. A financial institution may need to examine the contents of the contract,
SLA and SLO16 with the cloud service provider and request additional content depending on
the profile of the operations that will use cloud computing, in order to ensure sufficient service
level and risk management.
a. Management Measures
Contracts17 as well as SLAs/SLOs that are signed as necessary are recommended to include
the items listed in [Figure 10]. Naturally, financial institutions should consider adding orchanging items instead of simply using [Figure 10] as is, based on the profiles of theiroperations.

15

Service Level Agreement: an agreement between the service provider and the client financial institution regarding
the details and scope of the service provided as well as the required quality level (standard value or guaranteed
minimum value) or a document or contract that defines these matters. If the required quality level is not met, theservice provider may be liable to pay damages for incomplete fulfillment or nonfulfillment of its obligations.
16
Service Level Objective: a target set by the service provider for the quality of service. Target levels and target
values are set for performance, availability, data management, operations systems, support systems, security, etc. forservices provided as well as systems, equipment, etc. that comprise the service, and these targets are presented to theclient. If the targets are not achieved, the service provider is not immediately liable to pay damages like a contract or
SLA, but the service provider will be obliged to make efforts and improvements to achieve target levels and target
values. If the service provider does not meet these obligations appropriately, it may be liable to pay damages forincomplete fulfillment or nonfulfillment of its obligations.
17
Includes appendices and supplementary documents that are attached to the main contract.

14

[Figure 10] Items That Should Be Included in Contracts, SLAs and SLOs (Examples)1

2

3

Ordinary contract clauses (definition of terms, division of roles, areas of responsibilities, scope of
liability to pay damages in case of nonfulfillment of obligations, applicable law, court withjurisdiction, etc.)
Individual contract conditions (service contents, fees, duration, etc.), service specifications(resource allocation, etc. [necessary time for restricting or changing specifications, etc.]), andmanagement measures for data protection (data encryption, etc.)
Service level items(1) System operations: availability,

4
5

6
7
8
9

18

reliability, performance and scalability(2) Support: response to failure and response to inquiries(3) Data management: Mention of security of user data
(4) Control environment: Re-entrustment management (including further outsourcing),
protection of confidential information, and obligation to maintain a favorable control
environment
Response in case service level is not attained
Scope of information disclosure; obligation to cooperate with inspections, etc. by supervisors,etc.; acceptance of audits by financial institutions; operating rules for reporting, communication,etc. between service provider and user; and incident response
Assurance that there are no connections with anti-social forces and terrorist organizations
Return to original condition at end of use; obligation to cooperate with transfer to any new
system; and data return, erasure, etc.
Damages and compensation
Holder of intellectual property rights for products created while using applications running on thecloud service provider's resources (or percentage of ownership)

Note: The items listed above should be included in contracts/SLAs/SLOs by fully taking into account the contents and conditions
described in "III. Specific Risk Management Measures."b. Moderate Risk Management
The items listed in [Figure 10] are just an example of items that should be covered whenoutsourcing important operations to a cloud service provider. The contents and standard values
for each item could change depending on the significance and risk characteristics of theoperations that will be outsourced, and the necessity of each item could change as well. For
example, when outsourcing operations that are not important, all of the items above are notnecessarily needed, and the standard SLA that the cloud service provider usually presents toclients other than financial institutions may suffice. Or, it may be possible to sign just a standard
contract and not sign an SLA at all.

18

The evaluation of availability should cover (1) times the system shuts down due to failure, etc. and (2) scheduled
shutdowns for system upgrades/maintenance (including emergency security patches) and for improving thequality/security of the system, including the addition of new services. A point that should be noted is that for thesecond item, if the service is a public cloud offering global service, then scheduled shutdowns to implement
emergency security measures may not be implemented in accordance with an individual user's requests (work time,etc.) because precedence is given to the security of users as a whole. For this reason, it is important to confirm a cloudservice provider's policies and standards for scheduled shutdowns and emergency security measures.

152) Information Disclosure by the Cloud service provider
A financial institution bears important social responsibilities due to its operations, so in cases
where information is being (successively) entrusted, it needs to ensure the soundness andappropriateness of the operations. For this reason, when outsourcing operations, the financial
institution needs to acquire information about whether the cloud service provider can performtasks appropriately and the contents of its security management system before or even after
signing the contract, and then evaluate the cloud service provider appropriately based on that
information, in order to manage the cloud service provider. Meanwhile, it is expected that whena cloud service provider agrees to provide service to a financial institution, it takes into
consideration the important social responsibilities of the client and becomes accountable bycomplying with requests for the supply of information.
a. Management Measures(a) Specification of the Contents of Standard Information Disclosure in Normal Times
When a cloud service provider receives requests to disclose all sorts of information frommultiple client financial institutions, it could face an increased burden to respond to theserequests. For this reason, it is recommended to reduce the burden on the cloud service provider
by deciding in advance the scope of standard information disclosure through the contract, SLA,
etc., which would make it easier for the cloud service provider to comply with requests for
information disclosure from financial institutions. Some cloud service providers may bereluctant to supply information beyond what is normally disclosed because it needs to protect
the confidentiality of the information. But the contract needs to state that if a financial
institution requests the disclosure of information and provides a rational explanation why that
information is necessary, the cloud service provider will supply the information after discussing
the matter with the financial institution. If the information being requested is highly confidential,
then the two sides will need to sign a nondisclosure agreement before the information is
supplied.
(b) Information Disclosure When Risks Become Apparent
The contract or SLA should state that the cloud service provider will disclose information incompliance with requests from the financial institution regardless of whether the conditions in
section (a) above apply, in such cases as the occurrence of risk phenomena, when the risk of
information leakage has increased based on various materials, and when the cloud service
provider's internal controls have worsened.
(c) Dealing with Refusals to Disclose Information
There is a possibility that a cloud service provider will refuse a request for information
disclosure because information such as the architecture and specifications of cloud services islikely confidential information of paramount significance to the cloud service provider. A
financial institution needs to fully ascertain items that are connected directly with risk
management ([Figure 11]), so it needs to carefully consider whether to sign a contract with acloud service provider unwilling to disclose such information.
[Figure 11] Items Connected Directly with Risk Management(1) The flow from data input to storage, processing, backup, and output(2) Encryption format, and which areas are encrypted and not encrypted(3) Acquisition scope, acquisition frequency and retention period for system logs
(4) Acquisition content, storage location, and retention period for data copies (including
backups)16

b. Moderate Risk Management
If a determination is made that operations outsourced by a financial institution are notimportant, then there may not be a need to strictly request that a cloud service provider provide
detailed information about items connected directly with risk management. In this case, thecontents of standard information disclosure by the cloud service provider would be sufficient, so
it would not be necessary to request additional information.
3) Outsourcing to Multiple Cloud service providers
Cloud services are sometimes provided by multiple cloud service providers. In this case, one
should keep in mind that a performance bottleneck or failure in resources overseen by aparticular cloud service provider has a major impact on the quality of the entire cloud service.
What should be avoided is a situation in which when an incident occurs, each cloud service
provider does not assume responsibility and blames the other, resulting in delays in ascertaining
the status of the failure and implementing recovery measures.
a. Management Measures
In order to deal quickly with failures, it is necessary to decide on a business operator(hereinafter referred to as "main contractor") that acts as the single point of contact and handles
coordination between the cloud service providers, to clarify the responsibilities of the client
financial institution and cloud service providers, depending on the management capability of theclient financial institution. If the client financial institution is able to handle this role, a main
contractor could be optional.
b. Moderate Risk Management
A main contractor may not be necessary if a risk analysis concludes that a failure would only
have a limited impact or if a determination is made that a delayed recovery would have only anegligible impact.
4) Re-Entrusting Management
In order to ensure stable service and protection of information, it is important for a financial
institution to ascertain actual conditions and conduct appropriate risk management not just forthe cloud service provider to which it outsources operations directly but also providers to which
the cloud service provider re-entrusts ("sub-contractors").
a. Management Measures
Management measures described in [Figure 12] should be taken to ensure the soundoperations of sub-contractors.

17

[Figure 12] Management Measures for Sub-Contractors
Appropriate
advance screeningof sub-contractors• When outsourced operations are re-entrusted, it is necessary to conduct
appropriate advance screening of sub-contractors to ascertain the status ofre-entrustment and to exclude any inappropriate service provider. 19• If the cloud service provider's screening or management process of
sub-contractors are believed to be more effective than the financial
institution's, then the cloud service provider's advance screening20 could be
the best option.
Note: When re-entrustment operations that are especially important (core-banking systems,
systems that store highly confidential customer data, etc.), then the financial institution
should conduct the advance screening itself.

Clarification of
responsibilities,
including liability
for damages
Clarification of theobligations of the
sub-contractor

Halting of
re-entrustment

Clarify that if a sub-contractor causes a problem, it is responsible for a prompt
recovery in addition to being liable for damages within the limits of the clausedefining the cloud service provider's maximum liability for damages.
The contract between the financial institution and cloud service provider should
clearly state that any contract between the cloud service provider andsub-contractor should include clauses specifying that the sub-contractor bears
the same obligations, including those for reporting and ensuring internal
controls, that the cloud service provider has to the financial institution.
It is recommended to clearly state in the contract that the financial institution
can ask the cloud service provider to stop re-entrustment if, based on various
reports and other materials, there is reason to question the job performancecapabilities of the sub-contractor. If the cloud service provider does not comply
with the cancelation request, then the financial institution should consider
terminating service with the cloud service provider.

b. Moderate Risk Management
Depending on the operations that are re-entrusted, the client financial institution may be able
to simplify the risk management, including advance screening and everyday monitoring, for the
sub-contractor.21 This case could apply if the following conditions are met: (1) the operations
re-entrusted are not important, (2) the cloud service provider handles risk management,
including measures to fight cyberattacks and measures to deal with information leaks caused bya malicious insider, and (3) the cloud service provider handles emergency measures when an
incident occurs, including the acquisition and analysis of logs ([Figure 13]).

19

In cases that the financial institution conducts the advance screening itself, a possible scheme for improving theefficiency of the advance screening would be for candidate service providers for re-entrustment to be screened inadvance under an agreement between the cloud service provider and financial institution.
20
If a cloud service provider conducts advance screening of sub-contractors, this should be equal or greater in scopeand depth than a screening conducted by the financial institution itself, based on the financial institution's risk
management policy, etc. If these conditions are met, then advance reporting and approval of individual
sub-contractors (existing providers, addition of new providers and changes) are not necessarily needed.
21
The simplifying of risk management could include, for example, reducing the frequency and depth of check items(however, keep in mind that society demands strict handling of anti-social forces, etc.).

18

[Figure 13] Simplifying of Risk Management for Sub-contractors
Client financial
institution

Outsource operations(2) Risk management, including
information leaks countermeasure(3) Emergency response to incidents

Cloud service
providerModerate risk
management

Re-outsource

Sub-contractors(1) Re-entrustment of
non-important operations

The items "a. Management Measures" and "b. Moderate Risk Management" above can bereorganized as [Figure 14] below.
[Figure 14] Relationship between the Significance of Operations That Are Re-Entrusted
and the Party Conducting Advance Screening/Screening Level"a. Management Measures""b. Moderate Risk Management"

Especially important
operations

Non-important operations

Party conducting Financial institution or
Financial institution
advance screening cloud service provider

Financial institution or cloudservice provider

Important operations

Screening level

StrictModerate(3) During Operations of Cloud Services
This section will explain data encryption and management in the event of failure of storage
devices, etc., from the viewpoint of data management during operations of cloud services.
During operations, there is also a need to conduct monitoring and audits to check if the cloudservice provider is providing appropriate service, implementing appropriate risk management,
etc., based on the contract or SLA, but those issues22 will be discussed in "2. Audits, Etc. of the
Cloud service provider."1) Data Encryption, Etc.
The "FISC Security Guidelines" state that important data are recommended to be encrypted,
and that particularly in the case when personal data are stored, encryption, password setting, andother proper precautions should be taken to protect data contents from being read out even if
files are copied illicitly or stolen. In light of this description and the fact that overseas
regulations strongly recommend encryption,23 there is a need to consider more effective dataprotection measures. Furthermore, while encryption is one management measure, technologicaladvances could lead to the emergence of management measures that offer stronger data
22

The issues discussed will mainly be monitoring and on-site audits; such issues as the contents and methods ofmonitoring and audits (monitoring of uptime, receipt, verification, etc. of periodic operations reports) will not becovered.
23
For example, a law in the U.S. state of California (Senate Bill 1386: SB1386) and other laws require companies to
notify consumers if they believe there is a possibility that consumers' personal information has been leaked. However,they are exempted from this obligation if the "personal data" in question was encrypted. So while the "encryption of
personal data" is not mandatory, companies face tough information disclosure measures if data is not encrypted.

19

protection, so employing these new measures as an alternative should also be considered.
a. Management Measures
Data protection, including encryption, should include the management measures describedin [Figure 15] below.
[Figure 15] Management Measures for Data Protection
Encryption of
stored/transmitted
data

Such management measures as encryption should be employed for data that
includes highly confidential personal data or other sensitive information. To
ascertain the risk of data being observed at parts where encryption is
impossible due to specification restrictions (parts processed as plaintext),
financial institutions should ascertain the specifications of encryption ((1)
which parts are encrypted and which parts are not encrypted during
processing, (2) the encryption format, (3) management of the encryption key,etc.) and decide whether they match their own risk management policies.

Party managing theencryption key

The encryption key does not necessarily have to be managed by the financial
institution, but the measures 24 defined in [O-43] of the "FISC Security
Guidelines" are necessary. When management of the encryption key isentrusted to the cloud service provider, the financial institution should fully
ascertain the gist of the cloud service provider's risk management anddetermine if that matches its own risk management policy. Technologies are
now being offered that allow the client financial institution to store andmanage the encryption key. The use of solutions that are based on suchtechnologies would be effective to improve risk management.

Alternatives toencryption

Although encryption is an effective management measure, there are someconcerns, such as (1) the issue of management of encryption keys, as noted
above, (2) concerns about putting the original data on the cloud, and (3)concerns of performance degradation due to the need to repeatedly encryptand decrypt data as part of work processing through cloud computing. For
example, such technologies as tokenization -- in which the financial institution
holds the original data and token, and the data on the cloud is replaced withrandom numbers, effectively rendering the data meaningless -- may become
an alternative to encryption. However, if tokenization is employed as amanagement measure, then proper management measures would have to betaken for management of the token mapping table by the financial institution.
Note: Measures to prevent data from being read out following illicitly copied or stolen are notlimited to encryption and tokenization.

b. Moderate Risk Management
Encryption and tokenization are among management measures to protect customer data andother important data, so if data is not determined to be "important data" based on theconfidentiality of the information and risk profile, then the necessity for such management
measures as encryption and tokenization may be low.
2) Failure/Replacement of Storage Equipment, Etc.
When using cloud services, the cloud service provider sometimes will replace equipment orparts due to the failure, etc. of storage equipment. In that case, the storage equipment, etc. being
replaced may still contain highly confidential information, such as information about thefinancial institution or its customers. The financial institution should conduct proper
management for those storage equipment, etc., as well, including the erasure of data.
24[O-43] states: "Clarify the operation management method for the use of encryption keys."20

a. Management Measures
The following are management measures that could be taken for the failure and replacementof storage equipment, etc.
(i) Physical erasure (degaussing) or logical erasure (in case logical erasure cannot be
performed due to a failure of the moving parts, logic circuits, etc., then physicalerasure shall be performed) of data on the storage media that may have stored the data
in any storage equipment, etc. that was replaced.
Note: Regarding logical erasure, please refer to "(4) On Contract Expiry (or Termination) 1) Data
Erasure" below.

(ii) Properly perform physical erasure before the equipment is moved outside of the cloudservice provider's facility.
(iii) The contract, SLA, etc. clearly states that equipment is moved outside only after
irreversible erasure is performed.
Unlike steps taken at the end of the cloud service contract, which is mentioned later, thefailure/replacement of storage equipment, etc. during the contract period means that thefinancial institution can verify the effectiveness of the erasure/destruction process by requesting
information from the cloud service provider and through audits, etc. Considering this fact, theissuance and acquisition of data erasure completion certificates may not necessarily becost-effective.
b. Moderate Risk Management
When important data is not handled, erasure/destruction of data may not be necessary whenreplacing storage equipment, etc.

21(4) On Contract Expiry (or Termination)
1) Data Erasure
On the cloud service contract expiry, the data entrusted by the financial institution should be
erased in an appropriate manner and at an appropriate time. Management measures to ensurethat data is erased for certain should be implemented.
a. Management Measures
When the storage of confidential data is entrusted, the various system resources of the cloudservices are usually the assets of the cloud service provider, so it will likely be difficult for thefinancial institution itself to erase the data. In this case, one possibility would be for the cloudservice provider to perform the data erasure and issue data erasure completion certificate, etc.
Data erasure in this context refers to physical erasure or, logical erasure satisfying
predetermined (predescribed) conditions ([Figure 16]). Furthermore, in order to reduce theburden of issuing and acquiring separate data erasure completion certificates, the contract could
specify that the cloud service provider will perform data erasure, including logical erasure, on
the cloud service contract expiry, and verification of the appropriateness of the erasure process
by a third party could eliminate the need for data erasure completion certificates.
However, at present, logical erasure cannot be used to make the restoration of personal
information "impossible" (it can only make the restoration of information "extremely difficult"),
so from the viewpoint of further reducing information leak risks, the contract should clearlystate that the cloud service provider will perform "physical erasure" when replacing or removing
hardware in the future.
It is recommended that the timing of the data erasure be discussed with the cloud service
provider and clearly stated in the contract, given the possibility that even after the end of thecontract, the data entrusted to the cloud service provider will be used (as backup data) to deal
with such incidents as data leaks.
[Figure 16] Conditions under Which Logical Erasure of Data Would Be Allowable
Fragmented data

Full overwriting of thedata storage area
Destruction of theencryption key

Fragmented data is stored in the data storage area, and restoring personal
information and information about the client financial institution would be
extremely difficult from fragmented data alone. In this case, theinformation that links the data management area and data storage area
should be severed irreversibly.
A complete overwriting of the data storage area (with intentionally
meaningless data or other user's data).
If the stored data is encrypted, the encryption key should be destroyed.

b. Moderate Risk Management
If operations that do not handle customer data or other confidential information are entrusted
to the cloud service provider, then no data would be subject to the requirements forphysical/logical erasure. In this case, the data erasure process at the end of the cloud service
contract may be simplified or unnecessary, and a data erasure completion certificate will not benecessary.
2) Vendor Lock-In
If the programming language, services, etc. provided by the cloud service provider are fixed,
then it may be extremely difficult for the user to configure the cloud environment freely. The

22

financial institution is recommended to take steps in advance so that it can quickly switch to analternative cloud service, to an ordinary outsourcing arrangement, or to an on-premises
environment in the event that the cloud service provider violates the SLA or has difficulty
continuing the service contract due to any change in policy of the cloud service provider or
financial institution.
a. Management Measures
The client financial institution is recommended to make preparations for a system transfer
due to suspension or ending of the contract. The management measures for that situation are
described in [Figure 17] below.
[Figure 17] Management Measures to Reduce Vendor Lock-In Risks
Duty of cooperationof Cloud Service
ProviderInclude the following in the contract.
• The cloud service provider shall provide the client financial institution
with a method for extracting data that will be transferred to the new cloudservice provider or existing in-house system.
• The cloud service provider shall cooperate with the actual transfer work.

Advance knowledgeof transfer work

The client financial institution shall acquire knowledge of the method oftransfer data extraction and details of the actual transfer work before using
the cloud service.

Sharing of expense

The bearing of expenses for the transfer work should be specified in thecontract by envisioning various cases, including the cloud contract being
canceled by the financial institution or by the cloud service provider.

b. Moderate Risk Management
Measures to reduce vendor lock-in risks are recommended to be taken when transferring
important systems to the cloud, but in cases in which operations with low significance areoutsourced, then it may be sufficient for the financial institution to make preparations to switch
to an alternative provider without the cooperation of the initial cloud service provider. For
example, in the case of an IaaS (Infrastructure as a Service), in which only the computing
resources are outsourced, it may be possible to switch to another cloud service relatively easily
without the cooperation of the initial cloud service provider.

23

2. Audits, Etc. of Cloud service providers
The financial institution's management team even bears responsibility for the use of a cloudservice in which information that is used as a base for financial operations and the processes that
handle such information are entrusted to an outside company. For this reason, the effectivenessof risk management systems, etc. needs to be verified for cloud service providers, since they are
not easily managed directly with internal controls ([Figure 18]).
[Figure 18] Overview of Issues Regarding Audits, Etc. of Cloud service providers
Auditing firms, etc.

Financial regulators(3) Third-party audits(4) Inspections

Alternative(1) On-site audits, etc.

Client financial
institution

Cloud service provider(2) Examination visits

Sub-contractors(1) On-Site Audits and Monitoring by the Client Financial Institution
Since financial institutions are responsible for conducting proper job processing and need toappropriately manage customer data and other important information, when they outsource
work, they need to verify that the work being outsourced is being done appropriately. In casesthat the appropriateness of outsourced work cannot be sufficiently verified with information
submission requests alone, then the appropriateness should be confirmed by conducting on-site
audits, monitoring and other actions ("on-site audits, etc.") of the offices and data centers of thecloud service provider.25
a. Management Measures (Operation Method)
The operation method for onsite audits, etc. by the client financial institution is described in[Figure 19] below.

25

Some believe that allowing monitors and other personnel of the client financial institution to enter into thefacilities of the cloud service provider causes security issues and other issues for the many other client companies that
use the same cloud service provider, so there is a risk that this could negatively impact the safety and security of job
processing. However, many believe that rather than avoiding those risks, there is a stronger need to accept suchverification by users or their agents to confirm the soundness of job processing as a whole.

24

[Figure 19] Operation of On-Site Audits, Etc. by Client Financial Institutions
Specification of theright to conduct
on-site audits, etc.

The business consignment contract (Cloud Service Contract) should clearlystate that the client financial institution has the right to conduct on-site
audits, etc.

Alternative methods
for on-site audits, etc.

The financial institution should be able to ask a third party skilled in
conducting on-site audits, etc. to inspect the cloud service provider during
normal times instead of the client financial institution conducting on-site
audits, etc. directly. The conditions for this case are described later in "(3)Third-Party Audits."

Exercising the rightto conduct on-site
audits (Trigger andConditions)

When taking the operation format in which on-site inspections, etc. areconducted only when a third-party audit which is a substitute for on-site
audits, etc. cannot be conducted, or when it is determined that a third-party
audit cannot be depended upon, then the conditions for exercising the rightto on-site audits, etc. may be put in writing if necessary so that both theclient financial institution and cloud service provider can share anunderstanding on this matter.

Expenses forreceiving on-site
audits, etc.

The client financial institution and cloud service provider need to discuss inadvance how the expenses will be covered for the cloud service provider
receiving on-site audits, etc.

On-site audits, etc. of
sub-contractors

When important operations are re-entrusted, the contract between the client
financial institution and cloud service provider should clearly state that thefinancial institution has the right to conduct on-site audits, etc. of
sub-contractors.

Handling of issues
pointed out inon-site-audits, etc.

The contract should clearly state that regarding issues pointed out in on-site
audits, etc., the client financial institution and cloud service provider will
discuss countermeasures, including whether to implement them, as well as areasonable time period for implementing them.

b. Moderate Risk Management
When non-important operations are outsourced, then it may be possible to make use of"third-party certification" 26 reports that cover the items of on-site audits, etc. that areappropriate for the specific operations instead of on-site audits, etc. by the client financial
institution (or "third-party audits" mentioned later). Depending on the significance of theoperations, possible management measures include "third-party certification" reports preparedby the cloud service provider and security white papers.

(2) The Client Financial Institution Entering the Cloud service provider's Facilities
There are instances in which the client financial institution needs to enter the facilities of thecloud service provider other than those listed in "(1) On-Site Audits and Monitoring by the
Client Financial Institution" above.
a. Management Measures (Operation Method)(a) Visits to the Cloud service provider's Facilities before Signing the Contract or Starting
Service
26

Certifications of such standards as information security systems and privacy protection systems of companies bycertified public accountant institutes, industry groups and other organizations of various countries. Some well-known
ones include ISMS (ISO27001), PCI DSS Level 1, SOC1, SOC2, Auditing and Assurance Practice Committee
Practical Guidelines No. 86, IT Committee Practical Guidelines No. 7, and PrivacyMark.

25

A client financial institution has the need to seek on-site confirmation of processing and data
storage facilities as well as interviews with administrators to secure communication channels forthe future. The main purpose of these on-site studies is not to point out flaws in internal control
at data centers and other facilities. Whether these visits are allowed will depend on the cloudservice provider's policies, but a client financial institution conducting due diligence to select a
cloud service provider may take into consideration the cloud service provider's stance on
allowing visits and information disclosure.
(b) On-site Inspections When Incidents Occur
When incidents27 such as information leaks occur, or when they are suspected to haveoccurred, the cloud service provider should cooperate with the client financial institution's
investigation in order to determine whether damage has occurred and, if damage has occurred,
to fully ascertain the incident situation and specify a leak source or leak route. In cases thatusers and others conduct on-site audits to investigate serious incidents, cloud service providers
are recommended to comply with requests to submit evidence.
In cases that the cloud service provider fails to supply information, the client financial
institution judges that the cloud service provider was too slow to supply information, or there
are questions over the completeness of the information supplied, then an on-site audit by theclient financial institution itself or by a security firm or digital forensics firm designated by theclient financial institution will be necessary, and the cloud service provider should accept this.
Furthermore, it is recommended to clearly state it in the contract. In this investigation, theon-site inspector or the cloud service provider's operator acting under the instructions of theon-site inspector will operate the equipment to collect and analyze evidence (logs).
If the cloud service provider, due to its own policies, wishes to avoid receiving an
investigation in which the client financial institution's on-site inspector or personnel from thesecurity firm or digital forensics firm operates their equipment, then a tool will be necessary thatwill make it possible for the facilities of the client financial institution, cloud service provider orothers to extract information needed for analysis, in order to ensure traceability. In this case, an
independent third party will need to verify that this extraction tool works properly.
This kind of data extraction function may be supplied to the user as a part of theirapplications, but if it is not supplied or there is a problem with the completeness of the tool, thenan extraction tool will need to be developed and verified separately. In this case, the client
financial institution needs to agree with the cloud service provider at the time of contract
signing regarding the range of evidence collection (including evidence that normally cannot be
disclosed to the client financial institution because it involves the cloud service provider's otherclients) and the bearing of expenses for the development and verification of an extraction tool.
(c) When There Are Concerns That the Cloud service provider May Collapse
The contract should clearly state that when there are concerns that the cloud service provider
may collapse, then the client financial institution or a specialist that it designates can enter the
cloud service provider's facilities if necessary to protect customer data or related works andproducts.
b. Moderate Risk Management
Regarding operations that the financial institution determines are relatively less important,management measures considered cost-effective can be implemented. Entering the cloud service
provider's facilities may not be necessary if it is decided that risk management is possible
without doing so, such as when the cloud service provider prepared and supplied a data
27

In this case, "incidents" refer to incidents involving the operations that the client financial institution outsourced.
In the event that an incident occurred in portions involving other clients of the cloud service provider, depending on
the situation, this could be considered a case in which "an incident is suspected to have occurred in operations
outsourced to the cloud service provider."26

extraction tool.

(3) Third-Party Auditsa. Management Measures (Operation Method)
Assuming that there may be cases in which the client financial institution's on-site audits, etc.
will not be effective, it needs to consider conducting third-party audits instead. Below is asummary of the three conditions that would be required for third-party audits: "verification
items," "verifying party" and "verification flexibility."(a) Verification Items
If a third-party audit is conducted instead of on-site audits, etc. by the client financial
institution, then the verification items should include not just items typically related to systemrisks, but also take into consideration the cloud risk profile and meet the inspection needs of theclient financial institution.
Furthermore, if an audit of a cloud service provider is to be conducted after the client
financial institution has signed an audit contract with a third-party auditor on its own or jointlywith other financial institutions, the effective method would be to first examine the results ofaudits already conducted on the cloud service provider and then conduct an on-site examinationof the cloud service provider by focusing on points of uncertainty and missing verification
items.
(Audit Guidelines Related to Cloud Usage by the Financial Industry)
Risk management ought to be conducted by financial institutions on their own volition,and each financial institution should draw up audit guidelines and standards on its own by
being innovative and creative. But efforts to share and standardize audit viewpoints would
help to improve the effectiveness of cloud-related audits. Under these circumstances, the
FISC plans to revise the FISC Security Guidelines and the FISC Information System Audit
Guidelines for Banking and Related Financial Institutions based on this report. It is expectedthat these audit guidelines will be used by members of the industry, including third-party
auditors.
(b) Verifying Party
Taking into consideration the view that the client financial institution ought to takeresponsibility for conducting and leading audits, the measures described in [Figure 20] below
may help to ensure the independence of the cloud service provider or third-party auditor, or toprevent a decline in effectiveness due to the involvement of a third-party auditor whose
verification capabilities are not sufficient.

27

[Figure 20] Measures to Ensure the Independence of the Verifying Party and Prevent a
Decline in Effectiveness
Ensuring
independence

The client financial institution should be able to choose how to conduct an audit of
the cloud service provider by clearly prescribing in a contract, either by itself or
jointly with others, with a third-party auditor for audits of the cloud service provider.
The client financial institution should shift to a system in which it bears (or partly
bears) the expenses for third-party audits.
To avoid questions over the appearance of independence if the same auditor were to
conduct audits over an extended period, it would be preferable to change auditors
after an appropriate period.

Preventing adecline in
effectivenessAn effective way to improve the quality of audits would be to make use of anauditing scheme in which the liability for damages of the auditor is clearly stated in
the contract, as exemplified by SOC 2.28
To guarantee the competency of the third-party auditor, the auditor (auditing firm)should prepare and operate an appropriate quality management system based on theguidance and guidelines of the Japanese Institute of Certified Public Accountants andothers.

Ensuring
efficiency

An effective way to improve the efficiency of third-party audits would be formultiple financial institutions to jointly entrust audits to a third party.

(c) Verification Flexibility
It should be possible to conduct an emergency third-party audit to confirm the effect on theclient financial institution after such events as: (1) serious vulnerability related to cloudcomputing technologies becomes apparent, (2) an incident occurs at the cloud service provider
in an area related to another client, and (3) when an incident occurs at a different cloud service
provider.
b. Moderate Risk Management
Similar to moderate risk management described in "III.-2.- (1) On-Site Audits and Monitoringby the Client Financial Institution," when non-important operations are outsourced, it may bepossible to make use of "third-party certification" reports that cover the items of on-site audits,
etc. that are appropriate for the operations instead of third-party audits. Depending on thesignificance of the operations, possible management measures include "third-party certification"
reports prepared by the cloud service provider and security white papers.

(4) Inspections, Etc. by Financial Regulators29
Acting in the public interest, financial regulators examine the soundness of operations offinancial institutions, including outsourced operations. The cloud service provider has a legal
obligation to accept on-site inspections, etc. if requested by regulators. The items required of theclient financial institution and cloud service provider in regards to on-site inspections, etc. byregulators are described in [Figure 21] below.

28

A report on compliance and internal controls for business operations that mainly covers a service provider's
security, availability, processing integrity, confidentiality or privacy.
29
Includes requests for the submission of reports and materials.

28

[Figure 21] Items Required of the Client Financial Institution and Cloud service
providerObligation to cooperatewith inspections, etc.
by regulators

In order to ensure that on-site inspections, etc. by regulators go smoothly,
the contract between the client financial institution and cloud service
provider should clearly state that the cloud service provider has an
obligation to cooperate with on-site inspections, etc. by regulators.

On-site inspection, etc.
of sub-contractors

The contract between the client financial institution and subcontractor
should clearly state that sub-contractors (including service providers towhich operations are outsourced further) have an obligation to cooperatewith on-site inspections, etc. by regulators.

Handling of issues
pointed out due toon-site inspections, etc.

The contract should clearly state that improvement measures should betaken promptly to address issues pointed out due to on-site inspections,etc. by regulators.

29

3. Dealing with Incidents(1) Pre-Incident and Post-Incident Measures
Unlike incidents involving on-premises systems, anticipated incidents involving cloudcomputing include assets and data that are not under the full control of the financial institution,
so the countermeasures that should be taken will differ, depending on the situation. From theviewpoint of risk management, preparations (backups, arranging alternative service, etc.) should
be made in advance for dealing with expected incidents, and when an incident does actuallyoccur, measures such as detection and separation, data collection and analysis for incident event
analysis, elimination of the cause and a quick recovery, and drawing up measures to prevent
recurrences are important.

(2) Ensuring Traceability
Because a cloud is a virtualized and dynamically changing environment, if an incident suchas a failure or information leak should occur, it is possible that the work to identify the leaked ordamaged data or to investigate the cause could become more complicated. For this reason, thefinancial institution needs to make preparations to ensure traceability.
When an incident occurs, the financial institution bears the responsibility to extract thenecessary data, analyze it, and implement measures (or have others implement them). If it isunable to conduct the analysis on its own, then a security firm or digital forensics firm will doso on its behalf, and in this case there will be a need to enter the relevant facilities if necessary(regarding on-site investigations, please refer to "III.-2.-(2) The Client Financial Institution
Entering the Cloud service provider's Facilities" mentioned earlier).

30

Closing Remark
The environment surrounding financial institutions in Japan is changing at an unprecedented
pace, as exemplified by the diversification of products and services due to deregulation as wellas consolidation and realignment among financial institutions. Under these circumstances,financial institutions need to reform their operations and make business decisions more quickly,
such as understanding the needs of customers promptly and offering new financial services andproducts to differentiate themselves from other financial institutions. To do this, they need to beable to offer new products and services, enter or withdraw from businesses, or expand or
downsize operations at low cost and speedily, and it is expected that cloud computing can be aneffective tool to realize these objectives.
The Council discussed risk management for the public cloud, which has more of a
resource-sharing characteristic than other types of cloud computing. Risk management will bebased on the significance and risk profiles of operations and systems that will use cloudcomputing, and this report presents some examples and criteria for risk management measures.
It is also expected that the barriers preventing the use of cloud computing will be lowered byhaving financial institutions properly ascertain risks and implement appropriate risk
management measures based on the conclusions of the discussions by the Council.
Furthermore, in order for cloud computing to be used more effectively in the financial
industry, it will be important for the various stakeholders - including financial institutions, cloudservice providers and financial supervisors - to organically coordinate.
For financial institutions, as mentioned earlier, cloud computing is an effective tool for
realizing quick reforms of operations and speedy management, so it is important for them toconsider the use of cloud computing. Financial institutions looking to expand the use of cloudcomputing will work to improve risk management through such steps as creating systems thatallows them to deal flexibly with new risks that may emerge due to the constant advances incloud computing technology.
As for cloud service providers, they are expected to cooperate as much as possible with thefinancial institutions that outsource operations, such as by ensuring its auditability, disclosing
information to improve risk management, providing information related to traceability to
prepare for incidents, and supporting the work of financial institutions.
As for regulators and organizations that create voluntary rules and guidelines, it is expectedthat they will sequentially draw up regulations and guidelines that reflect actual conditions forcloud computing in line with the evolution of cloud computing technologies and changes in thelegal system.
The Council wishes that this report will help Japan's financial institutions create or revise
policies regarding cloud computing usage and risk management, and that it will help cloudservice providers draw up and implement the risk management measures necessary to provide
services to financial institutions.
--END--

31

List of Members and Observers of the "Council of Experts on the Usage ofCloud Computing by Financial Institutions"(Honorific titles omitted)

Chairperson

MasaruKitsuregawa

Members

Etsuya Shibayama
Jiro Kokuryo
Hiroshi Kamiyama
Katsunori Tanizaki
Hiroki Yonezawa
Nobuaki Nanchi
Tetsuya Koide
Satoshi Iitoyo

Shinji Nishiwaki
Keiji Sakagami
Akira Iwasaki
Hiroyoshi Watanabe
Hiroyuki Koike
Koichi Furukawa
Motoo Tanaka
Akira Maeda
Motohiko Nakamura
Observers

Makoto Koriyama
Hidekazu Shimura
Shinsuke Akasaka

Masahiro Uemura

Director General, National Institute of Informatics, Research
Organization of Information and Systems
Professor, Campuswide Computing Research Division, Institute ofIndustrial Science, The University of Tokyo
Professor, Information Technology Center, The University of Tokyo
Vice President, Keio University
Professor of Faculty of Policy Management, Keio University
Patent Attorney, Attorney-At-Law, Hibiya Park Law Offices
Managing Director, Sumitomo Mitsui Banking Corporation
Manager, Systems Division, Bank of Kyoto, Ltd. (Until the 3rd
meeting)
Tokyo Branch Manager/Tokyo Office Manager, Managing Executive
Officer, The Senshu Ikeda Bank, Ltd. (Starting from the 4th meeting)General Manager, Group Management Headquarters Group, IT
Business Process Unit, IT Business Process Planning Dept., The
Dai-ichi Life Insurance Co., Ltd.
Manager, IT Strategy Planning Dept./Executive Officer, Sompo Japan
Nipponkoa Insurance Inc. (formerly Sompo Japan Insurance Inc.)(Until the 3rd meeting)General Manager, IT Strategy Planning Dept., Sompo Japan
Nipponkoa Insurance, Inc. (Starting from the 4th meeting)Managing Director, IT Governance & Corporate Security Dept.,
Nomura Holdings, Inc.
Chief Customer Officer, Salesforce.com Co., Ltd.
Director and Head of Public Policy Japan, Amazon Japan K.K.
Vice President, GTS Cloud, IBM Japan, Ltd.
Member of the Board of Directors, Executive Vice President/Solution
Services, NTT Communications Corp. (Until the 3rd meeting)Senior Vice President, Cloud Services, NTT Communications Corp.
(Starting from 4th meeting)Senior Manager Chief Consultant¸ General System Department
Financial Project Management Unit, Hitachi, Ltd.
Certified Public Accountant Executive Board Member Information
Technology, The Japanese Institute of Certified Public Accountants
Supervising Inspector, Head of Information Technology Monitoring,
Inspection Coordination Division, Inspection Bureau, Financial
Services Agency
Director, Head of Computer System Risk and Business Continuity
Group, Examination Planning Division, Financial System and Bank
Examination Department, Bank of Japan
Director, ICT Security Office, Promotion for Content Distribution
Division, Information and Communications Bureau, Ministry ofInternal Affairs and Communications
Director, Office for IT Security Policy, Commerce and Information
Policy Bureau, Ministry of Economy, Trade and Industry

32

(The Center for Financial Industry Information Systems)
President
Executive Director

Tatsuo Watanabe
Tomoo Yoshida(Starting from the 4th meeting)Executive Director

Tadashi Nunami(Until the 3rd meeting)

Planning Dept.

Director General

Research Dept.

Director General

Masao Yoneyama(Starting from the 4th meeting)Takashi Arai
(Until the 4th meeting)Research Dept.
Director General
Security & Audit Research Dept. Director General
General Affairs Dept.
Director General

Yasuo Sakurai
Toshinobu Nishimura
Akinobu Saka(Starting from the 2nd meeting)General Affairs Dept.

Director General

Haruhiko Nakata(At the 1st meeting)◆ Administrative Staff
Ryuji Enoki,
So Ozawa (Until the 5th meeting),
Takeya Miyahara,
Shoichi Okada,
Koji Shinbayashi,
Shinichi Honda (Until the 3rd meeting)(REFERENCE) Dates of Council Meetings
1st meeting: April 14, 2014;
2nd meeting: May 16, 2014;
3rd meeting: June 16, 2014;
4th meeting: July 7, 2014;
5th meeting: Sept. 30, 2014;
6th meeting: Oct. 20, 201433

Reference Materials[Figure A] Usage Status of Cloud Computing── Created based on results of the "Study on Trends and Status of Security Measures
on Computer Systems for Banking and Related Financial Institutions" by the FISC
── Study base date: March 31, 2014── Valid responses: 698(1) Change in Cloud Computing Usage (Overall, Including Public, Community andPrivate)* The study did not differentiate between "planning/
considering use" and "currently using" for "public cloud".

50%
Planning/considering use[FY2013 Cloud Computing Usage]

40%
Currently using

Overall
Cloud

10.5%

30%
12.9%

PublicCloud

Planning/considering use

73

Currently using

186

Total

259

112

Percentage

37.1%

16.0%

(FY2012)(33.8%)

15.3%

*

20%
7.9%
26.6%

10%
13.0%

0%
(Responses)

2010
(749)

16.5%

2011
(740)

20.9%

2012
(743)

2013
(698)

FY

(13.5%)(2) Cloud Computing Usage Environment (Based on responses from 259
companies that indicated either "currently using" or "planning/considering use" [multiple
responses allowed])── In descending order for "public cloud" usage

1

Sales Support system

35

Community
cloud
8

2

Email

33

11

29

73

3

Intracompany information sharing

29

9

39

77

4

E-learning system

23

7

16

46

5

Website structuring

22

4

14

40

6

Schedule management

18

8

23

49

7

Server

17

8

32

57

8

Attendance management system

17

4

15

36

9

Personnel system

10

4

16

30

10

Accounting system

9

4

13

26

11

Welfare system

9

5

8

22

12

Backup system

7

7

20

34

13

General affairs system

7

6

9

22

14

Asset management system

6

5

17

28

15

System development management

6

2

9

17

16

Core business system

3

10

22

35

17

OA

3

3

18

24

Public cloud34

Private
cloud
38

Total
81

(3) Cloud Usage by Business Type (Ratio)[Overall, Including Public, Community and Private](Unit: %)No plan toCurrently Plan/cons use/consider
use
using
ider use

Business type

Valid
responses(companies)

Total

698

37.1

(26.6)

1

City banks, etc.

5

100.0

2

Trust banks

7

100.0

3

Regional banks I

63

4

Regional banks II

39

Using

No response(10.4)

60.2

2.7(100.0)(-)--(71.4)(28.6)--

66.7(42.9)(23.8)

33.3

-

66.7

(43.6)(23.1)

33.3-

5

Other banks, etc.

12

75.0

(66.7)

(8.3)

25.0

-

6

Shinkin banks, etc.

247

21.5

(8.5)

(13.0)

77.7

0.8

7

Credit cooperatives, etc.

68

7.4

(7.4)

(-)

91.2

1.5

8

Labor credit associations

13

-

(-)

(-)

100.0

-

9

JA banks

31

3.2

(3.2)

(-)

80.6

16.1

10

33

87.9

(84.8)

(3.0)

9.1

3.0

21

85.7

(76.2)

(9.5)

9.5

4.8

12

Life insurance companies
NonLife insurancecompanies
Securities firms

156

39.1

(32.1)

(7.1)

55.1

5.8

13

Credit card companies, etc.

3

100.0

(100.0)

(-)

-

-

11

[Public Cloud](Unit: %)No plan touse/consideruse

No response

16.0

81.2

2.7

5

40.0

60.0

-

7

57.1

42.9

-

Regional banks I

63

19.0

81.0

-

Regional banks II

39

20.5

79.5

-

Business type

Valid
responses(companies)

Total

698

1

City banks, etc.

2

Trust banks

3
4

Currently using, plan to use &considering using

5

Other banks, etc.

12

66.7

33.3

-

6

Shinkin banks, etc.

247

6.5

92.7

0.8

7

Credit cooperatives, etc.

68

1.5

97.1

1.5

8

Labor credit associations

13

-

100.0

-

9

JA banks

31

-

83.9

16.1

10

33

51.5

45.5

3.0

21

66.7

28.6

4.8

12

Life insurance companies
NonLife insurancecompanies
Securities firms

156

19.2

75.0

5.8

13

Credit card companies, etc.

3

-

100.0

-

11

35

[REFERENCE] Graph of Cloud Usage by Business Type (Ratio)[Overall, Including Public, Community and Private]
0%

10%

Total

20%

26.6

30%

40%

50%

60%

90%

100%

100.0

Trust banks

71.4

28.6

Regional banks I

42.9

4.8

19.0

Regional banks II

43.6

2.6

20.5

Other banks, etc.

Credit cooperatives, etc.

80%

1.4 9.0

City banks, etc.

Shinkin banks, etc.

70%

66.7
8.5 1.6

8.3

11.3

7.4

Currently using
Planning to use

Labor credit associations

Considering use

JA banks 3.2
Life insurance companies

84.8

NonLife insurance companies

76.2

Securities firms

32.1

9.5

7.1

Credit card companies, etc.

[Public Cloud]

3.0

100.0

(Sum of "Using," "Planning to Use" & "Considering Use")

0%

10%

Total

20%

30%

40%

50%

60%

70%

16.0

City banks, etc.

40.0

Trust banks

57.1

Regional banks I

19.0

Regional banks II

20.5

Other banks, etc.

66.7

Shinkin banks, etc.

6.5

Credit cooperatives, etc.

1.5

Labor credit associations

0.0

JA banks

0.0Life insurance companies

51.5

NonLife insurance companies
Securities firms

66.7
19.2

Credit card companies, etc. 0.0

36

80%

90%

100%

(4) Expected Benefits from Using Cloud Computing── All financial institutions were asked what they expect the benefits of cloudcomputing will be. A "reduction in system operation costs" was mentioned by
60.2% of the respondents, the highest number, followed by 50.3% that cited"flexible capacity." (Total of 698 respondents; multiple replies allowed.)
0

25

50

75

100

60.2

Reduction in system operation costs
50.3

Flexible capacity (networks, servers, storage, etc.)
43.1

Reduction in system development costs
34.1

Reduction in lead time until system introduction
21.5

Improvement in availability

18.6

Ease of system discontinuation
No response

8.7

Improvement in confidentiality

7.0

Others6.3(5) Concerns About Cloud Computing Use── All financial institutions were asked what concerns they have about using cloudcomputing. Concerns about "confidentiality (access management, encryption
management, etc.)" were mentioned by 71.3% of the respondents, the highest
number, followed by "handling of security accidents," which was cited by
59.7%. (Total of 698 respondents; multiple replies allowed.)
0

25

50

75
71.3

Confidentiality

59.7

Handling of security accidents
Business continuity of vendors

30.9

Uniformity of contract contents

30.7

Vendor's stance toward accepting audits

29.2

Regulator's inspection policies

27.8

Data residency

25.8

Long-term increase in costs through use
Availability

22.5
20.2

37

100 (%)

(6) Items that Financial Institutions Collected Information on as They Used or
Planned Use of Cloud Computing── Financial institutions using or planning to use cloud computing were asked whatitems they are collecting information on. Many items were mentioned by a large
percentage of respondents, including "initial/operating costs" and "examples of
introduction by other companies." (Total of 259 respondents; multiple replies
allowed.)
0

25

50

75
76.8

Initial/operating costs
69.5

Examples of introduction by other companies

64.5

Compatibility with own security requirements
Compatibility with own system requirements

59.1

Operations that will use cloud services

57.5
47.9

Soundness/business continuity of cloud vendor
Flexibility regarding other requirements (handling of audits, etc.)
Examples of failure at other companies

38

100

39.8
34.0

(7) Items that Financial Institutions Coordinated with Vendors as They Used or
Planned Use of Cloud Computing── Financial institutions using or planning to use cloud computing were asked whatitems they coordinated with vendors. "Handling of system failures" was mentionedby the highest percentage of respondents, followed by "contents of SLA" and "databackup," showing that there was a lot of coordination over service quality. Other
items cited by many respondents included "client's right to conduct on-site audits"and "requests to disclose data residency." (Total of 259 respondents; multiple replies
allowed.)
0

25

50

75
55.2

Handling of failures
Contents of SLA

47.1
44.0

Data backup
Client's right to conduct on-site audits

31.3

Requests to disclose data residency

30.5

Cooperation with inspections by regulators

29.3

Handling of re-entrustment

29.3

Data encryption

28.2
26.3

Requests for vendors to disclose information

39

(8) Reasons for Not Using/Considering Cloud Computing Use (Overall, Including
Public, Community and Private)── Financial institutions that are not considering or planning to use cloud computing
were asked the reasons why. "Concerns over using the service" was the reason thatreceived the most responses, and the percentage giving that response grew from theprevious fiscal year. (Total of 420 respondents in fiscal 2013; multiple replies
allowed.)
50%
43.3%
38.9%

40%

Do not think it is necessary
必要と考えていない
32.6%

30.2%

30%

Believe it is too early
時期尚早と考えている

32.1%
22.1%

28.8%
26.2%

利用を決める判断基準がない
Do not have standards for

23.5%

20%

deciding

12.3%

10%

サービス利用に対する懸念・不Have concerns about using
安がある
the service

10.0%(N=462)(N=486)(N=420)

2011
H23

2012
H24

2013
H25

0%

40

(FY)

[Figure B] Results of Hearings by the FISC
▽ Issues that are Unique to Financial Institutions
(1)

(2)
(3)

(4)

(5)
(6)

(7)

We have been taking sufficient security measures on-premise, and the system configured
in-house has been sufficiently cost-effective, so there are few benefits to using cloudcomputing at the current point in time.
Specific standards for security measures and system auditing guidelines for cloudcomputing use do not exist or are insufficient.
Financial institutions bear responsibility to conduct risk management even if operations
are outsourced to a cloud service provider, but we are unable to sufficiently control thecloud service provider because we have no choice but to accept the contract template
presented by the cloud service provider.
It is not clear if they will erase the data for sure when ending service. Also, there areuncertainties over whether the cloud service provider will cooperate with the work oftransferring to a new system.
It is not clear if the cloud service provider will cooperate with inspections of its facilities
by the Financial Services Agency under the Banking Act.
The cloud service provider will not comply with on-site audits. Also, regarding the resultsof third-party certification that were presented as an alternative to on-site audits, the audit
items are standard ones decided in talks between the cloud service provider and theauditing firm, and there is little room to include items that the client financial institution
would like to have checked.
Cannot use cloud computing for core-banking systems because the SLA for the cloudservice does not guarantee 24 hours/365 days availability.

▽ Ordinary Issues
(8)

(9)
(10)

(11)

(12)

It is not clear how personal data (or encrypted or fragmented personal data information) thatexists in the cloud environment will be handled under the Act on the Protection of Personal
Information.
There is a possibility that important data, including personal information, will be viewed bydomestic and foreign authorities.
Cloud service providers' stance on the disclosure of information is insufficient. More than a
few cloud service providers refuse to disclose information other than the prescribed items byciting anti-terrorism measures and the protection of intellectual property.
When considering use of the cloud to manage data, including personal information, we
asked about the specific encryption specifications and details about access control from theviewpoint of checking whether the confidentiality of the data is properly secured, but thecloud service provider refused to reply.
Many of the documents are in English. Also, there are many cases in which the Japanesebranch does not have the authority to reply to inquiries and requests, so we are concerned
whether the cloud service provider will properly deal with any problems that may arise.

41

[Figure C] Public Cloud Usage Examples
── Created using information provided by members of the Council(Domestic)(1) Sales Support Systems
SaaS,
PaaS
Business typeor
IaaS

Effects of introduction
Details of operations

Type of data inthe cloudCost
reduction

Speedyintroduction

Improved
More
convenience/ efficient
functionality operations

Notes

1

Bank

S

Corporate CRM

Borrower info,
Item info,
Activity log

2

Bank

S

Retail CRM

Customer info,
Inquiry info,
Product
application info○○

3 SecuritiesS

Ops for institutional
investors,
Global CRM

Customer info,
Negotiation
records○○

Improved customer service

4

S

Borrower info,
Corporate sales
Negotiation
compliance management
records○

Stronger compliance

S

Management of sales toaffluent clients

Customer info,
Item info,
Activity info

P

Agent management
controlAgentmanagement
info,
Solicitor info

Bank

5 Securities

6

Nonlifeinsurance

○

○

○

○

Stronger sales, flexible
customization

○

○

7

Life
insurance

P

Prospective customer
integrated database,
New corporate customer
Customer info
development using
face-to-face/Web
channels8LifeinsuranceS
P

Customer management,
Customer info,
Corporate sales support,
etc.
etc.

○

9

Creditcards

PPartner card applications,Customer info
Portal site building

○

○

42

Paperless○Improved productivity/
security by handling in thesystem fields that were nothandled in a system before

(2) Contact Centers & Help DesksBusiness type

Effects of introduction

SaaS,
PaaS
or
IaaS

Details of operations

Type of data inthe cloudCost
reduction

Speedyintroduction

1

Bank

S

Contact center operations

Customer info,
Inquiry info

2

Bank

S

Call center operations

Customer
response history,
Customer info

○

3

Life
insuranceS

Outbound call center
operations

Customer info○

4

Nonlifeinsurance

S
P

Contact history,
Call center, Sales activity
Materials
management, Sales
request info,
support back office, etc.
Phone log, etc.

○

○

5

Nonlifeinsurance

S

Agent system help desk○○

Improved
More
convenience/ efficient
functionality operations○

Agent info,
Solicitor info

○

Notes

○

○

○

Used to integrate prospective
customer databases andlinking information withoutbound call center
IT staff able to concentrate on
main business(3) In-House Information Sharing Systems
SaaS,
PaaS
Business typeor
IaaS

Effects of introduction
Details of operations

Type of data inthe cloudCost
reduction

1

Bank

S

Enterprise SNS

Comments on
SNS

2

Bank

I

Info sharing systemn/aSEnterprise SNS(No customer
info on cloud)S

Enterprise casemanagement, Fault
management

Employee info,
Internal rules,
Item info,
Fault
management,
Various inquiry
info

○

5

Nonlifeinsurance

P

Enterprise info sharing,
Various application
workflows, schedules,
etc.

Employee info,
Various
documents,
Customer info○

6

Nonlifeinsurance

S

Email, Calendars

Email data,
Activityschedules○

3 Securities

4 Securities

Speedyintroduction

Improved
More
convenience/ efficient
functionality operations

Stimulated exchanges within
bank

○
○

Notes

○

Disaster measures○

43

Stimulated communication
within company○

Stronger security

IT staff able to concentrate on
main business(4) Others
SaaS,
PaaS
Business type
or
IaaS
1

2

Bank

Bank

Effects of introduction
Details of operations

Type of data inthe cloudCost
reduction

Speedyintroduction

○

○

I

Workflow system,
Document management,
n/aIntegrated monitoring,Campaign sites, etc.

P

Investment trust
application management, Customer info,
Info sharing between
Product info
banks

○

○

Improved
More
convenience/ efficient
functionality operations

○

Notes

Roughly 37% reduction in
costs

Development of partner
financial institutions

3

Bank

S

Uncollateralized loan
screening applications

Customer info,
Credit info
(Number ofloans/balance atothercompanies)

4

Bank

S

Social listening

SNS, Blog

○

5

Bank

P

Management of budgets Item info,
with IT vendors
Budget info

○

6

Bank

S

Market integration
solutions

n/a

○

○

Operational risk
info, including
administrative
risks, systemrisks, lawsuit
risks

○

○

Cost reduction from existing
system (on-premises)○

Quick launch of application
management site

Confirmed reviews of own
products/services, Measured
effects of promotions,Improved product planning○

Broke free from Excel-based
management, More efficient
information sharing
Ensured security,
BCP measures

○

7

Bank

P

Management of loss
incidents for operationalrisks,
Tabulation by category

8Life
insurance

I

Risk calculation system

n/a

○

○

Easy verification of optimal
system configuration

9

Bank

I

Investment trust info
providing system

n/a

○

○

Released in 2 months,
including app development

10 Securities

I

Stock price delivery
systemn/a○○

11 Securities

I

Website load balancing
and video distribution

n/a

12

Life
insuranceP

Public web server

Corporate info,
Product info,
etc.

13

Life
insurance

S

Real estate management n/a

○

14

Bank

P

Project/budget
Project info,
management for systems Various
segment
documents○

P

Access control,
Intradepartmental
business support

16 InsuranceS
P

New-graduate
recruitment management, Various info,
Company vehicle
includingmanagement, asset
customer info
management

Nonlifeinsurance

S

Development
environment service

15

17

Bank

○
Configuration completed in 2
days○

Stronger security,
Disaster measures○○○

Employee info,
Investment
internal memo
info

○

○

n/a

44

○

○

Development productivity,
Paperless○Improved security

Built development
environment depending on
need, information sharing
within projects, etc.

(Overseas)(1) Sales Support Systems
SaaS,
PaaS
Business typeor
IaaS

Effects of introduction
Details of operations

Type of data inthe cloudＩ

Backup/recovery
solutions for front-office CRM info, etc.
CRM service

2

Bank(Europe)Ｉ

B2B transaction support
base, Use social
Customer info,
functions to find newTransaction info
borrowers and support
business promotion

3

Bank
(N
America)S

Business process
management

1

Bank(Europe)Bank(N
America)S
P

Customer management,
Info sharing, Itemtransfer/tracking, etc.

Customer info,
Employee info,
Corporate info

5

Bank
(N
America)S
P

Monitor/manage social
communications

Customer info

6

Bank
(Asia)S
P

Multi-channel services,
Fusion of sales andCustomer info,
services
Employee info
(cross-selling/up-selling)

I

More than 30% of
applications owned by
the Company

n/aLoan origination

Customer info,
Employee info,
Corporate info

8

Bank
(N
America)P○

Speedyintroduction

Improved
More
convenience/ efficient
functionality operations

Notes

○

Ensured solid security,
Ensured business continuity○

Solid security,
Ensure 24 hrs/365 days
availability & performance

Data related towholesalebanking
processes

4Bank
7 (Australia)

Cost
reduction○○○

Improved efficiency ofbusiness processes (Target:
10% increase in 1-2 years)○

Raised level of sales activities
while covering complianceand security,
Released apps at incredible
speed, Improved customer
acquisition rate by managing
leads and referrals, Improved
efficiency of managementlevel, Ensured and improved
security level○

Established social banking
hub,Real time responses
Contributed to profit growth,
Used advanced CRM,
Promoted smartphonebanking, Strengthened asset
management

○

○

45

○

Signed contracts at quadruple
the speed of industry average,
Expanded to small/midsize
companies, retail(1) Sales Support Systems (continued)
Business type

SaaS,
PaaS
or
IaaS

Effects of introduction
Details of operations

Type of data inthe cloudInsurance(N
America)S
P

Integrated portal,
Tracking customers'social activities

Bank
10
(N
America)S
P

Analyze trends of online Customer info,
customers
Corporate infoBank
(N
America)

S
P

CRM

Bank
12
(N
America)S
P

CRM, Banking platform
Customer info,
centering on end-to-end
Corporate info
and customersBank
13 (Australia)

SP

Put info collected via
phone and Web into thecloud

Customer info,
Corporate infoBank
(N
America)S
P

Mortgages

Customer info

S
P

Integrated customer(Customer info),
management (wholesale), Employee info,
Social communication, Corporate info,
Social marketing
Social info

9

11

14

15

Bank
(N
America)

Speedyintroduction

Customer info,
Corporate info

16

Insurance(Europe)

S
P

17

Securities(N
America)S
P

Investment customer
management, Customer
management, Mobile

I

Insurance purchaseapplication system○○

Realized linking of offers.
leads and products,
Offered end-to-end
comprehensive process thatspans business segments○

Standardized sales
techniques,
Full linking with core system
Achieved front office reformin 10 months,
Completed account opening
in 10 minutes instead of 1
hour

○

○

Access from multiple regions,
Cost reductions,
Legal compliance

○

○

○

○

Personal info

46

More efficient operations,Improved customer
satisfaction, Develop
prospective customers
Improved customer service
by being constantly
connected with customers via
multiple channels and social,
Better speed and response tochange○Investment
customer info,
Customer info,
Corporate info

Notes

Realized integrated portal for
10,000 independent advisors○

Customer info,
Corporate info

Customer management, Customer info,
Agent management,
Employee info,
in-house communication Corporate infoLife
insurance
18(N
America)

Cost
reduction

Improved
More
convenience/ efficient
functionality operations○

Built system that allows
better connections withcustomers, Full use of iPads,
Improved customer service,
Smoother in-housecommunication○

Unification of customer
service through investment
advisory ops, Customer
service using mobile
Configured system in thecloud while complying withsuch regulations and security
requirements as GLBA andPCI DSS(2) Contact Centers & Help DesksBusiness type

1

2

3

Bank
(U.S.)Bank(N
America)Bank(N
America)

SaaS,
PaaS
or
IaaS

Effects of introduction
Type of data inthe cloudDetails of operations

I

Analytic solutions for the Info on service
service desk
desk tickets

S
P

Unification of contact
point for inquiries
through integrated
customer portal,
Mortgage portfolio
managementS

Cost
reduction○

Customer info,
Regulation info,
Corporate info○

Customer info,
Employee info,
Corporate info

CRM,
Call center

Speedyintroduction

Improved
More
convenience/ efficient
functionality operations

○

Notes

○

Reduction in call volume &incident tickets, Improved
self-help capability of end
users

○

Unification of 17 types ofsystems,
Improved work efficiency of
20,000 core employees,
Smooth compliance withregulations,Introduction in 120 days
Building a system that unifies
and shares customer service
info allowing cyclic tracking
from initial lead, to contractconclusion, to the next
business (standardization ofsales process)○(3) Others
SaaS,
PaaS
Business typeor
IaaS

Effects of introduction
Type of data inthe cloudDetails of operationsBank
1 (Australia)

I

Transfer of more than
2,000
applications,n/aincluding mission-critical
ones

Bank
2 (Australia)

I

Re-construction
website3

Bank(Europe)I

Risk simulation system

of

Cost
reduction

Speedyintroduction

○

n/a

n/a

47

Improved
More
convenience/ efficient
functionality operations

Notes

○

○

Cost reduction of more than
60%○

Shortening of calculation
time (from 23 hours to 20
minutes),
Flexible resource use,
Server purchase became
unnecessary○[Figure D] The Handling of Cloud Services Under the "FISC Security Guidelines"(Supplements to the 8th Edition)[O-108] Risks should be managed appropriately when using cloud services.
1. When using cloud services, appropriate risk management is necessary in accordance withthe approach toward outsourcing management.
2. The following are some of the items that should be managed.
(1) Clarification of the purpose, scope, etc. when using cloud services [O-87](2) Clarification of the procedures for selecting the cloud service provider [O-87-1](3) Sign a contract that includes items related to security measures, regardless of theoutsourcing format [O-88]
The contract should include agreements on the boundaries of management andresponsibilities with the cloud service provider.
The following are some of the items that should be agreed upon.
1) Security management methods and framework [O-1 & 3]
2) Frameworks for system, data management for system, data management and network
management [O-4-6]3) Creation of manuals to deal with failures & disasters, recovery procedures andeducation/training [O-15, 63 & 83]
4) Backup of data for using cloud services [O-27]
5) Erasure of data when canceling or ending use of cloud services [O-75]*
Furthermore, a "risk management contract" may have to be signed separately from a"service usage contract," if necessary.
* For cloud services, system resources are usually the assets of the cloud service
provider, so it may be difficult for the financial institution, etc. to erase data on its own.
In that case, the cloud service provider may conduct the data erasure and provide a
certificate, etc. that states it has done so.
(4) The laws that apply in the event of a dispute with the cloud service provider, and a risk
assessment if the court with jurisdiction is in another country.
The following are some of the risks that should be assessed.
1) Ascertainment and analysis of local laws and regulations as well as judicial systems
2) Securing of attorneys qualified to practice locally3) Economic and human resource costs for conducting meetings, appearing in court andother activities in unfamiliar, remote locations4) Dealing with all of the above in a foreign language…Etc.
3. There is a need to conduct system audits of the cloud service being used to ascertain andevaluate its effectiveness, efficiency, reliability, compliance and security.
Please refer to [O-90 & 91] regarding system audits.
4. Regarding equipment standards, technological standards and operating standards in addition
to those for outsourcing management that are referred to in these guideline items, pleaserefer to those standards when necessary.
5. When the standards being referenced include the term "outsourcing contract," this should be
replaced with a "service usage contract," such as "usage contract" and "terms of service"when referencing the documents.

48

[Figure E] Definition of Outsourcing Under the Financial Services Agency's
Supervisory Guidelines
When a bank outsources its operations to a third party (hereinafter referred to as"outsourcing"), it may be able to not only improve the efficiency of its operations, but also
to deal with the diverse needs of its customers and respond quickly to rapid technologicalinnovations, for example, by outsourcing operations to a more specialized party. However,since a bank that outsources needs to protect its customers while ensuring sound andappropriate operations, including appropriate management of the risks that accompany
outsourcing, banks are legally required to take measures to ensure appropriate execution ofoutsourced operations (Article 12-2, Clause 2 of the Law; Article 13-6, Clause 8 of the
Enforcement Regulations).
…
(Note 1) Outsourcing includes a bank outsourcing any administrative work necessary to conduct its
operations to a third party (including cases in which an outsourcing contract was not officiallysigned but the actual conditions can be considered outsourcing, or when the outsourced operations
are conducted overseas).

<The rest is omitted>

49

[Figure F] Risks That Should Be Considered for Usage of Cloud Computing by
Financial Institutions
No.
(1)

Class
Risks related tolegal systems

(2)

(3)

(4)

(5)

(6)

(7)

(8)

(9)

Risks related totechnology

Risk
The effect ofauthorities
intercepting
communications or
taking enforcement
action against otherusers

Details• In the unlikely event that enforcement action is taken against
another user, there is a possibility that authorities will prohibitchanges to hardware in which the client financial institution's
own data is stored or seize that hardware, preventing the client
financial institution from processing the data or resulting in thecontents of the data becoming known to authorities.
• Similarly, if domestic or foreign authorities conduct
operations to intercept the communications or browse the dataof another user, then information related to the client financial
institution's data processing could be subject to interception
and other actions.
Impediment to on-site • On-site audits and inspections are difficult due to travel
audits by the client
expenses, time needed, etc.
financial institution • Foreign clients or foreign regulators may have difficulty
and inspections byconducting audits and inspections.
Japanese authorities
Impact of difference • Differences in demands for the protection of privacy andin legal systems
other factors depending on the country (jurisdiction) could
hamper countermeasures in the event that problems occur, orfor the transfer of personal data.
• If processing is dispersed across multiple countries(jurisdictions), the laws that apply may not be clear (privacy
laws and financial regulations are compulsory provisions, so it
may be difficult to designate the applicable laws through thecontract). In this case, in order to avoid legal risks, responses
should be made by assuming that the laws of the country(jurisdiction) with the toughest rules will apply.
Intelligence activities • Foreign governments may intercept communications lines oror data browsing by browse data within their jurisdictions for the purpose offoreign authorities
fighting terrorism, maintaining security or preventing tax
evasion.
Effects of attacks• Since data center facilities, processors, storage and networks
from the outside
are shared among multiple users, attacks against others usersthat share the infrastructure could have an effect on the client
financial institution.
Effects of• Unauthorized actions or operational mistakes by other users
inappropriatethat share the system could have an effect on the client
activities by otherfinancial institution.
users
Effects of difficulties • There is a risk of any remaining data leaking because of thein physical erasure of difficulty of complete data erasure by physically destroying or
datadegaussing hardware when the service ends.
Data leakage from• Unlike on-premises environments, this framework is based ontransmission routes the transmission of data over the network, which will cause abigger risk of data leaking during data transmission.
Ease of probing from • The fact that many components that comprise the system exist
the outside
on the network means that probing from the outside using
specialized technologies is relatively easy, so outsiders may beable to easily ascertain the full picture of the system
configuration.

50

No.
(10)

Class

(11)

Risks related tooperations

(12)

(13)

(14)

(15)

(16)
(17)

(18)

(19)

Risks related togovernance

Risk
Details
Effects of the network • Unlike when hosting in one's own building, the client
connection becoming financial institution cannot receive the service if the network
interrupted
connection is interrupted.
Concerns about real • Increased traffic for other users could result in a shortage oftime and availability resources for processing one's own users, possibly leading topoor response and system shutdown, so the expected level ofservice may not be guaranteed.
Effects of outsiders • On-site audits by the client financial institution or inspections
entering data centers by regulators could be affected if they take place at the sametime as on-site audits by other companies or inspections byregulators.
• The client financial institution's operations could be affected
if there are problems with on-site audits by other companies.
Problems with the• The cloud service provider could have problems withcloud service
processing jobs that straddle its service area due to requirement
provider's processing inconsistencies, insufficient coupling tests, etc.
of jobs straddling its
service area
Poor handling of• In case an incident occurs, cloud service providers may shiftincidents
the responsibility among each other, for example, hampering
the ascertainment of the current status and recovery.
Difficulty in viewing • The cloud service provider may be reluctant to disclose
items necessary for
information because it is using new technologies.
risk management• The system structure may be highly complex due toredundancy and dispersion of resources.
Vendor lock-in• Sufficient consideration may not have been taken for thesmooth transfer of data and systems at the end of service.
Inappropriate control • Users may have difficulty exerting direct control overenvironment at
sub-contractors to which cloud service providers outsource
sub-contractors
operations because sub-contractors have not signed contracts
directly with the user. As a result, users may not be able toensure a sufficient control environment at sub-contractors.
Difficulty in• Cloud service providers place weight on cost-saving andresponding tostarting services, so they may be reluctant to provide more than
individual needs
standardized user support. As a result, they may not disclose
regarding risk
information that users need for risk management or to handle
management
incidents sufficiently.
Effect of specification • Depending on the cloud service, there are cases in which not
restrictions for risk
enough consideration is given to "measures to deal withmanagement
information leakage risks," which is something that thefinancial industry is very interested in.

51

[Figure G] Examples of System/Data Classification Based on SignificanceExamples of systemclassification basedon availability
standards
Examples of dataclassification based on
confidentiality standards
High

High

Low

Systems that could affect customers/transactions• Core banking• ATM• Internet transactions• Settlements• Insurance claim payments• Order/contract processing• Administrative work at sales
offices• Insurance contract
management• Agent management

Info whose leakage is expected to have amajor impact
Info required by law to be protected,
including personal info and trade secrets
•
•
•
•
•

Info about customer assets & finances
Undisclosed info about the Company
Account numbers & PINs
Credit card numbers & expiration dates
Undisclosed info, including those related to
employees' privacy• Trade secrets• Listed company's insider info
• IDs/passwords• Customer names only
• Undisclosed corporate info that, if leaked,
would have a relatively small impact (e.g.,number of employees & names of senior
management)• Disclosed info
(Info publicized on websites, commercial
registration info & info on EDINET)• Published interest rates & stock price info

Low

Published info

52

Systems for in-house operations• Asset management• Profit management• Human resources & payroll• Accounting• Customer info management• Sales support• Email• Risk management• Website for conveying info
to customers in emergencies• Schedule management• In-house info sharing• Welfare• OA• System development
management• Website for transmitting info

[Figure H] List of Risk Management Measures (Examples)

On contract expiry(ortermination)

During operations

On the contract signing

At the use
examination

Risk management
itemsStandard*

Cloud service
providerselection

Comprehensive
evaluation

Data residency

Confidentiality

Service level

Availability

Information
disclosure

Comprehensive
evaluation

Outsourcing tomultiple service
providersComprehensive
evaluation

Sub-contractor
management

Comprehensive
evaluation

Data encryption,
etc.

Confidentiality

Failure/replacement ofstorageequipment, etc.

Confidentiality

Data erasure

Confidentiality

Vendor lock-in

Comprehensive
evaluation

On-site audits &monitoring by the client
financial institution

Comprehensive
evaluation

Entering of the cloudservice provider'sfacilities by the client
financial institution

Comprehensive
evaluation

Third-party auditsComprehensive
evaluation

Strict management←――――――――――――→

Moderate management• Evaluation of risk management status• Evaluation based not only on
based not only on disclosed info but also by disclosed info but also on reputation & • Evaluation based mainly on
asking the cloud service provider to disclose track record of the cloud service
disclosed info
undisclosed info
provider• Location region (country, state, etc.) should be ascertained,
specific enough so that the laws that will be applied to the cloud • Data residency is unnecessary if important data isservice will be known
not stored or processed• Location should be ascertained in cases that on-site access will
be necessary due to an incident occurring• Items necessary for risk management should be included in theoutsourcing contract or SLA/SLO• Customization of the standard agreement presented by• Customization of the standard agreement presented by thethe cloud service provider is not necessary
cloud service provider to match the financial institution's own
security policy• Request that the cloud service provider disclose info inaddition to the cloud service provider's standard info disclosure • Not necessary to request disclosure of information in
to match the financial institution's own security policy
addition to the cloud service provider's standard info
• Request disclosure of information about architecture as
disclosurenecessary for risk management• Clarification of the main contractor isnecessary• Clarification of the main contractor
would be recommended• Clarification of the main
contractor is not necessary• When re-entrustment operations that are not important, strict advancescreening is not necessary• Sub-contractors should be checked & monitored as needed• If the cloud service provider's advance screening is more effective, then that can be used instead of the financial
institution's(The financial institution itself should conduct advance screening if especially important operations will be re-entrusted)• Such measures as encryption arenecessary to protect highly confidential• For highly confidential info other thaninfo, including personal data, that is
personal data, such measures as• Protection using encryption, etc.
stored/transmitted
encryption to protect theis unnecessary when important• Storage & management of the encryption storage/transmission of data would be data is not being handled
key by the financial institution would berecommended
recommended• Physical/logical erasure of data stored on the storage media• Physical/logical erasure is unnecessary if important• Contract or SLA should clearly indicate that any storage
equipment will be turned into a state incapable of being restored data such as confidential personal info is not being
handledbefore it is moved outside of the facility• Strict advance screening & monitoring isnecessary• Physical erasure or irreversible logical erasure should be
conducted for important data, such as highly confidential• Physical/logical erasure is unnecessary if important
personal info
data, such as confidential personal data, will not be• Although the issuance of a data erasure completion certificate handled
would be recommended, this could be omitted if the contract• A data erasure completion certificate would also be
states that the data will be erased and the effectiveness of that
unnecessary
action can be confirmed through a third-party audit
of existence of a method• Request cooperation in extracting data that •ofConfirmation
extracting data for transfer• Select potential alternative cloudneeds to be transferred to the new service• Work to be done by the client
service providers in advanceprovider or to an in-house systemfinancial institution• The outsourcing contract should clearlystate that the client financial institution has
the right to conduct on-site audits to verify
appropriate management of the outsourced
operations• Under agreement, the contents of limited
operation of such audits should be put inwriting• The outsourcing contract should• Clearly stating the right toclearly state that the client financial
conduct on-site audits, etc. is notinstitution has the right to conduct
necessary
on-site audits• The results of third-party• On-site audits, etc. could be replaced certification or security whiteby using the results of third-party
papers could replace on-site
certification and adding the financial
audits, etc.
institution's risk profile• Request that the cloud service
provider promptly present log info
necessary for analysis when an incident• An on-site investigation is necessary when occurs, or have it prepare a tool for• On-site investigation or the
an incident occurs
extracting the necessary logs
of data when the cloud• When the cloud service provider is at risk • When the cloud service provider is at protection
service provider is at risk of goingof going bankrupt, its facilities should berisk of going bankrupt or if the steps
entered to protect data, etc.
outlined above are not possible, then it bankrupt are not necessary
will be necessary to protect data
through such steps as entering the cloudservice provider's facilities• Audit led by financial institution isnecessary• The use of third-party certification is • Third-party certification,• Third-party audits can be conducted if the possible if the verification contents are security white papers, etc. can beconditions of "verification items,"
sufficient based on the client financial
used instead"verifying party" and "verification
institution's risk profile
flexibility" are met.

* The main management axis that should be considered when deciding the appropriate level for risk management measures for each risk management item.
Availability: Risk levels should be decided mainly based on whether availability is high or low
Confidentiality: Risk levels should be decided mainly based on whether confidentiality is high or low
Comprehensive evaluation: A decision should be made by looking at both availability and confidentiality comprehensively

53

[Figure I] High-Confidentiality Data (Examples)Class

Data examples• Name, date of birth, sex and address• An individual's credit information• An individual's "sensitive information," such as illness history,
Personal information
religion and legal domicile• Account number/PIN, credit card number/expiration date andtransaction data
• Information regarding a company's creditworthiness• Insider information about a listed company, etc.
Corporate information
Note: Information that can be acquired by viewing a company's
registration, such as company name and capital, should betreated as "public information."
Information about the• Undisclosed information that, if leaked to the outside, could have an
client financial
impact on confidence in the client financial institution
institution
Information provided bypublic institutions, etc. • Information that, if leaked to the outside, could hurt the public
on the understanding
interest (inspection results by regulators, information aboutthat it would be kept
anti-social forces, etc.)
secret54

[Figure J] Practical Guidance on Safety Management Measures for the
Guidelines on Personal Information Protection in the Financial
Industry
III. "Supervision of Subcontractors" Under Article 12 of the Guidelines on Personal Information Protectionin the Financial Industry
Under Article 12, Clause 3 of the Guidelines, companies that handle personal information in thefinancial industry must, when outsourcing the handling of personal data, select a subcontractor that canbe recognized to handle personal data appropriately and ensure that the subcontractor is taking security
control measures for that personal data.
(Standards for Selecting Subcontractors in Regards to Protection of Personal Data)
5-1. When a company that handles personal information in the financial industry outsources the handlingof personal data, based on Article 12, Clause 3-1 of the Guidelines, it must set the items below asstandards for selecting the subcontractor, select the subcontractor in accordance with the standards, andperiodically review the standards.
(1) Creation of basic policies, handling rules, etc. regarding security control of personal data at
subcontractors(2) Creation of an implementation system for security control of personal data at subcontractors(3) Confidence in security control of personal data at subcontractors based on track record, etc.
(4) Soundness in management of subcontractors
5-1-1. Standards for the selection of subcontractors must include the following items as part of "Creationof basic policies, handling rules, etc. regarding security control of personal data at subcontractors."(1) Creation of basic policies regarding security control of personal data at subcontractors(2) Creation of handling rules regarding security control of personal data at subcontractors(3) Creation of rules regarding the inspection and audit of the status of handling of personal data at
subcontractors(4) Creation of rules regarding outsourcing by subcontractors
5-1-2. The standards for the selection of subcontractors, as part of the "Creation of an implementation
system for security control of personal data at subcontractors," must include systematic security control
measures under I.-(2)-1), human security control under 2) of the same clause, and technical security
control under 3) of the same clause. Furthermore, when the subcontractor outsources operations, thenstandards must be set regarding the status of implementation systems for security control at the
sub-contractors.
5-2. Companies that handle personal information in the financial industry must, based on 5-3, periodicallyor whenever the need arises, confirm compliance to the items set in the standards for subcontractor
selection after the outsourcing contract is signed, and if the subcontractor is not meeting the standards,
provide supervision so that the subcontractor meets the standards.
(Items Regarding Security Control that Should be Included in Outsourcing Contracts)
5-3. Companies that handle personal information in the financial industry must include in any outsourcing
contracts the items related to security control shown below.
(1) Authority regarding supervision and auditing of subcontractors as well as the seeking of reports(2) Prohibition of the leakage, theft, alteration or unauthorized use of personal data bysubcontractors(3) Conditions for re-entrustment(4) Accountability of subcontractors in the event that information leaks, etc. occur
5-4. Companies that handle personal information in the financial industry must, based on 5-3, periodicallyor whenever the need arises, confirm that the subcontractor is complying with security control
measures, and if the subcontractor is not meeting the requirements stated in the contract, provide
supervision so that the subcontractor meets the requirements stated in the contract. Furthermore,companies that handle personal information in the financial industry must periodically review the
security control measures included in the outsourcing contract.

55

Report of the Council of Experts on the Usage of Cloud
Computing by Financial Institutions
Published March 2015
Edited & Published: The Center for Financial Industry
Information Systems
4th Floor, Sumitomo Irifune Bldg.,
2-1-1 Irifune, Chuo-ku, Tokyo 104-0042
JAPAN
Phone:+81-3-5542-6060
Fax:+81-3-5566-1052
URL:
https://www.fisc.or.jp/
E-mail:infofisc@fisc.or.jp© This report may not be reproduced or copied in any form, in
whole in part, without permission from the publisher.

56