Standards for Information Security Measures for theCentral Government Computer Systems(Dec 2005 (General, First Edition))

Dec 13, 2005

Established by the Information Security Policy Council

Table of Contents
Chapter 1 General ................................................................................................................... 1
1.1.1 Positioning of Standards for Measures........................................................................ 1(1)

Positioning of these Standards for Measures on enhancement of Information

Security Measures for the Central Government Computer Systems ................................ 1(2)

Revising the Standards for Measures ................................................................ 1(3)

Complying with laws and regulations ............................................................... 1

1.1.2 How to use Standards for Measures............................................................................ 2(1)

Relationship of these Standards for Measures and Standards of Government

Agency .................................................................................................................... 2(2)

Scope............................................................................................................ 2(3)

Structure........................................................................................................ 3(4)

Itemized Measures ......................................................................................... 3(5)

Setting Security Levels ................................................................................... 3(6)

Evaluation Procedure...................................................................................... 4

1.1.3 Definition of Terms .................................................................................................. 5
Chapter 2 Building the Organization and System ...................................................................... 10
2.1 Introduction ................................................................................................................. 10
2.1.1 Establishing the Organization and System................................................................. 10
Compliance Requirements ........................................................................................... 10(1)

Designating the chief information security officer............................................ 10(2)

Designating the information security committee .............................................. 10(3)

Designating the chief information security auditors.......................................... 10(4)

Designating the information security officers .................................................. 10(5)

Designating the information system security officers........................................ 11(6)

Designating the information system security administrators .............................. 11(7)

Designating the division/office information security officers............................. 11

2.1.2 Separation of Roles ................................................................................................ 12
Compliance Requirements........................................................................................... 12(1)

Defining the roles that must not be undertaken by the same person.................... 12

2.1.3 Violation and Exceptional Measures......................................................................... 12
Compliance Requirements ........................................................................................... 12(1)

Handling the violations ................................................................................. 12(2)

Exceptional measures ................................................................................... 12

2.2 Operation .................................................................................................................... 15
2.2.1 Education for the Information Security Measures ...................................................... 15
Compliance Requirements ........................................................................................... 15(1)

Educating the employees about the information security measures .................... 15(2)

Participating in the educational programs on information security measures ....... 15

Contents - 1

2.2.2 Malfunction Handling............................................................................................. 16
Compliance Requirements........................................................................................... 16(1)

Advance Preparation for Possible Malfunction ................................................ 16(2)

Reporting and Taking Emergency Measures on Malfunctions ........................... 16(3)

Cause Investigation and to Prevent the Recurrence of Malfunction .................... 17

2.3 Evaluation ................................................................................................................... 18
2.3.1 Self-assessment of the Information Security Measures ............................................... 18
Compliance Requirements ........................................................................................... 18(1)

Formulating an annual plan for self-assessment ............................................... 18(2)

Preparing for the self-assessment ................................................................... 18(3)

Conducting the self-assessment...................................................................... 18(4)

Evaluating the result of self-assessment .......................................................... 18(5)

Making improvements based on the self-assessment ........................................ 18

2.3.2 Auditing the Information Security Measures ............................................................. 18
Compliance Requirements ........................................................................................... 19(1)

Formulating the audit plans ........................................................................... 19(2)

Instructing the information security audit........................................................ 19(3)

Formulating the detailed audit plans ............................................................... 19(4)

Requirements for the information security auditor ........................................... 19(5)

Conducting the information security audit....................................................... 19(6)

Reaction based on the results of the information security audit.......................... 20

2.4 Review........................................................................................................................ 21
2.4.1 Reviewing the Information Security Measures .......................................................... 21
Compliance Requirements ........................................................................................... 21(1)

Reviewing the information security measures.................................................. 21

Chapter 3 Measures for Information ........................................................................................ 22
3.1 Information Classification ............................................................................................. 22
3.1.1 Classifying the Information ..................................................................................... 22
Compliance Requirements........................................................................................... 22(1)Classifying the information ........................................................................... 22

3.2 Information Handling ................................................................................................... 23
3.2.1 Creating and Obtaining Information ......................................................................... 23
Compliance Requirements ........................................................................................... 23(1)

Prohibiting creation or obtainment of Information for non-business purposes ..... 23(2)Classifying the information on creation or obtainment and considering marking . 23

(3)

Labeling classification and marking ............................................................... 23(4)

Application of the existing, classification and marking..................................... 23(5)

Changing classification and marking .............................................................. 23

3.2.2 Usage of Information.............................................................................................. 23
Compliance Requirements........................................................................................... 24

Contents - 2

(1)Prohibiting usage for non-business proposes ................................................... 24(2)

Handling the information based on classification and marking .......................... 24(3)

Handling classified information ..................................................................... 24

3.2.3 Maintenance of Information .................................................................................... 24
Compliance Requirements........................................................................................... 24(1)

Maintaining the information based on classification......................................... 24(2)

Information Retention Period......................................................................... 25

3.2.4 Transfer of Information........................................................................................... 25
Compliance Requirements........................................................................................... 25(1)

Gaining approval and notifying of information transfer .................................... 25(2)

Selecting between transmitting and transporting the information ....................... 25(3)

Selecting the transfer means .......................................................................... 25(4)

Protecting the printed information.................................................................. 26(5)

Protecting the electronic records .................................................................... 26

3.2.5 Provision of Information......................................................................................... 26
Compliance Requirements........................................................................................... 26(1)

Releasing the information ............................................................................. 26(2)

Providing the information to others ................................................................ 26

3.2.6 Deleting of Information .......................................................................................... 27
Compliance Requirements........................................................................................... 27(1)

Deleting the electronic records....................................................................... 27(2)

Disposing the written documents ................................................................... 27

Chapter 4 Measures based on Clarifying Information Security Requirements .............................. 28
4.1 Information Security Functions...................................................................................... 28
4.1.1 Authentication Functions ........................................................................................ 28
Compliance Requirements........................................................................................... 28(1)

Introducing the authentication functions ......................................................... 28(2)

Identification code handling by employees...................................................... 30(3)

Authentication information handling by employees.......................................... 30

4.1.2 Access Control Functions........................................................................................ 31
Compliance Requirements........................................................................................... 31(1)

Introducing the access control functions ......................................................... 31(2)

Configuring Access control by the employees ................................................. 32

4.1.3 Administration Functions ........................................................................................ 32
Compliance Requirements........................................................................................... 32(1)

Introducing the administration functions ......................................................... 32(2)

Granting and managing identification code and authentication information ........ 32(3)

Applying an alternative measure for identification code and authentication

information ............................................................................................................ 34
4.1.4 Audit Trail Management Functions .......................................................................... 34

Contents - 3

Compliance Requirements........................................................................................... 34(1)

Introducing the audit trail management functions............................................. 34(2)

Obtaining and keeping the audit trails by the information system security

administrator .......................................................................................................... 35(3)

Studying, analyzing, and reporting the obtained audit trails............................... 35(4)

Notifying the users about audit trail management............................................. 35

4.1.5 Assurance Functions............................................................................................... 35
Compliance Requirements........................................................................................... 35(1)

Introducing the assurance functions................................................................ 35

4.1.6 Encryption and Performing Electronic Signature (including key management) ............. 36
Compliance Requirements........................................................................................... 36(1)

Introducing the functions for encryption and performing electronic signature ..... 36(2)Management of encryptions and electronic signatures ...................................... 37(3)

Using the encryption function or performing electronic signature ...................... 37

4.2 Threats to Information Security...................................................................................... 39
4.2.1 Security Holes ....................................................................................................... 39
Compliance Requirements........................................................................................... 39(1)

Building the information systems................................................................... 39(2)

Operating the information systems ................................................................. 39

4.2.2 Malware................................................................................................................ 40
Compliance Requirements........................................................................................... 40(1)

Building the information systems................................................................... 40(2)

Operating the information systems ................................................................. 40

4.2.3 Denial of Service Attacks........................................................................................ 41
Compliance Requirements........................................................................................... 41(1)

Building the information systems................................................................... 41(2)

Operating the information systems ................................................................. 42

4.3 Security Requirements of Information Systems ............................................................... 43
4.3.1 Security Requirements of Information Systems ......................................................... 43
Compliance Requirements ........................................................................................... 43(1)

Planning and designing the information systems.............................................. 43(2)

Building, operating, and monitoring the information systems ............................ 43(3)

Moving and disposing of the information systems............................................ 44(4)

Reviewing the information systems ................................................................ 44

Chapter 5 Measures for Components of Information Systems .................................................... 45
5.1 Facilities and Environment ............................................................................................ 45
5.1.1 The secure area where computers and communication equipment are located ............... 45
Compliance Requirements........................................................................................... 45(1)Managing entry and exit................................................................................ 45(2)Managing the visitors and delivery personnel .................................................. 45

Contents - 4

(3)Securing the computers and communication equipment.................................... 46(4)Managing security in the secure area .............................................................. 47(5)

Measures against disasters and malfunctions ................................................... 47

5.2 Computers ................................................................................................................... 48
5.2.1 Common Measures for Computers ........................................................................... 48
Compliance Requirements ........................................................................................... 48(1)

Installing the computers ................................................................................ 48(2)

Operating the computers ............................................................................... 48(3)

Disposing of the computers ........................................................................... 49

5.2.2 Terminals .............................................................................................................. 49
Compliance Requirements........................................................................................... 49(1)

Installing the terminals.................................................................................. 49(2)

Operating the terminals................................................................................. 50

5.2.3 Server Devices....................................................................................................... 50
Compliance Requirements........................................................................................... 50(1)

Installing the servers..................................................................................... 50(2)Operating the servers .................................................................................... 51

5.3 Application Software .................................................................................................... 52
5.3.1 Common Measures for Applications provided via Communication Line ...................... 52
Compliance Requirements........................................................................................... 52(1)

Installing the applications.............................................................................. 52(2)

Operating the applications............................................................................. 52

5.3.2 E-mail................................................................................................................... 52
Compliance Requirements........................................................................................... 52(1)

Introducing e-mail service............................................................................. 52(2)

Operating e-mail service ............................................................................... 52

5.3.3 Web ...................................................................................................................... 53
Compliance Requirements........................................................................................... 53(1)

Introducing the Web ..................................................................................... 53(2)

Operating the Web........................................................................................ 53

5.4 Communication Lines................................................................................................... 54
5.4.1 Common Measures for Communication Lines........................................................... 54
Compliance Requirements ........................................................................................... 54(1)

Building communication lines ....................................................................... 54(2)

Operating the communication line.................................................................. 55(3)

Disposing of the communication lines ............................................................ 55

5.4.2 Management of Communication Lines in the Government Facilities ........................... 56
Compliance Requirements........................................................................................... 56(1)

Building the communication lines in the government agencies .......................... 56(2)

Operating the communication line in the government agency............................ 56

Contents - 5

(3)Measures on the lines.................................................................................... 56

5.4.3 Connecting with Communication lines outside the Government Agency ...................... 57
Compliance Requirements........................................................................................... 57(1)

Connecting the communication lines inside the government agency and thecommunication lines outside the government agency .................................................. 57(2)

Operating a communication line inside the government agency which is connectedwith a communication line outside the government agency.......................................... 57
Chapter 6 Measures for Individual Consideration ..................................................................... 59
6.1 Information Security Measures for Procurement and Development.................................... 59
6.1.1 Purchasing the equipment, etc. ................................................................................ 59
Scope ........................................................................................................................ 59
Compliance Requirements........................................................................................... 59(1)

Establishing the mechanism to ensure information security in the government

agency ................................................................................................................... 59(2)

Following the procedures for purchasing the equipment, etc. ............................ 59

6.1.2 Outsourcing........................................................................................................... 59
Scope ........................................................................................................................ 59
Compliance Requirements........................................................................................... 60(1)

Establishing the mechanism to ensure information security in the government

agency ................................................................................................................... 60(2)

Establishing the Information Security Measures to be applied to the contractors . 60

(3)

Following the procedure to select the outside contractor ................................... 61(4)

Following the procedure to outsource works ................................................... 61(5)

Following procedures to terminate the outsourcing .......................................... 62

6.1.3 Software Development ........................................................................................... 62
Compliance Requirements........................................................................................... 62(1)

Establishing the system for software development ........................................... 62(2)Starting software development....................................................................... 62(3)

Designing the software ................................................................................. 62(4)

Developing the software ............................................................................... 63(5)

Testing the software...................................................................................... 63

6.2 Specific Restrictions ..................................................................................................... 64
6.2.1 Restrictions on Information Processing outside the Government Facility...................... 64
Compliance Requirements........................................................................................... 64(1)

Establishing the Security Measures ................................................................ 64(2)

Gaining approval, notifying, and management................................................. 64(3)

Implementing the Security Measures .............................................................. 65

6.2.2 Restrictions on Information Processing Using Information Systems Not Supplied by theGovernment Agency....................................................................................................... 66
Compliance Requirements........................................................................................... 66

Contents - 6

(1)Establishing the Security Measures ................................................................ 66(2)

Gaining approval, notifying, and management................................................. 66(3)

Implementing the Security Measures .............................................................. 66

6.3 Miscellaneous .............................................................................................................. 68
6.3.1 Preventing actions that lower the Information Security Level outside the Government
Agency ......................................................................................................................... 68
Compliance Requirements........................................................................................... 68(1)

Establishing the measures ............................................................................. 68(2)

Implementing the measures ........................................................................... 68

6.3.2 Consistent Operation with the Business Continuity Plan (BCP)................................... 68
Scope ........................................................................................................................ 68
Compliance Requirements........................................................................................... 68(1)

Understanding the preparation plan for a BCP in the government ...................... 68(2)

Ensuring consistency between the BCP and the Information Security Measures .. 68(3)

Reporting inconsistency between the BCP and the information security rules ..... 69

Contents - 7

Chapter 1 General
1.1.1 Positioning of Standards for Measures(1) Positioning of these Standards for Measures on enhancement of Information Security
Measures for the Central Government Computer Systems
In principle, each government agency must take its own responsibility for measures toensure information security. However, it is necessary to formulate a unified framework toprovide guidance on such measures and raise the level of information security in unison basedon the “Policy for Enhancement of Information Security Measures for the Central
Government Computer Systems (decision by the Information Security Council on Sep 15,
2005)” in order to enhance the information security measures across the board forgovernment agencies. These Standards for Measures will provide the standards for themeasures that each government agency should take to achieve information security and themeasures to further raise the level of information security in the unified framework.
(2) Revising the Standards for Measures
It is important to grasp the changes in circumstances appropriately and review the
information security measures in order to maintain an appropriate level of information
security. It is possible that what and how to add to or revise these Standards for Measures will
be known after each government agency uses these to formulate standards of government
agency and operation procedures in view of its characteristics and to evaluate its information
security measures. Also, it is possible that revising information security measures in theseStandards for Measures is required to be made in accordance with development of
information technologies.
With this in mind, these Standards for Measures shall be reviewed periodically and added
to or expanded in order to maintain their applicability in the future. Each government agency
must update standards for measures implemented by government agency appropriately whenthese Standards for Measures are revised.
(3) Complying with laws and regulations
How information and information systems should be handled is also formulated in laws
and regulations (hereinafter “relevant laws and regulations”). So, besides these Standards for
Measures, such relevant laws and regulations must be conformed to when information
security measures are taken. Because these relevant laws and regulations should be
conformed to regardless of the information security measures formulated, these Standards for
Measures do not specifically mention them. Also, the existing government decisions on
information security measures must be conformed to as well.

-1-1.1.2 How to use Standards for Measures(1) Relationship of these Standards for Measures and Standards of Government Agency

These Standards for Measures provide the standards for the measures that each government
agency should take to achieve information security and the measures to further raise the levelof information security. Each government agency shall review the current information
security rules as needed in order to achieve higher information security than provided for inthese Standards for Measures. Therefore, each government agency must not leave its
standards of government agency updated based on these Standards for Measures without
rational reasons. Each government agency must determine what to define in standards ofgovernment agency in view of its characteristics and update its standards of government
agency appropriately by referring to these Standards for Measures directly, and incorporating
the relevant contents of these Standards for Measures with or without modifications (structure,
expressions.)(2) Scope
These Standards for Measures shall be applied as follows:(a) These Standards for Measures are formulated for the purpose of protecting“information.” “Information” in these Standards for Measures means information thatis stored in the information systems and the electronic storage media outside theinformation systems, and information related to the information systems that is written
or printed on the documents. Unfinalized documents are also included within thisscope. Information written or printed on the documents can be documents containing
electronically recorded information (documents containing input information andthose containing output information of the information systems) and design
specifications of the information systems.
(b) These Standards for Measures shall be applied to the employees who handle
information and information systems. In these Standards for Measures, “employee”
means an employee who handles information and information systems unlessotherwise noted.
(c) In the Standards for Measures, “government agency” means Cabinet Secretariat,
Cabinet Legislation Bureau, National Personnel Authority, Cabinet Office, Imperial
Household Agency, Japan Fair Trade Commission, National Public Safety
Commission (National Police Agency), Defense Agency, Financial Services Agency,
Ministry of Internal Affairs and Communications, Ministry of Justice, Ministry ofForeign Affairs, Ministry of Finance, Ministry of Education, Culture, Sports, Scienceand Technology, Ministry of Health, Labor and Welfare, Ministry of Agriculture,
Forestry and Fisheries, Ministry of Economy, Trade and Industry, Ministry of Land,
Infrastructure and Transport, and Ministry of the Environment.

-2-(3) Structure
These Standards for Measures are composed of three levels – chapter, section and item.
These Standards for Measures organize information security measures into the chaptersof ”Building the Organization and System,” ”Measures for Information,” ”Measures based on
Clarified Information Security Requirements,” ”Measures for Components of Information
Systems,” and ”Measures for Individual Considerations,” and arranges the contents into
sections, then itemizes standards for the measures.
(a) “Building the Organization and System” describes organizational issues such assystem, evaluation procedure, breach, and exceptional measures and also clarifies
operational authority and responsibilities of employees so that the whole organization
can take information security measures.
(b) “Measures for Information” defines compliance requirements at each stage of theinformation lifecycle – creation, use, storage, transfer, provision, and deletion, andalso indicate the measures that employees must always take when they execute theirtasks to protect information.
(c) “Measures based on Clarified Information Security Requirements” explains security
functions such as access control to introduce into the information systems, and also
defines compliance requirements to prevent threats such as security holes, malware,and denial of service attacks in order to describe measures to take for the information
systems.
(d) “Measures for Components of Information Systems” defines compliance requirements
in order to describes measure to take for the information systems in view of theindividual characteristics and lifecycle of information systems such as computers andcommunication lines.
(e) “Measures for Individual Consideration” defines compliance requirements forindividual consideration that need specific attention in terms of information security
such as procurement, development, and information processing outside thegovernment facility.
(4) Itemized Measures
These Standards for Measures set compliance requirements for measures each government
agency should take by individual item.
(5) Setting the Level of Measures
The information security measures that should be taken are not single level because they
depend on the importance of the information assets or threats that exist. Also, the appropriate
strength in accordance with the characteristics of information systems and tasks for eachmeasure should be taken. With this in mind, these Standards for Measures have multi levelsof strength for each measure, and define compliance requirements to be taken. This level iscalled “the level of measures” and is formulated as follows:-3-

(a) “BASIC Requirements”: measures that should be taken as mandatory for the
information to protect and the information systems that handle such information.
(b) “ENHANCED Requirements”: measures that should be taken for especially important
information and the information systems that handle such information if eachgovernment agency considers them required after considering whether they are
required.
By following the above items, each government agency shall take measures that satisfy orexceed the BASIC Requirements. Each government agency must select an appropriate levelfor each compliance requirement after evaluation of the risks based on the characteristics of
the information systems and tasks.
(6) Evaluation Procedure
It is essential that information security measures are continuously feasible without delay
but not transient. Therefore, each government agency must confirm that the following
requirements are met based on these Standards for Measures by conducting information
security auditing periodically or as incidents arise.
(a) The standards of government agency conform to these Standards for Measures(confirming the compliance in design.)(b) Actual operations conform to the standards of government agency. (confirming thecompliance in operation.)(c) The standards of government agency are appropriate and efficient for the risks, or not
unfeasible (confirming the adequacy in design).
(d) Actual operations are appropriate and efficient for the risks (confirming the adequacyof operations).
Particularly, the most important purpose of information security auditing at eachgovernment agency is to achieve compliance in design and operation. In the case that any
improvements that it believes necessary in terms of adequacy of design (formulating) andoperation (implementation) are found in the course of the auditing, it is desirable to put it on alist of concerns. In these Standards for Measures, compliance requirements are formulated
along with the person who should execute the tasks. So, each employee shall conduct a
self-assessment of how well the measures are taken based on his or her role. It is essential foreach employee to fulfill his or her role to implement information security measures andconducting self-assessment helps to operate with adequate measures. To achieve this goal,
each government agency shall grasp how well the measures are implemented by conducting
an auditing as to whether the self-assessment is adequate and how well the measures are
implemented.
In principle, each government agency must take responsibility for implementing its own
information security measures. However, in order to promote information security measures
for government agencies across the board, it must report to the National Information Security
Center about how well the measures are implemented and the results of auditing. Then,-4-

National Information Security Center will inspect and evaluate how well the information
security rules for each government agency are formulated and measures are implemented
based on the evaluation metrics formulated in these Standards for Measures periodically or asneeded. The scope of applicable information systems shall be discussed and determined by
the National Information Security Center and each government agency.

1.1.3 Definition of Terms
z
z

z
z

z

z

z

z
z

z
z
z

“Access control” means to restrict objects to which a subject is allowed to have access.
“Secure area” means the inside of an office or a server room in which computers andcommunication equipment are located, where the measures against information security
violations caused by outside hackers and disasters are implemented physically andenvironmentally.
“Contractor” means a person who undertakes all or a part of the processing tasks on
information systems such as planning, development, maintenance, and operation.
“Delivery personnel” means a person whose purpose is to receive or pass items toemployees working in a secure area and who does not need to enter the secure area. Suchexchanges of items can occur in courier services and delivery of office equipment, etc.
“Outsourcing” means to order all or a part of the processing tasks on information systems
such as planning, development, maintenance, and operation to the personnel outside thegovernment agency.
“External storage media” means a storage device that can be removed from an information
device (magnetic tape, magnetic disk, optical disk, cassette, MO, floppy disk and USB
memory, etc.)“Availability” means to have a status in which a person who is allowed to accessinformation can access the information and the related assets without being interrupted
when he or she needs to do so.
“Availability class-1 information” means the information that is not availability class-2
information (except written documents.)“Availability class-2 information” means the information that is handled in the tasks of thegovernment agency (except written documents) and can infringe citizens’ rights or have an
impact (except minor ones) on the stable operation of the government agency if damaged,
lost, or made unavailable.
“Integrity” means to have a state in which information is not damaged, altered, or deleted.
“Integrity class-1 information” means the information that is not integrity class-2
information (except written documents.)“Integrity class-2 information” means the information that is handled in the work of thegovernment agency (except written documents) and can infringe citizens’ rights or have an

-5-

z
z
z
z
z
z

z

z

z

z
z
z
z
z

z

impact (except minor ones) on accurate operation of tasks of the government agency ifaltered, wrongly described, or damaged.
“Equipment, etc.” means information equipment and software.
“Confidentiality” means a state in which only a person who is allowed access can accessthe information.
“Confidentiality class-1 information” means the information that is not confidentiality
class-2 information or confidentiality class-3 information.
“Confidentiality class-2 information” means the information that is handled in the work of
the government agency but is not confidential or supposed to be published.
“Confidentiality class-3 information” means the information that is handled in the tasks ofthe government agency and is not confidential.
“Employee” means a person who works under the direction of a legal employee and eachgovernment agency and handles information and information systems managed by thegovernment agency.
“Shared identification code” means an identification code that is shared by multiple
subjects. In principle, a single identification code is granted to a single subject; however, it
can be shared by multiple subjects if there are any restrictions on the information system orin consideration of how they are used. Such an identification code is called a shared
identification code.
“Administration” means to manage the granting of information for authentication(including identification code and authentication information) and the granting of
information for permission of access control.
“Announced security hole” means a security hole that can be known to everyone andincludes one announced by software or hardware manufacturer and vendors and one
announced by security-related organizations such as the JPCERT Coordination Center.
“Service” means a set of functions that is composed of a single or multiple functions
provided to the connected computer by an application running on a server.
“Least privilege” means a function by which a person who is granted an identification codewith administrative rights can use it only when he or she executes the administrative task.
“Identification” means to identify the subject that accesses an information system.
“Identification code” means a code that an information system recognizes to identify the
subject. A User ID is a typical identification code.
“Subject” means a person who accesses the information systems or other information
systems and a device. A subject is supposed to be human in principle; however, otherinformation systems and devices can be subjects when multiple information systems anddevices work in coordination.
“Authentication” means to verify whether the subject that presents an identification code islegitimate or the one that is granted the identification code. The information system
recognizes the subject as legitimate if the identification code and authentication

-6-

z
z

z

z
z

z

z
z

z
z
z

z

information are presented in a correct way and authentication is successful. Though being“authenticated” means to be proved officially or by a third party, ”authentication” in theseStandards for Measures does not always mean such proof.
“Authentication information” means information that a subject presents to an information
system in order to become authenticated. A password is typical authentication information.
“Authentication information storage device” means a device that stores authentication
information so that a legitimate subject can own or hold it. In the case that anauthentication method based on ownership is used, the information system recognizes the
subject as legitimate if it has this.
A magnetic tape card and IC card are typical authentication information storage devices.
“Standards of government agency” means the information security policies that eachgovernment agency defines; they are basic policies of information security measures andinformation security standards that are applicable to all information assets.
“Information system” means a computer system that provides information processing andcommunications.
“Information security rules” are the standards of government agency and the operation
procedures that provide step-by-step instructions on how to execute the measuresformulated in the standards of government agency in specific information systems andtasks.
“Information transfer” means to transmit electronically recorded information and totransport external storage media, PCs and written documents that contain information
outside the government facility.
“Legal employee” means an employee who is designated to execute administrative tasks byappointment.
“Software” means procedures and orders to operate a computer that are written in a form
that computers can understand. An operating system and applications running on theoperating system can be viewed as software in a broad sense.
“Security update file” means an electronic file that is used to close a security hole, such asa patch or software upgrade.
“Terminal” means a computer that an employee directly operates (including an operating
system and connected peripheral devices) such as a PC and a PDA.
“Communication line” means a mechanism by which multiple computers are connected tosend or receive information in a prescribed communication protocol. A communication line
which is established by connecting a line and communication equipment is called aphysical communication line, and a communication line which is formulated over thephysical communication line and can exchange information in a prescribed communication
protocol is called a logical communication line.
“Communication equipment” means a device that is located to connect the lines and used
to control the information exchanged by computers via a communication line. Repeater

-7-

z
z

z

z
z

z

z

z

z
z

hubs, switching hubs, routers, and firewalls are included.
“Computers” means computers in general and includes operating systems, servers
including connected peripheral devices, and terminals.
“Marking” is information to indicate restrictions on how to handle the information (Do not
copy, internal use only, do not re-distribute, encryption required, and destroy after readingetc.)“Multiple factors authentication / composite authentication” is an authentication method inwhich multiple factors of knowledge, ownership, and biological information are used toauthenticate.
“Outside the Government Agency” means outside the organization or building managed by
the government agency that legal employees belong to.
“Communication line outside the government agency” means a logical communication line
which computers that are not managed by the government agency are connected with and isused for communications between such computers regardless of what physicalcommunication lines (wired/wireless, real/virtual, managed by the government
agency/other organizations) or communication equipment are used.
“Information processing outside the government facility” means doing information
processing required to execute the administrative tasks outside the organization or building
managed by the government agency. This includes offline processing as well as online
processing by connecting from outside the government facility to the information systemsof the government agency that legal employees belong to.
“Information systems not supplied by the government (unsupplied information system)”means the information systems that are not the ones supplied by the government agency
which legal employees belong to. These include private PCs and the information systems
provided to loan employees working in the relevant government agency by the originalorganization.
“Information processing using information systems not supplied by the government” means
doing information processing required to execute the administrative tasks using unsupplied
information systems. This includes not only using the devices directly but also using theservices provided by the devices. A service here means one such as an e-mail service forprivate use. Transferring business e-mail messages required to execute the administrative
tasks to a privately used e-mail service and vice versa are the examples.
“Inside the government agency” means inside the organization or building managed by thegovernment agency which legal employees belong to.
“Communication line inside the government agency” means a logical communication line
which computers that are managed by the government agency are connected with and isused for communications between such computers regardless of what physicalcommunication lines (wired/wireless, real/virtual, managed by the government
agency/other organizations) or communication equipment are used.

-8-

z
z
z

z

z

z
z
z
z
z

z
z

“Malware” means software in general which brings a result unwanted for computer users,
such as computer viruses and spyware.
“Malware definition file” means the data which antivirus software, etc. uses to determine
malware.
“Granting” (information for authentication or information for permission of access control)means to issue, update and modify such information.
“Labeling” means to put information into a state in which all persons who handle it canhave a common understanding of its classification. The classification must be shown foreach item of information in principle. However, for specific information systems, clearlystating classification of information stored in the information system in the rule, etc. andnotifying the rule to all persons who use the information system is also labeling.
“Mobile PC” means a terminal that is movable as needed for business purposes regardlessof terminal shape. A laptop PC that is used at a specific place is not a mobile PC.
“Vital information” means availability class-2 information.
“Confidential information” means confidentiality class-2 information and confidentiality
class-3 information.
“Classified information” means confidential information, critical information, and vital
information.
“Critical information” means integrity class-2 information.
“Exceptional measures” means that an employee takes alternative measures required inorder to continue executing his or her administrative tasks appropriately, or, if there is arational reason for doing so, reports and obtains permission not to meet the compliancerequirements in the case that complying with the relevant information security rules isdifficult.
“Login” means an action in which a subject requests authentication. Because login isfollowed by authentication, validity of the subject is unknown at the login stage.
“Logon” means the status in which the subject that has requested authentication by login isvalidated by the information system.

-9-

Chapter 2 Building the Organization and System
2.1 Introduction
2.1.1 Establishing the Organization and System
Compliance Requirements(1) Designating the chief information security officer[BASIC Requirements](a) A chief information security officer must be designated.
(b) The chief information security officer must direct the tasks for information security
measures in the government agency that he or she belongs to.
(c) The chief information security officer must designate a person who has in-depth
knowledge and specialized experience in information security as the chief information
security advisor as needed.
(2) Designating the information security committee[BASIC Requirements](a) The chief information security officer must establish the information security
committee and designate a chairperson and members of the committee.
(b) The information security committee must formulate the standards of government
agency for information security and gain approval from the chief information security
officer.
(3) Designating the chief information security auditor[BASIC Requirements](a) The chief information security officer must designate the chief information security
auditor.
(b) The chief information security auditor must direct the tasks for the audit under the
direction of the chief information security officer.
(4) Designating the information security officers[BASIC Requirements](a) The chief information security officer must determine the management unit to be used
to implement the information security measures and designate an information security
officer for each unit. The head of information security officers must be designated togive directions to the information security officers.
(b) The information security officer must give directions for the administrative tasks for
information security measures in the unit he or she governs.
(c) The head of information security officers must define administrative procedures for- 10 -

employment, job termination, and job transfer that occur in implementing information
security measures and gain approval from the chief information security officer.
(d) The information security officer must periodically ensure that administrative
procedures for employment, job termination, and job transfer that occur in
implementing information security measures are followed.
(e) The chief information security officer must report the designating and changing of any
information security officers to the head of information security officers.
(f) The head of information security officers must formulate a network for all information
security officers.
(5) Designating the information system security officers[BASIC Requirements](a) The information security officer must designate information system security officers
for the information systems in the unit he or she manages.
(b) The information system security officer must direct the administrative tasks for
information security measures for the information systems he or she manages.
(c) The information security officer must report the designating and changing of any
information system security officers to the head of information security officers.
(d) The head of information security officers must formulate a network for all information
system security officers.
(6) Designating the information system security administrators[BASIC Requirements](a) The information system security officer must designate an information system security
administrator for each unit required for the administrative tasks for the information
system he or she manages.
(b) The information system security administrator must implement information security
measures for the administrative tasks he or she manages.
(c) The information system security officer must report the designating and changing of
any information system security administrators to the head of information security
officer.
(d) The head of information security officers must formulate a network for all information
system security administrators.
(7) Designating the division/office information security officers[BASIC Requirements](a) The information security officer must designate a division/office information security
officer for each division/office.
(b) The division/office information security officer must direct the administrative tasks for
information security measures in the division/office he or she manages.

- 11 -

(c) The information security officer must report the designating and changing of any
division/office information security officers to the head of information security
officers.
(d) The head of information security officers must formulate a network for all
division/office information security officers.

2.1.2 Separation of Roles
Compliance Requirements(1) Defining the roles that must not be undertaken by the same person[BASIC Requirements](a) In the context of the implementation of information security measures, the following
roles must not be undertaken by the same person.
(i)

The applicant and the approver of any request(ii) The auditee and the auditor

2.1.3 Violation and Exceptional Measures
Compliance Requirements(1) Handling the violations[BASIC Requirements](a) The employee must report to the information security officer who is responsible for the
information security rules in the case of finding any serious breach of them.
(b) The information security officer must instruct the violator or the pertinent persons to takenecessary measures to maintain information security in the case of being informed of or
finding any serious breach of the information security rules.
(c) The information security officer must report to the chief information security officer inthe case of being informed of or finding any serious breach of the information security
rules.
(2) Exceptional measures[BASIC Requirements](a) The information security committee must designate the person who judges whether therequest for applying any exceptional measures should be allowed or denied (hereinafterreferred to as “the judge”) and define the judgment procedure.
(b) The employee must request for the approval for exceptional measures to the judge byfollowing the formulated procedures. However, the employee can make this request after
the fact promptly in the case that the exceptional measure is immediately needed for- 12 -

executing his or her tasks and the immediate taking of alternative measures that are notprovided for in the information security rules or the violation of the rules are unavoidable.
The employee must clarify information including the following:(i) Requester information (name, department, contact)(ii) Portion of information security rules which the exceptional measure is requestedfor (the title of rule and article, etc.)(iii) Period for applying the exceptional measure(iv) Description of the exceptional measure (an alternative measure, etc.)(v) Reporting procedure for terminating the exceptional measure(vi) Reason for requesting the exceptional measure(c) The judge must review the request for applying an exceptional measure made by theemployee in accordance with the formulated judgment procedure and approve ordisapprove the request. Also, when the judge makes a decision, he or she must formulatea request process record including the following information and present it to the chief
information security officer.
(i) Name of the judge (name, title, department, contact)(ii) Request information••

Requester information (name, department, contact)
Portion of information security rules which the exceptional measure isrequested for (the title of rule and article, etc.)• Period for applying the exceptional measure• Description of the exceptional measure (an alternative measure, etc.)• Reporting procedure for terminating the exceptional measure• Reason for requesting the exceptional measure(iii) Result•••

Approved or disapproved
Reason for approval or disapprovalPortion of information security rules which the exceptional measure isapproved for• Period of the approved exceptional measure• Description of the exceptional measure (an alternative measure, etc.)• Reporting procedure for terminating the exceptional measure(d) The employee must report to the judge who is responsible for the exceptional measure
when he or she terminates the approved exceptional measure. However, this reporting is
not required if the judge decides so.
(e) The judge must check whether the requestor has reported terminating the approved
exceptional measure on its expiration and instruct the requestor to report it, and takenecessary measures. However, this reporting is not required if the judge decides so.
(f) The chief information security officer must formulate the ledger of request process
records for exceptional measures and provide this to the information security auditors on- 13 -

their request for reference purposes.

- 14 -

2.2 Operation
2.2.1 Education for the Information Security Measures
Compliance Requirements(1) Educating the employees about the information security measures[BASIC Requirements](a) The head of information security officers must educate the employees about
information security rules.
(b) The head of information security officers must examine educational contents on
information security rules for the employees and formulate educational materials.
(c) The head of information security officers must plan and develop the plan to educate on
the information security measures and organize its implementation system so that theemployees can participate in at least one education program per year.
(d) The head of information security officers must plan and develop the contents foreducation on the information security measures and organize the implementation
system so that any employee who starts working or transfers to another department
can participate in an educational program at their new workplace within three months.
(e) The head of information security officers must establish the system to manage theachievement of participation of the employees on information security measures.
(f) The head of information security officers must inform the division/office information
security officer of the achievement of participation of each employee on information
security measures.
(g) The division/office information security officer must advise the employee who has notparticipated in any educational program for information security measures. In the casethat the employee does not take his or her advice, the division/office information
security officer must report this to the head of information security officers.
(h) The head of information security officers must report the achievement of participationof each employee on information security measures to the chief information security
officer and the information security committee once a year.
[ENHANCED Requirements](i) The head of information security officers must plan the contents for training on theinformation security measures for the employees, and organize the system regarding
the information security rules.
(2) Participating in the educational programs on information security measures[BASIC Requirements](a) The employee must participate in at least one educational program per year on
information security measures in accordance with the plan to educate on theinformation security measures.

- 15 -

(b) The employee must ask the division/office information security officer how they canparticipate in an educational program on information security measures at his or her
new workplace when they start working or transfer to another department.
(c) The employee must report the reason to the head of information security officers
through the division/office information security officer in the case that he or shecannot participate in an educational program on information security measures for any
reason that he or she is not responsible for.
[ENHANCED Requirements](d) The employee must participate in a training program on information security measuresin the case that participating in such a training program is formulated in the policy.

2.2.2 Malfunction Handling
Compliance Requirements(1) Advance Preparation for Possible Malfunction[BASIC Requirements](a) The chief information security officer must establish the system to prevent the damage
from increasing and recover from the malfunction (including incidents andmalfunctions. This is hereinafter referred to as “malfunction”) in the case of any
malfunctions that can breach information security.
(b) The head of information security officers must establish the malfunction report
procedure that the employee uses to report to the information security officer andnotify the procedure to all the employees.
(c) The head of information security officers must establish the malfunction handlingprocedure.
(d) For the information systems that are considered especially important for the tasks, thehead of information security officers must prepare the emergency network withinformation including emergency contacts and means of communication for the
responsible information system security officer and the responsible information systemsecurity administrator, and message contents[ENHANCED Requirements](e) The head of information security officers must establish a point of contact to receive
information about malfunction from outside the government agency and announce theaccess to the contact to parties outside the government agency.
(2) Reporting and Taking Emergency Measures on Malfunctions[BASIC Requirements](a) In the case that the employee comes to know that any malfunction has occurred, he or
she must notify the relevant party and report to the information security officer in- 16 -

accordance with the reporting procedure formulated by the head of information
security officers.
(b) The employee must confirm whether the malfunction handling procedure exists andfollow the procedure in the case that he or she can follow it.
(c) In the case that any malfunction has occurred and no relevant malfunction handlingprocedure exists or it is unknown whether such a procedure exists, the employee must
try to prevent the damage from increasing until they are instructed how to handle it.
The employee must follow instructions when he or she receives any.
(3) Cause Investigation and to Prevent the Recurrence of Malfunction[BASIC Requirements](a) In the case that any malfunction has occurred, the information security officer must
investigate the cause of malfunction and prevent the recurrence, then report to thechief information security officer in writing.
(b) In the case that the chief information security officer receives a report of any
malfunction from the information security officers, he or she must examine themalfunction report and take necessary measures to prevent a recurrence.

- 17 -

2.3 Evaluation
2.3.1 Self-assessment of the Information Security Measures
Compliance Requirements(1) Formulating an annual plan for self-assessment[BASIC Requirements](a) The chief information security officer must formulate an annual plan for
self-assessment.
(2) Preparing for the self-assessment[BASIC Requirements](a) The information security officer must establish the self-assessment form andprocedure for each employee.
(3) Conducting the self-assessment[BASIC Requirements](a) The information security officer must instruct the employees to conduct
self-assessment in accordance with the annual plan for self-assessment formulated by
the chief information security officer.
(b) The employee must conduct self-assessment using the self-assessment form andprocedure instructed by the information security officer.
(4) Evaluating the result of self-assessment[BASIC Requirements](a) The information security officer must confirm that the employees have conducted
self-assessment and evaluate the results.
(b) The chief information security officer must confirm that the information security
officer has conducted self-assessment and evaluate the results.
(5) Making improvements based on the self-assessment[BASIC Requirements](a) The employee must make any improvements that he or she believes possible within
the scope of his or her authority based on the results of self-assessment, then report
this to the information security officer.
(b) The chief information security officer must evaluate the results of self-assessment as awhole, and instruct the information security officers to make improvements as needed.

2.3.2 Auditing the Information Security Measures- 18 -

Compliance Requirements(1) Formulating the audit plans[BASIC Requirements](a) The head of information security auditors must formulate the annual plan for
information security audit and gain approval from the chief information security
officer.
(2) Instructing the information security audit[BASIC Requirements](a) The chief information security officer must instruct the head of information security
auditors to conduct an audit in accordance with the annual plan for information
security audit.
(b) The chief information security officer must instruct the head of information security
auditors to conduct audits that are not defined in the annual plan for information
security audit as needed to respond to changes in information security conditions.
(3) Formulating the detailed audit plans[BASIC Requirements](a) The head of information security auditors must formulate the detailed audit plans inorder to conduct audits in accordance with the annual plan for information security
audit and the instructions for auditing to respond the changes in information security
conditions.
(4) Requirements for the information security auditor[BASIC Requirements](a) The head of information security auditors must request an information security auditor
who is independent from the auditee to perform the audit.
(b) The head of information security auditors must partly outsource the audit work to a
supplier outside the government agency as needed.
(5) Conducting the information security audit[BASIC Requirements](a) The information security auditor must conduct audits under the directions of the headof information security auditors based on the audit plan.
(b) The information security auditor must confirm whether the standards of government
agency comply with these Standards for Measures.
(c) In the case that the procedure is formulated as the standards of government agency are
introduced, the information security auditor must confirm whether the procedurecomplies with the standards of government agency.

- 19 -

(d) The information security auditor must confirm whether the actual operations by theauditee are in compliance with the information security rules.
(e) The information security auditor must document audit working papers and keep it forthe pre-defined period.
(f) The head of information security auditors must formulate the audit report based on theaudit working papers and submit it to the chief information security officer.
(6) Reaction based on the results of the information security audit[BASIC Requirements](a) The chief information security officer must instruct the information system security
officer in the auditee workplace to react to any problems indicated in the audit report.
(b) The chief information security officer must instruct the information system security
officers in other departments to investigate whether similar problems exist and to solve
them if any if he or she believes that it is highly likely that the departments other than
the auditee one pose similar challenges or problems and quick investigation is required
based on the audit report.
(c) The information security officer must develop the improvement plan for the problems
for which resolution is requested by the chief information security officer based on theaudit report, and report it to the chief information security officer.
(d) The chief information security officer must evaluate the adequacy of existing
information security rules and order a review as needed based on the results of theaudit.

- 20 -

2.4 Review
2.4.1 Reviewing the Information Security Measures
Compliance Requirements(1) Reviewing the information security measures[BASIC Requirements](a) The person who established the information security rules must consider whether
reviewing the rules is required as need arises and if it is required, then he or she must
review them.
(b) In the case that the employee finds any challenges or problems posed by the
information security measures they take, he or she must review the relevant measures.

- 21 -

Chapter 3 Measures for Information
3.1 Information Classification
3.1.1 Classifying the Information
Compliance Requirements(1) Classifying the information[BASIC Requirements](a) The information security committee must establish the procedure to label theclassification and markings, and the standards for classification and marking in termsof confidentiality, integrity, and availability of electronic records and confidentiality of
written documents for the information used in the tasks.

- 22 -

3.2 Information Handling
3.2.1 Creating and Obtaining Information
Compliance Requirements(1) Prohibiting creation or obtainment of Information for non-business purposes[BASIC Requirements](a) The employee must not create or obtain any information from the information systems
for the purpose other than executing his or her governmental business(2) Classifying the information on creation or obtainment and considering marking[BASIC Requirements](a) In the case that the employee creates information, he or she must classify it based on
its confidentiality, integrity, and availability and consider whether marking is required.
(b) In the case that the employee obtains and starts to manage the information created by
the person outside the government agency, he or she must classify it based on its
confidentiality, integrity, and availability and consider whether marking is required.
(3) Labeling classification and marking[BASIC Requirements](a) The employee must label the classification of information in a way that can beunderstood by the person who is allowed to view it and also label the marking as
needed.
(4) Application of the existing, classification and marking[BASIC Requirements](a) The employee must apply the existing classification and marking in the case that he or
she quotes any existing information in the new information.
(5) Changing classification and marking[BASIC Requirements](a) In the case that the employee thinks that any information requires re-classification, heor she must consult the person who created or obtained it. If it is required, then the
consulted person must re-classify the relevant information appropriately.
(b) In the case that the employee thinks that any information requires review of marking,he or she must consult the person who created or obtained it. If it is required, then the
consulted person must review the marking of the relevant information appropriately.

3.2.2 Usage of Information- 23 -

Compliance Requirements(1) Prohibiting usage for non-business proposes[BASIC Requirements](a) The employee must not use any information from the information systems for a
purpose other than executing his or her tasks.
(2) Handling the information based on classification and marking[BASIC Requirements](a) The employee must handle information appropriately in accordance with theclassification labeled on the information. In the case marking is also labeled beside theclassification, the instructions for marking must be followed.
(3) Handling classified information[BASIC Requirements](a) The employee must not take classified information outside the government agency forthe purpose other than executing his or her tasks.
(b) The employee must not leave classified information unattended.
(c) The employee must not make copies of confidentiality class-3 information more thannecessary.
(d) The employee must not distribute confidential information more than necessary.
[ENHANCED Requirements](e) For confidentiality class-3 information, the employee must clearly indicate the period
during which it should be treated as confidentiality class-3 information. Even during
this period, in the case that the employee thinks changing it to a lower classificationis required, he or she must take the steps required for re-classification.
(f) The employee must give a serial number on the written document in which
confidentiality class-3 information is printed and clarify where it is kept.

3.2.3 Maintenance of Information
Compliance Requirements(1) Maintaining the information based on classification[BASIC Requirements](a) The information system security officer must provide appropriate access control onclassified information stored in the computers.
(b) The employee must manage the external storage media appropriately in accordancewith the classification of the information stored.
(c) The employee must appropriately manage the written documents containing- 24 -

(d)

(e)

(f)

(g)

information that is input into or output from the information systems containing
confidential information or important specifications.
The employee must consider whether encryption is required in the case that he or she
stores confidential information in the computers or the external storage media and if it
is required, then he or she must encrypt it.
The employee must consider whether performing an electronic signature is required in
the case that he or she stores critical information on the computer or external storage
media and if it is required, then he or she must perform an electronic signature.
For electronic records or important specifications which are critical information orvital information, the employee must consider whether making a back-up or copy isrequired and if it is required, then he or she must make a back-up or copy of them.
For back-ups or copies of electronic records or important specifications which are
critical information or vital information, the information system security officer must
consider whether contingency planning is required and if it is required, then he or she
must take appropriate measures to prevent all sites from being impacted by a disaster.

(2) Information Retention Period[BASIC Requirements](a) The employee must keep the information stored on computers or external storage
media until the retention period expires in the case that such a period is set and delete
it without delay in the case that the period does not require extension.

3.2.4 Transfer of Information
Compliance Requirements(1) Gaining approval and notifying of information transfer[BASIC Requirements](a) The employee must gain approval from the division/office information security officer
in the case that he or she transfers confidentiality class-3 information.
(b) The employee must notify the division/office information security officer in the casethat he or she transfers confidentiality class-2 information.
(2) Selecting between transmitting and transporting the information[BASIC Requirements](a) The employee must select to transmit or transport the confidential information inconsideration of safety and notify the division/office information security officer.
(3) Selecting the transfer means[BASIC Requirements]- 25 -

(a) The employee must select the means to transfer confidential information inconsideration of safety and notify the division/office information security officer.
(4) Protecting the printed information[BASIC Requirements](a) In the case that the employee transports a written document including confidential
information, he or she must take appropriate security measures in accordance with theclassification of information.
(5) Protecting the electronic records[BASIC Requirements](a) In the case that the employee transfers an electronic record of confidential information,
he or she must consider whether protection by password is required and if it isrequired, then he or she must set a password for it.
(b) In the case that the employee transfers an electronic record of confidential information,
he or she must consider whether encrypting the information is required and if it isrequired, then he or she must encrypt it.
[ENHANCED Requirements](c) In the case that the employee transfers an electronic record of confidential information,
he or she must encrypt it in a way to provide the encryption strength required, split itinto pieces, and transfer it using different routes.

3.2.5 Provision of Information
Compliance Requirements(1) Releasing the information[BASIC Requirements](a) The employee must confirm that the information is classified into confidentiality
class-1 information when he or she releases the information.
(b) The employee must take measures to prevent the inadvertent leak of information fromadded pieces, etc. when he or she releases electronic records.
(2) Providing the information to others[BASIC Requirements](a) In the case that the employee provides confidentiality class-3 information to the person
outside the government agency, he or she must gain approval from the division/office
information security officer.
(b) In the case that the employee provides confidentiality class-2 information to the person
outside the government agency, he or she must notify the division/office information- 26 -

security officer.
(c) In the case that the employee provides confidential information to the person outside
the government agency, he or she must take measures to make sure that, on the part ofthat person, the relevant confidential information is treated based on the confidentiality
category set by the government agency the employee belongs to.
(d) In the case that the employee provides electronic records, he or she must takemeasures to prevent inadvertent leak of information from added pieces, etc.

3.2.6 Deleting of Information
Compliance Requirements(1) Deleting the electronic records[BASIC Requirements](a) In the case that the employee disposes of computers, communication equipment, andexternal storage media, he or she must make all the information difficult to restore byusing data erasing software or devices, or by physically or magnetically destroying it.
(b) In the case that the employee provides the computers, communication equipment, andexternal storage media to others, he or she must consider whether making the stored
information difficult to restore is required, and if it is required, then he or she must
make the confidential information stored on the relevant computers, etc. difficult torestore by using data erasing software or devices in order to minimize the remaining
confidential information.
[ENHANCED Requirements](c) The employee must make the confidential information stored on the relevant
computers, communication equipment, and external storage media difficult to restore
by using data erasing software in order to minimize the remaining confidential
information in the case that it is required to do so considering the environment, etc.
(2) Disposing the written documents[BASIC Requirements](a) The employee must dispose the written document containing confidential information
in a way to make it difficult to restore.

- 27 -

Chapter 4 Measures based on Clarifying Information Security
Requirements
4.1 Information Security Functions
4.1.1 Authentication Functions
Compliance Requirements(1) Introducing the authentication functions[BASIC Requirements](a) The information system security officer must consider whether authentication isrequired for every information system. He or she must determine that an information
system that handles classified information requires authentication.
(b) The information system security officer must provide functions for identification andauthentication for the information systems for which authentication is required.
(c) In the case that authentication information must be kept secret, the information systemsecurity administrator must manage to keep the authentication information unknown toothers for the information systems for which authentication is required.
(i) The authentication information must be encrypted in the case that it is stored.
(ii) The authentication information must be encrypted in the case that it iscommunicated.
(iii) If the authentication information cannot be encrypted in the case that it is stored orcommunicated, the user must be notified that it is not encrypted when he or she
sets, changes, or provides (enters) authentication information.
(d) For the information systems for which authentication is required, the information
system security officer must establish a function to prompt users to change
authentication information periodically in the case that he or she requires such changes
to users along with either of the following functions:(i) A function to check whether the users change the authentication information
periodically(ii) A function to refuse continued use of the information system in the case that theusers do not change the authentication information periodically(e) For the information systems for which authentication is required, the information
system security officer must establish a function to stop authentication using therelevant authentication information or authentication information storage device or tostop use of information systems using a corresponding identification code in the casethat he or she recognizes that the authentication information or authentication
information storage device is used or can be used by another party.
(f) For the information systems for which authentication is required, the information
system security officer must establish the following functions in the case that he or she- 28 -

uses authentication method by knowledge:(i)
A function to let the users set their own authentication information(ii) A function to keep the authentication information set by the users in a state inwhich other parties cannot know it easily(g) For the information systems for which authentication is required, the information
system security officer must examine and meet all the applicable requirements in thecase that he or she uses an authentication method other than that based on knowledge,
ownership, or biological information. Also, he or she must define the requirements
including the following for the authentication method to use.
(i) Any subject other than the legitimate subject must not be accepted. (prevention ofincorrect permission.)(ii) The legitimate subject must not be rejected for any reasons for which it is not
responsible. (prevention of false rejection.
(iii) The legitimate subject must not be able to grant or lend its authentication
information to other parties easily (prevention of substitution.)(iv) The authentication information must not be easily duplicated (prevention of
duplication.)(v) There must be means to invalidate logons individually at the discretion of theinformation system security administrator (assurance of invalidation.)(vi) The authentication must be available enough to perform the tasks (assurance ofavailability.)(vii) In the case that any information or device needs to be provided from outside to
add new subjects, such information or devices can be sufficiently provided during
the life of the information system (assurance of continuity.)(viii)The authentication information must be able to re-issued to the legitimate subject
in a secure manner if the authentication information granted to it cannot be used(assurance of re-issuance.)(h) The information system security officer must not use the relevant biologicalinformation for the purpose other than that agreed by the user in advance if he or she
uses authentication method based on biological information. Also, he or she must be
careful not to invade the privacy of the user in using the relevant biologicalinformation.
[ENHANCED Requirements](i) For the information systems for which authentication is required, the information
system security officer must establish a function to perform multiple factors
authentication method.
(j) For the information systems for which authentication is required, the information
system security officer must establish a function to notify the information for the last
logon to the user who has logged on.
(k) For the information systems for which authentication is required, the information- 29 -

system security officer must establish a function to detect or prevent any attempts at
illegitimate logon.
(l) For the information systems for which authentication is required, the information
system security officer must establish a function to display a notification about the useof the information system before the user login to the information system.
(m) For the information systems for which authentication is required, the information
system security officer must establish a function to prevent the users from re-using thesame authentication information as that previously used in the case that he or she
requires periodic changes in authentication information.
(n) For the information systems for which authentication is required, the information
system security officer must establish a function to require that the users logon using
an individual identification code before they login using the identification code in thecase that the identification code with administrative rights is shared.
(2) Identification code handling by employees[BASIC Requirements](a) The employee must not use the information system using an identification code otherthan the identification code granted to him or her.
(b) The employee must not grant or lend the identification code granted to him or her toany other parties.
(c) The employee must not leave the identification code that has been granted to him or
her in a state in which it can be known by the parties who do not need to know it.
(d) The employee must notify the information system security administrator in the casethat he or she does not need to use the identification code any longer. However, thisreporting is not always required if the information system security officer has
previously stated that individual reporting is not required.
[ENHANCED Requirements](e) The person who is granted an identification code with administrative rights must use it
only when he or she executes the tasks as an administrator.
(3) Authentication information handling by employees[BASIC Requirements](a) In the case that authentication information is used or can be used by others, theemployee must report this to the information system security officer or the information
system security administrator immediately.
(b) In the case that the information system security officer or the information systemsecurity administrator receives a report that authentication information has been used
or can be used by others, he or she must take necessary measures.
(c) In the case that the employee uses authentication method based on knowledge, he or
she must meet the following requirements- 30 -

The employee must keep his or her authentication information unknown to othersin handling.
(ii) The employee must not tell what his or her authentication information is.
(iii) The employee must try to remember his or her authentication information.
(iv) The employee must select authentication information that cannot be easily
guessed when he or she set it.
(v) In the case that the employee is instructed to change authentication information
periodically by the information system security administrator, he or she must doso.
(d) In the case that the employee uses authentication method based on ownership, he or
she must meet the following requirements:(i) The employee must take security measures so that the authentication information
storage device is not used in an unintended manner.
(ii) The employee must not grant or lend his or her authentication information storage
device to others.
(iii) The employee must manage not to lose the authentication information storage
device. In the case that it is lost, he or she must report this to the information
system security officer or the information system security administrator.
(iv) In the case that the employee does not need to use the authentication information
storage device any longer, he or she must return this to the information systemsecurity officer or the information system security administrator.
(i)

4.1.2 Access Control Functions
Compliance Requirements(1) Introducing the access control functions[BASIC Requirements](a) The information system security officer must consider whether access control isrequired for every information system. He or she must determine that an information
system that handles classified information requires access control.
(b) For the information systems for which access control is required, the information
system security officer must establish a function to provide access control.
[ENHANCED Requirements](c) For the information systems for which access control is required, the information
system security officer must add a function to provide access control based on theattributes other than those of the user and the group the user belongs to.
(d) For the information systems for which access control is required, the information
system security officer must establish a function to Mandatory Access Control (MAC).

- 31 -

(2) Configuring Access control by the employees[BASIC Requirements](a) The employee must configure necessary access control using the functions installed on
the information system in accordance with the classification and marking of theinformation stored in the information system.

4.1.3 Administration Functions
Compliance Requirements(1) Introducing the administration functions[BASIC Requirements](a) The information system security officer must consider whether administration isrequired for every information system. He or she must decide that an information
system that handles classified information requires administration.
(b) For the information systems for which administration is required, the information
system security officer must establish a function to provide this administration.
[ENHANCED Requirements](c) For the information systems for which administration is required, the information
system security officer must establish a function of the least privilege.
(d) For the information systems for which administration is required, the information
system security officer must establish a function to re-issue authentication information
automatically.
(e) For the information systems for which administration is required, the information
system security officer must establish a dual locking function.
(2) Granting and managing identification code and authentication information[BASIC Requirements](a) For the information systems for which administration is required, the information
system security officer must decide to approve or disapprove the use of the shared
identification code for each information system.
(b) For the information systems for which administration is required, the information
system security officer must clearly establish the procedures for administration
including the following:(i) The procedure to validate that the applicant is the legitimate subject if a subject
makes a request for administration(ii) The initial distribution procedure and the change manager procedure ofauthentication information(iii) The setting procedure and the change control procedure for access control
information- 32 -

(c) For the information systems for which administration is required, the information
system security officer must designate a person who is responsible for theadministration.
(d) For the information systems for which administration is required, the person doing
administration must issue identification codes and authentication information only tothe subject that has gained approval of using the information system.
(e) In the case that the person doing administration issues an identification code for the
information systems for which administration is required, he or she must notify
whether it is shared or not to the users. However, a shared identification code may be
granted only for the information system where the information system security officer
allows the use of it.
(f) For the information systems for which administration is required, the person dosing
administration must grant the identification code with administrative rights only in thecase that such identification code is required to execute the business or business
responsibilities.
(g) For the information systems for which administration is required, the person doing
administration must invalidate the identification code of an employee in the case thatthe employee does not need to use it any longer. Also, he or she must check whether
unnecessary identification codes exist in the case that he or she adds or deletes anidentification code for personnel changes, etc.
(h) For the information systems for which administration is required, the person doing
administration must have the employee return the authentication information storage
device provided when the employee does not need to use it any longer.
(i) For the information systems for which administration is required, the person doing
administration must configure access control only in the minimum necessary scopeconsidering the business responsibilities and needs. Also, he or she must check
whether inappropriate access control settings exist in the case that he or she adds ordeletes an identification code for personnel changes, etc.
[ENHANCED Requirements](j) For the information systems for which administration is required, the person doing
administration must grant a single identification code to an employee for a single
information system.
(k) For the information systems for which administration is required, the person doing
administration must keep a record of which subject the identification codes have been
granted to. In the case that the person doing administration destroys the record, he or
she must gain approval from the information security officer in advance.
(l) For the information systems for which administration is required, the person doing
administration must not grant an identification code that has already been granted to
one subject to any other subjects.

- 33 -

(3) Applying an alternative measure for identification code and authentication information[BASIC Requirements](a) For the information systems for which administration is required, in the case that the
information system security administrator receives a request for approval of using analternative measure because the employee cannot use the identification code, he or she
must confirm that the applicant is a legitimate user and consider whether thealternative measure is required, and if it is required, then he or she must provide it .
(b) For the information systems for which administration is required, in the case that the
information system security officer or the information system security administrator
receives a report of unauthorized use of an identification code, he or she must
invalidate the system use with the identification code.

4.1.4 Audit Trail Management Functions
Compliance Requirements(1) Introducing the audit trail management functions[BASIC Requirements](a) The information system security officer must consider whether audit trails are required
for each information system.
(b) For the information systems for which audit trails are required, the information systemsecurity officer must establish a function to collect the audit trails.
(c) For the information systems for which audit trails are required, the information systemsecurity officer must configure the information system to record necessary information
items for each event in order to collect the audit trails.
(d) For the information systems for which audit trails are required, the information systemsecurity officer must define a policy for use in the case that the audit trails cannot be
obtained or may be unobtainable and establish a function to handle the situation for the
information system as needed.
(e) For the information systems for which audit trails are required, the information systemsecurity officer must provide access control to prevent the obtained audit trails frombeing deleted, falsified, or accessed illegally and also appropriately manage the audit
trails recorded in external storage media or other devices/media.
[ENHANCED Requirements](f) For the information systems for which audit trails are required, the information systemsecurity officer must establish a function to aid automatic checking, analyzing, andreporting of the audit trails for the information system.
(g) The information system security officer must establish a function on the information
system to notify any events that indicate possible information security infringement to
the monitoring personnel, etc. immediately if such events are found in the obtained- 34 -

audit trails.
(2) Obtaining and keeping the audit trails by the information system security administrator[BASIC Requirements](a) For the information systems for which audit trails are required, the information systemsecurity administrator must record the audit trails using the function established for the
information system by the information system security officer.
(b) For the information systems for which audit trails are required, the information systemsecurity administrator must define the period for which the obtained audit trails are
kept and keep it until the period expires, and delete it without delay in the case that theperiod does not require extension.
(c) For the information systems for which audit trails are required, the information systemsecurity administrator must take a defined measure in the case that the audit trails
cannot be obtained or may be unobtainable.
(3) Studying, analyzing, and reporting the obtained audit trails[ENHANCED Requirements](a) For the information systems for which audit trails are required, the information
security officer or the information system security officer must study and analyze theobtained audit trails periodically or as need arises, then take necessary information
security measures or report to the head of information security officers or the
information security officer.
(b) In the case that the monitoring personnel receive a notification of any event thatindicates a possible security breach, he or she must take a pre-defined measure.
(4) Notifying the users about audit trail management[BASIC Requirements](a) For the information systems for which audit trails are required, the information security
officer or the information system security officer must explain that the audit trails can beobtained, maintained, checked, and analyzed to the information system security
administrator and the users in advance.

4.1.5 Assurance Functions
Compliance Requirements(1) Introducing the assurance functions[BASIC Requirements](a) The information system security officer must consider whether the assurance measures
are required for the information systems that handle classified information.

- 35 -

(b) For the information systems for which assurance measures are required, theinformation system security officer must establish the assurance functions.

4.1.6 Encryption
management)

andPerforming

Electronic

Signature(including

keyCompliance Requirements(1) Introducing the functions for encryption and performing electronic signature[BASIC Requirements](a) The information system security officer must consider whether encryption functions
are required for the information systems that handle confidential information (except
written documents (hereinafter applicable in this section)).
(b) For the information systems for which encryption is required, the information systemsecurity officer must establish a function to provide encryption.
(c) The information system security officer must consider whether performing anelectronic signature is required for the information systems that handle criticalinformation.
(d) For the information systems for which performing an electronic signature is required,
the information system security officer must establish a function to provide anelectronic signature.
(e) For the information systems for which encryption or performing an electronic
signature is required, the information system security officer must consider required
safety and reliability when he or she selects the algorithm and select the one listed in
e-Government Recommended Ciphers List in the case that he or she can select one.
However, he or she must select one listed in e-Government Recommended Ciphers
List in the case of a new introduction (including upgrading) of the encryption orelectronic signature algorithm. In the case that multiple algorithms can be chosen forthe configuration, at least one algorithm must be chosen from e-Government
Recommended Ciphers List.
[ENHANCED Requirements](f) For the information systems for which encryption or performing electronic signature isrequired, the information system security officer must configure the cryptographic
module as a component so that it can be replaced.
(g) For the information systems for which encryption or performing electronic signature isrequired, the information system security officer must allow for the selection ofmultiple algorithms.
(h) For the information systems for which encryption or performing electronic signature isrequired, the information system security officer must validate whether the selected
algorithm is implemented in the software or hardware appropriately.

- 36 -

(i) For the information systems for which encryption or performing an electronic
signature is required, the information system security officer must store the key to use
to decrypt the encrypted information (except written documents (hereinafter applicablein this section)) or to perform an electronic signature in the cryptographic module with
tamper-resistance in order to protect it from physical attacks by a third party.
(2) Management of encryptions and electronic signatures[BASIC Requirements](a) For the information systems for which encryption or performing electronic signature isrequired, the information system security officer must define the generation procedure,
expiry date, disposal procedure, updating procedure, and response procedure in thecase of exposure for the key to use to decrypt the encrypted information or to perform
electronic signature.
(b) For the information systems for which encryption or performing an electronic
signature is required, the information system security officer must define the media
and storage location for the key to use to decrypt the encrypted information or toperform electronic signature.
(c) For the information systems for which performing an electronic signature is required,
the information system security officer must provide the information or a measure tovalidate the electronic signature to the signature verifier.
[ENHANCED Requirements](d) For the information systems for which encryption is required, the information systemsecurity officer must define the back-up procedure or the deposit procedure for the key
to use to decrypt the encrypted information.
(e) In the case that the information system security officer decides that an encryption or
performing an electronic signature is required, he or she must collect information
about the compromise risks of the algorithm selected for the information system as theneed arises.
(3) Using the encryption function or performing electronic signature[BASIC Requirements](a) In the case that the employee transfers confidential information or saves it in anelectronic storage media, he or she must consider whether encryption is required and if
it is required, then he or she must encrypt it.
(b) In the case that the employee transfers critical information or saves it in an electronicstorage medium, he or she must consider whether performing an electronic signature isrequited and if it is required, then he or she must perform electronic signature.
(c) The employee must self-manage the key to use to decrypt the encrypted information orto perform an electronic signature so that it is unknown to others.
(d) The employee must consider whether making a back-up of the key to use to decrypt- 37 -

the encrypted information is required in view of confidentiality, integrity, andavailability and if it is required, then he or she must make a back-up and provide
safety management that is equivalent to that for the original.

- 38 -

4.2 Threats to Information Security
4.2.1 Security Holes
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) For computers and communication equipment (except computers and communicationequipment without announced security hole information. Hereinafter applicable in thissection), the information system security administrator must collect device information
required to respond to security holes and put it on a document.
(b) The information system security administrator must take measures to respond to theannounced security holes relating to software used in the computers or communicationequipment when such computers or communication equipment are built or start
operating.
[ENHANCED Requirements](c) For the information systems that handle vital information, the information systemsecurity officer must install computers and communication equipment in a redundantconfiguration so that the services can continue to be provided without disruption when
action is taken in response to security holes.
(d) The information system security officer must take measures for computers andcommunication equipment even in the case that there is no information about theannounced security holes.
(2) Operating the information systems[BASIC Requirements](a) The information system security administrator must update the documents that include
device information required to respond to the security holes in the case that theconfiguration of computers and communication equipment has been changed.
(b) The information system security administrator must obtain information about theannounced security holes relating to software used on the computers andcommunication equipment which he or she is responsible for as need arises.
(c) The information system security officer must analyze the risks the security holes poseto the information systems using the security hole information obtained, determine thefollowing, and formulate a security hole response plan.
(i)
Need of response(ii) Response procedure(iii) Temporary workaround procedure in the case that no response procedure exists(iv) Effects of response or temporary workaround procedures on the information
systems- 39 -

Response implementation schedule(vi) Need of response testing(vii) Response testing procedure(viii) Response testing plan
The information system security administrator must take measures against security
holes based on the security hole response plan.
The information system security administrator must record the items including date,work description, and worker for the measure against security holes that has beentaken.
The information system security administrator must obtain the security update file in a
reliable manner. Also, he or she must validate integrity of the security update file inthe case that any validation procedure is provided.
The information system security administrator must investigate and analyze measures
for security holes and software configurations periodically and respond in the case thathe or she finds any computers or communication equipment in an inappropriate state.
The information system security officer must share the obtained information about the
security holes and the measures with other information system security officers asneeded.
(v)

(d)
(e)

(f)

(g)

(h)

4.2.2 Malware
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) The information security officer must define the daily activities including advice to theemployees to prevent the presence of malware.
(b) The information system security officer must install antivirus software, etc. on thecomputers (except for the computers which do not accept any antivirus software, etc.
Hereinafter applicable in this section.)(c) The information system security officer must take measures against malware by using
antivirus software, etc. for all imaginable routes for the malware.
[ENHANCED Requirements](d) For all the imaginable routes of malware, the information system security officer must
install antivirus software etc. from different manufacturers in combination.
(e) The information system security officer must take measures to prevent malware fromspreading by communications.
(2) Operating the information systems[BASIC Requirements]- 40 -

(a) The information system security administrator must try to collect information about
malware and decide whether any response is required, and instruct the employees totake measures as needed.
(b) The employee must not execute the executable files detected as malware by antivirus
software or load the data files into any applications.
(c) The employee must always keep the applications and malware definition files usedwith antivirus software updated.
(d) The employee must enable the automatic malware detection function provided byantivirus software, etc.
(e) The employee must check for malware in all the electronic files using antivirus
software, etc. periodically.
(f) The employee must check whether there is an infection by malware when he or she
loads external data or software into the computers or provides data or software
externally.
(g) The employee must try to prevent infection by malware using software security
functions.
(h) The information security officer must examine and review as appropriate how wellmeasures against malware are implemented.
[ENHANCED Requirements](i) The information security officer must establish the system to receive assistance fromexternal experts in the case that the measures against malware that have been taken are
insufficient.

4.2.3 Denial of Service Attacks
Compliance Requirements(1) Building the information systems[BASIC Requirements](a) For the information systems which handle vital information (information systems withcomputers, communication equipment or communication lines accessed via theInternet. Hereinafter applicable in this section,) the information system security officer
must use the functions provided on the computers and communication equipment thatare necessary to provide services to protect against denial of service attacks.
[ENHANCED Requirements](b) The information system security officer must build the communication equipment andcommunication line considering that the other services that share communicationequipment or communication lines and access to the Internet from the inside can be
impacted in the case that a denial of service attack occurs.
(c) For the information systems which handle vital information, the information system- 41 -

(d)

(e)

(f)

(g)

security officer must identify the monitoring scope and define the monitoringprocedure for the computers, communication equipment, or communication lines
which suffer denial of service attacks.
For the information systems that handle vital information, the information systemsecurity officer must introduce any countermeasure device necessary to eliminate or
mitigate the impact of denial of service attacks on the computers, communicationequipment, or communication lines.
For the information systems that handle vital information, the information systemsecurity officer must maintain effective measures to protect against denial of service
attacks.
For the information systems that handle vital information, the information systemsecurity officer must install the computers, communication equipment orcommunication lines that are required to provide services in a redundant configuration.
For the information systems which handle vital information, the information systemsecurity officer must consider that computers and communication equipment alone
cannot protect from a denial of service attack caused by large-scale access andestablish a response procedure and correspondence procedure in cooperation with theprovider of the communication lines which are connected to the Internet when denialof service attacks occur.

(2) Operating the information systems[ENHANCED Requirements](a) For the information systems that handle vital information, the information systemsecurity administrator must monitor the computer, communication equipment, andcommunication line in accordance with the monitoring procedure and keep amonitoring record.
(b) For the information systems that handle vital information, the information systemsecurity officer must use the above record to improve the techniques to detect denial ofservice attacks.
(c) For the information systems that handle vital information, the information system security
officer must review the measures against denial of service attacks periodically.

- 42 -

4.3 Security Requirements of Information Systems
4.3.1 Security Requirements of Information Systems
Compliance Requirements(1) Planning and designing the information systems[BASIC Requirements](a) The information system security officer must require the person who is responsible for
information systems to establish the system to maintain security throughout theirlifecycle.
(b) The information system security officer must decide the security requirements of theinformation systems.
(c) The information system security officer must define the measures in purchasing(including leasing) equipment, etc., developing software, configuring the information
security functions, protecting against the threats to information security, and handlingmeasures for components of information systems in order to meet the security
requirements of information systems.
(d) In the case that the information system security officer recognizes any important
security requirements for the information system to be built, he or she must request fora security target (ST) evaluation and confirmation to the third-party organization for
the relevant information system. However, in the case that he or she updates theinformation system and there are only minor changes in important security
requirements in the reviewed security target, such evaluation and confirmation are notalways required.
(e) The information system security officer must define the installation procedure andenvironmental requirements in terms of information security when the information
system he or she has built goes into the operation phase.
[ENHANCED Requirements](f) In the case that the information system security officer recognizes any important
security requirements for the information system to be built, he or she must define therequired security function for the device and software products to be procured basedon the security function designed to meet the requirement. In the case that multiple
products meet the function and other requirements, he or she must select one that iscertified according to Evaluation and Certification/Validation Scheme under CCRA
(Common Criteria Recognition Arrangement) for this security function as acomponent of the information system.
(2) Building, operating, and monitoring the information systems[BASIC Requirements](a) The information system security officer must use the information security measures- 43 -

that have been formulated based on the security requirements to build, operate, andmonitor the information systems.
(3) Moving and disposing of the information systems[BASIC Requirements](a) In the case that the information system security officer moves or disposes of theinformation systems, he or she must consider whether deleting or saving theinformation, or disposing or reusing the information systems is required and takeappropriate measures in either case.
(4) Reviewing the information systems[BASIC Requirements](a) The information system security officer must consider as appropriate whether
reviewing the information security measures for the information systems is required,and if it is required, then he or she must carry out the review and take appropriate
measures.

- 44 -

Chapter 5 Measures for Components of Information Systems
5.1 Facilities and Environment
5.1.1 The secure area where computers and communication equipment are locatedCompliance Requirements(1) Managing entry and exit
[BASIC Requirements](a) The information system security officer must take measures to prevent suspicious
individuals from entering the secure area.
[ENHANCED Requirements](b) The information system security officer must take measures to isolate the secure areafrom the areas with a different security level physically and limit the location where
people can enter or exit.
(c) The information system security officer must take measures to authenticate the persons
who enter the secure area.
(d) The information system security officer must take measures to authenticate the persons
who exit the secure area.
(e) The information system security officer must take measures to prohibit theauthenticated persons from letting unauthenticated persons enter or exit the securearea.
(f) The information system security officer must establish the procedure to approve thepersons who enter the secure area continuously. Also, he or she must establish the
document to record information including the person’s name, department, approved
entry date, entry period, and rationale.
(g) In the case that there are any changes in the persons who have gained approval ofentering the secure area, the information system security officer must update the above
document with the changes. Also, he or she must record these changes.
(h) The information system security officer must take measures to record and monitor all
entries to and exits from the secure area.
(2) Managing the visitors and delivery personnel[ENHANCED Requirements](a) In the case that there is any visitor to the secure area, the information system security
officer must take measures to confirm the name, department, purpose of the visit, andthe name and department of the employee who receives the visit.
(b) In the case that there is any visitor to the secure area, the information system security
officer must take measures to record the name, department and purpose of the visit, thename and department of the employee who receives the visit, the date of the visit, and- 45 -

(c)

(d)
(e)
(f)
(g)

the time of entry and exit.
In the case that there is any visitor to the secure area, the information system security
officer must establish the procedure by which the visited employee examines whether
the visitor may enter the secure area.
The information system security officer must take measures to limit the area where thevisitors can enter.
The information system security officer must take measures so that the visited
employee attends to the visitor in the secure area.
The information system security officer must take continuous measures to identify thevisitors and the persons who have gained approval of entering by appearance.
In the case that exchange of items with delivery personnel occurs, the information
system security officer must set either requirements:(i)Such exchange must be done outside the secure area.
(ii) In the case that the delivery personnel enter the secure area, such exchange must
be done in the area where computers, communication equipment, external storage
media, and documents cannot be touched and the employee must be inattendance.

(3) Securing the computers and communication equipment[ENHANCED Requirements](a) For the information systems that handle classified information, the information systemsecurity officer must isolate computers and communication equipment from otherinformation systems physically and not locate them in the same secure area.
(b) For the information systems that handle classified information, the information systemsecurity officer must take measures to prevent moving the computers andcommunication equipment to be located and used at a specific location.
(c) The information system security officer must take measures to protect the computersand communication equipment against illegal operation while the employee is awayfrom them.
(d) For the information systems that handle confidential information, the information
system security officer must take measures to protect the display of computers andcommunication equipment from others’ eyes.
(e) For the information systems that handle confidential information, the information
system security officer must take measures to protect the cables including power
cables and communication cables used in the information systems against threats
including damage and sniffing.
(f) For the information systems that handle confidential information, the information
system security officer must take measures against information leakage caused byelectromagnetic waves.

- 46 -

(4) Managing security in the secure area
[BASIC Requirements](a) The employee must always keep his or her ID badge visible to other employees in the
secure area.
[ENHANCED Requirements](b) For the information systems that handle classified information, the employee mustbring the items used in the information systems into or out of the secure area aftergaining approval from the information system security officer.
(c) For the information systems that handle classified information, the information systemsecurity officer must record the bringing of items into or out of the secure area.
(d) For the information systems which handle confidential information, the information
system security officer must restrict bringing computers, communication equipment,
external storage media, and recording devices (including the ones to record voice,video, and image) that are not used in the information systems into the secure area.
(e) The information system security officer must take measures to monitor the work donein the secure area.
(5) Measures against disasters and malfunctions[ENHANCED Requirements](a) For the information systems that handle vital information, the information systemsecurity officer must take physical measures to protect computers and communicationequipment against natural and human-induced disasters.
(b) For the information systems which handle vital information, the information systemsecurity officer must take measures to stop power feeding to the computers andcommunication equipment as needed as well as assure the security of workers in thecase that any disaster or malfunction occurs in the secure area.

- 47 -

5.2 Computers5.2.1 Common Measures for Computers
Compliance Requirements(1) Installing the computers[BASIC Requirements](a) The information system security officer must establish the rule to maintain computer
security.
(b) The information system security officer must establish the document to identify the
responsible employees and users of every computer.
(c) For the computers that handle vital information, the information system security
officer must consider and ensure the system capabilities to provide the performancerequired from the relevant computer in the future.
(d) The information system security officer must configure the computers so that the users
who attempt to login to the computer are authenticated.
(e) The information system security officer must administer the identification codes of theuser who has logged on.
(f) The information system security officer must take measures to protect the computersagainst the announced security holes which exist in the operating system andapplications running on the computer (except the ones without announced security
hole information.)(g) The information system security officer must take measures to protect the computers(except for the computers which do not have any antivirus software, etc.) against
malware.
(h) The information system security officer must establish the documents used for thecomputers.
(i) For the information systems that handle classified information, the information systemsecurity officer must locate the computer in a secure area. However, this is not always
required for mobile PCs in the case that he or she gains approval from the information
security officer.
[ENHANCED Requirements](j) For the computers that handle vital information, the information system security
officer must install the computers that are required to provide services in a redundantconfiguration.
(2) Operating the computers[BASIC Requirements](a) The information system security administrator must manage operation of thecomputers based on the rule to maintain security.

- 48 -

(b) The information system security officer must review the rule to maintain computer
security appropriately. Also, if there is any change to the relevant rule, he or she mustrecord it.
(c) The employee must not use the computers for the purpose other than executing his or
her tasks.
(d) In the case that the information system security officer has changed the responsible
employees or users of the computers, he or she must update the document to identify
the new responsible employees or users of the computers. Also, he or she must record
such changes.
(e) The information system security officer must take measures to protect the computersagainst the announced security holes in order to maintain an appropriate computer
security level.
(f) The information system security officer must take measures to protect the computersagainst malware in order to maintain an appropriate computer security level.
(g) In the case that the information system security administrator has changed any
computer configuration, he or she must update the documents used for the computerswith the changes. Also, he or she must record such changes.
[ENHANCED Requirements](h) The information system security officer must periodically examine the state of each
item of software used on the computers within his or her control and make
improvements if any computers are found to be in an inappropriate state.
(3) Disposing of the computers[BASIC Requirements](a) In the case that the information system security officer disposes of the computers,
communication equipment, and external storage media, he or she must make all theinformation difficult to restore by using data erasing software or devices, or physicallyor magnetically destroying it.

5.2.2 Terminals
Compliance Requirements(1) Installing the terminals[BASIC Requirements](a) The information system security officer must define a list of software that may be used
for the terminals. However, in the case that it is difficult to list the allowed software,
he or she can list the denied software or list both of the allowed and the denied
software.
(b) The information system security officer must enable the protection measures in the- 49 -

mobile PCs that handle classified information to be used outside the government
agency so that they can operate with the same protection measures as the terminals to
be used inside the government agency.
(c) The employee must gain approval from the information system security officer in thecase that he or she needs to use a mobile PC.
(d) The information system security officer must add a function to encrypt the information
saved in the internal storage media for mobile PCs that handle confidential
information.
(e) The information system security officer must define the measures to prevent theft forthe mobile PCs that handle classified information.
[ENHANCED Requirements](f) The information system security officer must build the information systems using theterminals that do not allow the employees to save the information.
(2) Operating the terminals[BASIC Requirements](a) The employee must not use any other software than that which he or she is allowed touse on the terminal.
(b) For the mobile PCs that handle classified information, the employee who uses themobile PC must take measures to prevent theft.
(c) For the mobile PCs that handle confidential information, in the case that the employee
takes the mobile PCs outside the government agency, he or she must consider whether
encrypting the confidential information saved in the internal storage media of themobile PC is required and if it is required, then he or she must encrypt it.
(d) The employee must not connect his or her terminal to communication lines other thanthose to which the information system security officer has given approval forconnecting.
[ENHANCED Requirements](e) The information system security administrator must synchronize the terminal timewith the standard time in the information systems.

5.2.3 Server Devices
Compliance Requirements(1) Installing the servers[BASIC Requirements](a) In the case that the information system security officer maintains the server via acommunication line, he or she must consider whether encrypting the sent or received
information is required and if it is required, he or she must encrypt it.

- 50 -

(b) The information system security officer must define the software to be used to provide
services and to operate and manage the servers.
(c) In the case that the information system security officer finds that any server
application that is not included in the allowed software is running, he or she must stop
the relevant server application. Also, even in the case that the server application is
included in the allowed software, he or she must disable the functions that are not
used.
[ENHANCED Requirements](d) The information system security officer must uninstall any software that is notincluded in the allowed software from the servers.
(2) Operating the servers[BASIC Requirements](a) The information system security officer must confirm the changes in the configurationof servers periodically. Also, he or she must identify the impact of the changes on theservers and take measures.
(b) The information system security administrator must make a back-up of theinformation stored in the servers that handle vital information periodically. Also, he or
she must manage the media containing the obtained information in a secure manner.
(c) The information system security administrator must record the information including
the date of work, the server, the work description, and the worker for the operation andmanagement of the server.
(d) The information system security officer must consider whether audit trails are requiredon the server and if it is required, then he or she must collect it.
(e) The information system security administrator must synchronize the time of servers
with the standard time of the information systems.
[ENHANCED Requirements](f) The information system security administrator must monitor the security state of theservers to detect any events including illegal activities or use.
(g) For the servers that handle vital information, the information system security
administrator must monitor the system status of the relevant server to detect any
trouble.
(h) For the servers that handle vital information, the information system security
administrator must balance the load of the servers required to provide services overmultiple servers.

- 51 -

5.3 Application Software
5.3.1 Common Measures for Applications provided via Communication Line
Compliance Requirements(1) Installing the applications[BASIC Requirements](a) The information system security officer must define the rule to maintain security of theservices to be provided via a communication line.
(2) Operating the applications[BASIC Requirements](a) The information system security administrator must operate and manage the systems
daily and periodically based on the rule formulated to maintain security of theservices.
(b) The employee must not use the services that are provided via a communication line forprivate purposes.

5.3.2 E-mailCompliance Requirements(1) Introducing e-mail service[BASIC Requirements](a) The information system security officer must configure the e-mail servers so that
unsolicited bulk e-mail cannot be relayed.
[ENHANCED Requirements](b) The information system security officer must establish a function to authenticate theemployees when the e-mail client sends or receives messages to or from the e-mailserver.
(2) Operating e-mail service[BASIC Requirements](a) In the case that the employee sends or receives e-mail messages that contain
information that is related to business, he or she must use the e-mail service provided
by the e-mail server that is operated or outsourced by each government agency that heor she belongs to. However, this is not always required if he or she has gained
approval for information processing in unsupplied information systems.
(b) The employee must display any e-mail message he or she receives as text in thee-mail client.

- 52 -

5.3.3 Web
Compliance Requirements(1) Introducing the Web[BASIC Requirements](a) In the case that the users enter strings, etc. in the services provided using the Web
servers, the information system security officer must sanitize input data.
(b) The information system security officer must build the information systems so that the
Web servers do not send to the Web clients any information that could be utilized inattacks.
(c) For the information systems which handle confidential information, the information
system security officer must identify the information to protect against sniffing,consider whether encryption is required, and if it is required, then he or she must
encrypt the information for the services provided using the Web servers.
[ENHANCED Requirements](d) For the information systems that handle confidential information, the information
system security officer must identify the information to be stored on the Web servers
and confirm that the relevant servers do not contain any confidential information.
(e) The information system security officer must use the digital certification to ensure thevalidity of Web servers.
(2) Operating the Web[BASIC Requirements](a) In the case that the employee downloads software to the computers on which a Webclient is running, he or she must confirm the source of the software using an electronic
signature.
[ENHANCED Requirements](b) The information system security officer must limit the Web pages from outside thegovernment agency that the employees can browse and review the limit periodically.

- 53 -

5.4 Communication Lines
5.4.1 Common Measures for Communication Lines
Compliance Requirements(1) Building communication lines[BASIC Requirements](a) In the case that the information system security officer builds a communication line,
he or she must consider the risks in doing so.
(b) For the information systems that handle vital information, the information systemsecurity officer must consider and ensure the system capabilities to provide
performance required for the relevant communication lines and communicationequipment for the future.
(c) The information system security officer must establish the documents to be used forthe communication lines and communication equipment.
(d) The information system security officer must group the computers that are connectedwith the communication line and separate them on that communication line.
(e) The information system security officer must consider the communication
requirements among the grouped computers and use the communication equipment
and provide access control and route control in accordance with the communication
requirements.
(f) For the information systems that handle confidential information, the information
system security officer must consider whether encryption of the confidential
information sent or received using the communication line is required and if it isrequired, then he or she must encrypt it.
(g) For the information systems that handle classified information, the information systemsecurity officer must consider security and select physical lines used for thecommunication line.
(h) The information system security officer must ensure security of the connections thatare used in the services for remote maintenance or diagnosis work for thecommunication equipment.
(i) The information system security officer must take measures to protect thecommunication equipment against the announced security holes in the communicationequipment.
(j) The information system security officer must locate the communication equipment in
the secure area.
(k) In the case that a private line service provided by a carrier is used, the information
system security officer must stipulate the items including security and service levels in
the agreement.
(l) The information system security officer must consider whether audit trails are required- 54 -

for the communication equipment and if it is required, then he or she must collect it.
[ENHANCED Requirements](m) The information system security officer must authenticate the communicating
computers.
(n) For the information systems that handle vital information, the information systemsecurity officer must install the communication line or communication equipment thatis required to provide the services in a redundant configuration.
(2) Operating the communication line
[BASIC Requirements](a) The information system security administrator must manage the information including
the identification code of computers that use the communication line, combinations ofcomputer users and user identification codes, and user department of thecommunication line.
(b) In the case that the information system security administrator has made any changes in
the configurations or settings for items including communication line, communicationequipment, access control, or identification code, he or she must update the documents
used for the communication line and communication equipment. Also, he or she mustrecord such changes.
(c) The information system security officer must confirm the configurations or settings foritems including communication line, communication equipment, access control, or
identification code periodically. Also, he or she must identify the impact of thechanges on the security of the communication line and take appropriate measures.
(d) In the case that security of the information system is difficult to ensure for any reason,
the information system security officer must change the communication line from theshared configuration to the independent and closed configuration.
(e) The employee must not connect computers and communication equipment that are notapproved by the information system security officer to the communication line.
(f) The information system security officer must take measures to protect thecommunication equipment against the announced security holes to maintain an
appropriate security level for the communication equipment.
(g) The information system security administrator must synchronize the time of thecommunication equipment with the standard time of the information systems.
(3) Disposing of the communication lines[BASIC Requirements](a) In the case that the information system security officer disposes of the communicationequipment, he or she must make all the information stored in the internal storage
media of the communication equipment difficult to restore.

- 55 -

5.4.2 Management of Communication Lines in the Government Facilities
Compliance Requirements(1) Building the communication lines in the government agencies[ENHANCED Requirements](a) The information system security officer must take measures to confirm that thecomputers that are physically connected with the communication equipment havegained approval for connecting with the communication line before they are logicallyconnected with the communication line.
(2) Operating the communication line in the government agency[ENHANCED Requirements](a) The information system security officer must review the configurations of access
control when he or she changes the communication requirements and periodically.
(b) The information system security officer must check for security holes in thecommunication line and communication equipment periodically.
(c) For the information systems that handle vital information, the information systemsecurity administrator must confirm and analyze the utilization and state of thecommunication line daily to measure or detect any degradation or abnormality in thecommunication line.
(d) The information system security administrator must monitor the information that issent or received via the communication line in the government agency.
(3) Measures on the lines[BASIC Requirements](a) In the case that the information system security officer builds the VPN environment,
he or she must consider whether measures including the following are required and if
it is required, then he or she must take any of such measures.
(i)
Establishing the procedures to start or stop using the VPN environment(ii) Encrypting the information(iii) Identifying the communicating computers or authenticating the users(iv) Obtaining and managing the authentication records(v) Limiting the scope of communication lines which are accessible via VPN(vi) Assuring the confidentiality in the VPN connection method(vii) Managing the computers which use VPN(b) In the case that the information system security officer builds the wireless LAN
environment, he or she must consider whether measures including the following are
required and if it is required, then he or she must take any of such measures.
(i)
Establishing the procedures to start or stop using the LAN environment(ii) Encrypting the information- 56 -

Identifying the communicating computers or authenticating the users(iv) Obtaining and managing the authentication records(v) Limiting the scope of communication lines which are accessible via wirelessVPN(vi) Prohibiting connection with another communication line while connecting withthe wireless LAN(vii) Assuring the confidentiality in the wireless LAN connection method(viii) Managing the computers which connect with the wireless LAN(c) In the case that the information system security officer builds the remote accessenvironment via the public telephone network, he or she must consider whether
measures including the following are required and if it is required, then he or she musttake any of such measures.
(i)
Establishing the procedures to start or stop using the remote access environment(ii) Identifying and authenticating the communicating users or caller numbers(iii) Obtaining and managing the authentication(iv) Limiting the scope of communication lines which are accessible by remote
access(v) Prohibiting connecting with another communication line while accessing
remotely(vi) Assuring confidentiality in the remote access method(vii) Managing the computers which access remotely(iii)

5.4.3 Connecting with Communication lines outside the Government Agency
Compliance Requirements(1) Connecting the communication lines inside the government agency and the communicationlines outside the government agency[BASIC Requirements](a) The information system security officer must gain approval from the information
security officer to connect a communication line inside the government agency with acommunication line outside the government agency.
(b) In the case that the information security officer decides that the security of theinformation systems cannot be ensured when the communication line in thegovernment agency is connected with a communication line outside the government
agency, he or she must change the communication line inside the government agency
or the communication line outside the government agency from the sharedconfiguration to the independent configuration.
(2) Operating a communication line inside the government agency which is connected with acommunication line outside the government agency- 57 -

[BASIC Requirements](a) In the case that the information system security officer decides that security of theinformation systems cannot be ensured when a communication line in the government
agency is connected with a communication line outside the government agency, he or
she must change the communication line inside the government agency or thecommunication line outside the government agency from the shared configuration to
the independent configuration.
(b) The information system security officer must review the configurations for access
control when he or she changes the communication line and periodically.
(c) The information system security officer must periodically check for security holes in
the communication lines in the government agency and communication equipment thatcan be communicated from the communication lines outside the government agency.
(d) For the information systems that handle vital information, the information systemsecurity administrator must confirm and analyze the utilization and state ofcommunication lines daily to measure or detect degradation or abnormality in thecommunication line.
(e) The information system security administrator must monitor the information that is sent or
received via the communication lines in the government agency.

- 58 -

Chapter 6 Measures for Individual Consideration
6.1 Information Security Measures for Procurement and Development
6.1.1 Purchasing the equipment, etc.
Scope
This applies to purchases (including leases. This is applicable hereinafter) of the equipment, etc.
Compliance Requirements(1) Establishing the mechanism to ensure information security in the government agency[BASIC Requirements](a) The head of information security officers must formulate the selection criteria and therequirements for the equipment, etc. and review them appropriately.
(b) The head of information security officers must formulate the confirmation and test
procedure for the equipment, etc. in terms of information security measures.
(2) Following the procedures for purchasing the equipment, etc.
[BASIC Requirements](a) In the case that the information system security officer selects the equipment, etc., heor she must consider whether the equipment, etc. meets the selection criteria and therequirements for the equipment, etc. in order to make a selection.
(b) In the case that the equipment, etc. is delivered, the information system security officer
must confirm that the delivered equipment, etc. meets the selection criteria and therequirements for the equipment, etc. and add the confirmation to the inspection.
(c) The information system security officer must consider whether maintenance andcheck-up in terms of information security measures is required after the equipment, etc.
is delivered, and if it is required, then he or she must clarify the maintenance andcheck-up requirements and sign an agreement with the manufacturer of the equipment,
etc. or other service provider.
(d) In the case that there are required specifications for security functions to satisfy the
security requirements and the purchase is made by comprehensive evaluation of
bidders, the information system security officer must select the equipment, etc basedon whether it is certified according to Evaluation and Certification/Validation Scheme
under CCRA (Common Criteria Recognition Arrangement).

6.1.2 Outsourcing
Scope- 59 -

This is applied to the information processing tasks out of the job functions provided based on
section 29 of the accountancy law which stipulates leases, contracts, and other agreements,
including:z

Information processing such as compiling statistics, aggregation, entering data, and media
conversionz

Building the information systems (including software development, operation, ASP service,
maintenance, upgrade)z

Other examination and investigationz

Leasing the items (including device expansion, maintenance, server rental, housing)Compliance Requirements(1) Establishing the mechanism to ensure information security in the government agency[BASIC Requirements](a) The head of information security officers must establish the criteria to determine thescope of information systems that can be outsourced and the scope of information
assets that may be accessed by the contractors.
(b) The head of information security officers must decide the selection procedure,
selection criteria, and requirements for contractors (including implementation of
information security measures by contractor personnel)[ENHANCED Requirements](c) The head of information security officers must establish the procedure to evaluate theinformation security level of the contractor based on the international standards inorder to select a contractor more stringently.
(d) In the case that the head of information security officers selects a contractor, he or she
must confirm the information security level of the candidate contractors that meet the
information security requirements in accordance with the above evaluation procedure.
(2) Establishing the Information Security Measures to be applied to the contractors[BASIC Requirements](a) The information system security officer must formulate the information security
measures that the contractor must implement in the outsourced work and notify thecontractor in advance.
(b) The information system security officer must formulate the response procedure in thecase information security is violated in contracted work and notify the candidate
contractors in advance.
(c) The information system security officer must establish a procedure to evaluate how
well the information security measures are implemented by the contractor and notify
the response procedure in the event of poor implementation to the candidate
contractors.

- 60 -

(3) Following the procedure to select the outside contractor[BASIC Requirements](a) The information system security officer must select the contractor based on theformulated procedure, criteria, and requirements of contractor.
(4) Following the procedure to outsource works[BASIC Requirements](a) The information system security officer must sign an outsourcing agreement with thecontractor that stipulates implementation of the information security measures in thecontracted work, nondisclosure (including prohibiting use of information for
non-business purposes), response procedures in the case of information security
breaches or poor implementation of information security measures. Also, he or sheshould include the following items in the agreement as needed:(i) To enforce the contractor to undergo the information security audit(ii) To enforce the contractor to guarantee to meet the service level agreement(b) The information system security officer must clarify the responsibilities of both parties
for the outsourcing agreement, build consensus, and request the contractor to present
the confirmation note about how the information security measures will be
implemented and managed. Also, he or she must include the following description in
the confirmation note as needed:(i)
The contractor personnel shall (perform specific actions) in order to implement
the information security measures.
(ii) The contractor shall identify the personnel who engage in the outsourced workand prohibit other personnel from engaging in the work(c) The information system security officer must judge whether to renew the outsourcing
agreement based on the procedure, criteria, and requirements for the contractor on acase-by-case basis but must not take the decision to renew lightly.
(d) The information system security officer must consider whether to change the services
that are provided by the contractor (including maintaining and improving the basic
policy for information security, operation procedures, and management procedure)
based on the procedure, criteria, and requirements for the contractor.
(e) The information security officer must prohibit the contractor from subcontracting allor part of the outsourced work to a third party. However, this is not always required if
the information system security officer receives explanations from the contractor anddecides that information security is ensured measures to be taken to protect against thepotential dangers from subcontracting.
(f) The employee must provide the required minimum information to the contractor andmeet the following requirements in the case that the contractor handles any
confidential information:(i) In the case that the employee transfers information to the contractor, he or she- 61 -

must do so in a secure manner by masking any unnecessary parts or encrypting,etc. and keep a record of the transfer.
(ii) In the case that the contractor does not need information any longer because theoutsourced work is complete, etc., he or she must return or dispose of it.
(5) Following procedures to terminate the outsourcing[BASIC Requirements](a) The information system security officer must confirm the information security
measures implemented in the outsourced work when he or she terminates theoutsourcing and adds the confirmation to the inspection.

6.1.3 Software Development
Compliance Requirements(1) Establishing the system for software development[BASIC Requirements](a) The information system security officer must require the person who is responsible for
information systems to establish the system for software development designed tocomply with the information security measures (to meet the compliance requirementsof (2) to (5).)(b) In the case that the information system security officer outsources softwaredevelopment, he or she must select necessary information security measures (or thecompliance requirements of (2) to (5)) that should be implemented by the contractor
and ensure that such implementation is assured by the contractor.
(2) Starting software development[BASIC Requirements](a) The information system security officer must define the procedure and environment
for each phase of software development in terms of information security.
(b) The information system security officer must consider whether separating theinformation system that is used for software development and testing from theoperating information system is required in terms of information security and if it isrequired, then he or she must separate them.
(3) Designing the software[BASIC Requirements](a) The information system security officer must consider whether any security function isrequired, and if it is required, then he or she must design the function appropriately
and clearly describe it in the design document based on the analysis of measured- 62 -

(b)

(c)

(d)

(e)

dangers connected with the information assets to be used in the operation of thesoftware to be developed and the classification of information that is handled by thesoftware.
The information system security officer must consider whether a function to manage
the security functions for operation of the software to be developed is required, and if
it is required, then he or she must design the function appropriately and clearly
describe it in the design document.
The information system security officer must define the scope and procedure of review
to confirm the validity of information security in software design and review it
accordingly.
The information system security officer must consider whether a function to confirm
the validity of information security in the data processed or input-output by thesoftware to be developed is required and if it is required, then he or she must design
the function appropriately and clearly describe it in the design document.
In the case that there are any important security requirements for the software to be
developed, the information system security officer must request a security target (ST)evaluation and confirmation by the third-party organization for the purpose of thedesign of security functions to meet them. However, in the case that he or she
undergoes the ST evaluation and confirmation for the information system that contains
the relevant software and he or she updates the software and there are only minorchanges of important security requirements in the reviewed security target, such
evaluation and confirmation are not always required.

(4) Developing the software[BASIC Requirements](a) The information system security officer must protect against unnecessary access andmake a back-up of the source code that is formulated by the software developer.
(b) The information system security officer must define the rule for coding in terms of
information security.
[ENHANCED Requirements](c) The information system security officer must define the scope and procedure of review
to confirm the validity of the formulated source code and review it accordingly.
(5) Testing the software[BASIC Requirements](a) The information system security officer must consider whether any testing is requiredin terms of security, and if it is required, then he or she must define the items andprocedure of testing and conduct the test.
(b) The information system security officer must record the test that is conducted in termsof information security.

- 63 -

6.2 Specific Restrictions
6.2.1 Restrictions on Information Processing outside the Government Facility
Compliance Requirements(1) Establishing the Security Measures[BASIC Requirements](a) The head of information security officers must define the procedures on security
measures for processing classified information outside the government agency.
(b) The head of information security officers must define the procedures on security
measures for bringing the information systems that handle classified information
outside the government agency.
(2) Gaining approval, notifying, and management[BASIC Requirements](a) In the case that the employee processes classified information (except confidentiality
class-2 information) outside the government agency, he or she must gain approval
from the information system security officer or the division/office information security
officer.
(b) In the case that the employee processes confidentiality class-2 information outside thegovernment agency, he or she must notify the information system security officer orthe division/office information security officer.
(c) The information system security officer and the division/office information security
officer must record processing of classified information that is done outside thegovernment agency.
(d) In the case that the information system security officer or the division/office
information security officer does not receive a report of expiration when the approved
period for processing classified information (except confidentiality class-2
information) outside the government agency expires, he or she must confirm the state
and take appropriate measures. However, this is not always required if the person who
has given approval does not require reporting.
(e) In the case that the notified period for processing confidentiality class-2 information
outside the government agency expires, the information system security officer or thedivision/office information security officer must confirm the state and take appropriate
measures as needed.
(f) In the case that the employee processes classified information outside the government
agency, he or she must process the minimum information required for executing his or
her tasks.
(g) In the case that the employee brings the information systems that handle classified
information (except confidentiality class-2 information) outside the government- 64 -

(h)

(i)

(j)

(k)

(l)

agency, he or she must gain approval from the information system security officer orthe division/office information security officer.
In the case that the employee brings the information systems that handle
confidentiality class-2 information outside the government agency, he or she must
notify the information system security officer or the division/office information
security officer.
The information system security officer and the division/office information security
officer must record bringing the information systems that handle classified information
outside the government agency.
In the case that the information system security officer or the division/office
information security officer does not receive a report of expiration when the approved
period for bringing classified information (except confidentiality class-2 information)
outside the government agency expires, he or she must confirm the state and takeappropriate measures. However, this is not always required if the person who hasgiven approval does not require reporting.
In the case that the notified period for bringing confidentiality class-2 information
outside the government agency expires, the information system security officer or thedivision/office information security officer must confirm the state and take appropriate
measures as needed.
In the case that the employee brings the information systems that handle classified
information outside the government agency, he or she must take the minimum amountof information systems required for executing his or her tasks.

(3) Implementing the Security Measures[BASIC Requirements](a) The employee must take the security measures that are formulated for processingclassified information outside the government agency.
(b) In the case that the approved period for processing classified information (except
confidentiality class-2 information) outside the government agency expires, theemployee must report this to the person who has given approval. However, this is notalways required if the person who has given approval does not require reporting.
(c) The employee must take the security measures that are formulated for bringing theinformation systems that handle classified information outside the government agency.
(d) In the case that the approved period for bringing the information systems that handle
classified information (except confidentiality class-2 information) outside thegovernment agency expires, the employee must report this to the person who has given
approval. However, this is not always required if the person who has given approval
does not require reporting.

- 65 -

6.2.2 Restrictions on Information Processing Using Information Systems Not
Supplied by the Government Agency
Compliance Requirements(1) Establishing the Security Measures[BASIC Requirements](a) The head of information security officers must define the procedures on security
measures for processing classified information using the information systems not
supplied by the government (unsupplied information systems).
(2) Gaining approval, notifying, and management[BASIC Requirements](a) In the case that processing classified information (except confidentiality class-2
information) using the unsupplied information systems is required, the employee must
gain approval from the information system security officer or the division/office
information security officer.
(b) In the case that processing confidentiality class-2 information using the unsupplied
information systems is required, the employee must notify the information systemsecurity officer or the division/office information security officer.
(c) The information system security officer and the division/office information security
officer must record processing of classified information which is done using theunsupplied information systems.
(d) In the case that the information system security officer or the division/office
information security officer does not receive a report of expiration when the approved
period for processing classified information (except confidentiality class-2
information) using the unsupplied information systems expires, he or she must confirm
the state and take appropriate measures. However, this is not always required if theperson who has given approval does not require reporting.
(e) In the case that the notified period for processing confidentiality class-2 information
using the unsupplied information systems expires, the information system security
officer or the division/office information security officer must confirm the state andtake appropriate measures as needed.
(3) Implementing the Security Measures[BASIC Requirements](a) In the case that the employee processes classified information using the unsupplied
information systems, he or she must in principle take the security measures that areformulated for the relevant information systems.
(b) In the case that the approved period for processing classified information (except
confidentiality class-2 information) using the unsupplied information systems expires,- 66 -

the employee must report this to the person who has given approval. However, this is
not always required if the person who has given approval does not require reporting.

- 67 -

6.3 Miscellaneous
6.3.1 Preventing actions that lower the Information Security Level outside theGovernment Agency
Compliance Requirements(1) Establishing the measures[BASIC Requirements](a) The head of information security officers must define the procedures for measures toprevent actions that would lower the level of information security outside thegovernment agency.
(2) Implementing the measures[BASIC Requirements](a) In principle, the employee must take measures to prevent actions that would lower thelevel of information security outside the government agency.

6.3.2 Consistent Operation with the Business Continuity Plan (BCP)
ScopeThis applies to the government agencies that establish or will establish a BCP.
Compliance Requirements(1) Understanding the preparation plan for a BCP in the government[BASIC Requirements](a) The chief information security officer must establish the system so that the information
security committee is kept regularly informed of a government agency BCP
preparation plan via the head of information security officers.
(b) In the case that the head of information security officers understands the preparation
plan for a BCP in the government agency, he or she must report it to the information
security committee, and as needed, to the information security officer, the information
system security officers and the division/office information security officers.
(2) Ensuring consistency between the BCP and the Information Security Measures[BASIC Requirements](a) In the case that there is any preparation plan for a BCP or the standards for measures
implemented by the government agency, the information security committee mustensure the consistency between the BCP and the standards for measures implemented
by the government agency.
(b) In the case that there is any preparation plan for a BCP in the government agency, the- 68 -

head of information security officers, the information security officer, the information
system security officer, and the division/office information security officer must
consider whether each information system is related with the relevant BCP.
(c) In the case that there is any preparation plan for the BCP in the government agency,
the head of information security officers, the information security officer, theinformation system security officer, and the division/office information security officer
must establish the following common procedures based on the BCP and the standards
for measures implemented by the government agency for the information systems thatthey believe are related with the relevant BCP.
(i) In order to operate common requirements for the BCP and the standards formeasures implemented by the government agency consistently during normal
operation, necessary reviews must be conducted for the common procedures in
information security measures.
(ii) In order to understand the compliance requirements of information security
measures that can prevent the BCP and standards for measures implemented by
the government agency from being implemented in the case of malfunction andenable consistent operation, the procedures for malfunction handling must be
formulated.
(3) Reporting inconsistency between the BCP and the information security rules[BASIC Requirements](a) In the case that there is any preparation plan for a BCP in the government agency and

it is difficult to determine whether a measure should be taken or not because ofinconsistent requirements between the BCP and the information security rules, theemployee must notify the relevant parties and, in order to receive further instructions,
report this to the information security officer using the reporting procedure for malfunction
handling which the head of information security officers has established.

- 69 -