Common Standards for Cybersecurity
Measures for
Government Agencies and Related Agencies(FY2021)

July 7, 2021
Established by the Cybersecurity Strategic Headquarters

Table of contents
Chapter 1 General Provisions............................................................................................................. 1
1.1
Purpose and Scope of these Common Standards for Measures .................................... 1(1) Purpose of these Standards ........................................................................................ 1(2) Scope of these Standards............................................................................................ 1(3) Revisions of these Standards ..................................................................................... 1(4) Co mpliance with laws and regulations..................................................................... 2(5) Contents of the measures............................................................................................ 2
1.2
Classification of Information and Handling Restrictions............................................... 2(1) Classification of informat ion ..................................................................................... 2(2) Types of handling restrictions.................................................................................... 4
1.3
Defin ition of Terms.............................................................................................................. 5
Chapter 2 Basic Framework of Information Security Measures ............................................... 9
2.1
Introduction and Plan .......................................................................................................... 9
2.1.1 Establishment of organizations and systems .................................................................... 9(1) Designation of the chief information security officer and deputy chief
information security officer ....................................................................................... 9(2) Establishment of the Information Security Co mmittee.......................................... 9(3) Designation of the chief informat ion security auditor ......................................... 10(4) Designation of the head information security officer and information
security officers ......................................................................................................... 10(5) Designation of the chief informat ion security advisor......................................... 10(6) Establishment of an information security measure promotion structure........... 10(7) Establishment of the system for information security incidents......................... 10(8) The roles that should not be concurrently undertaken by the same person ...... 11
2.1.2 Establishment of standards for measures and promotion plan of measures .............. 11(1) Establishment of the government agency’s own standards................................. 11(2) Establishment of the promotion plan of measures................................................ 11
2.2
Operation ............................................................................................................................. 122.2.1 Enforcement of information security related provisions .............................................. 12(1) Operation of information security measures ........................................................ 12(2) Handling violations ................................................................................................... 13
2.2.2 Exceptional measures ........................................................................................................ 13(1) Maintenance of exceptional measures.................................................................... 13(2) Operation of exceptional measure........................................................................... 13
2.2.3 Education............................................................................................................................. 14(1) Establishment of structures for information security measures education andformulation of education implementation plans ................................................... 14(2) Enforcement of information security measures education .................................. 14
2.2.4 Handling of information security incidents.................................................................... 15(1) Preparation for information security incidents...................................................... 15(2) Handling of information security incidents ........................................................... 15(3) Prevention of recurrence of information security incidents and sharing oflessons learned ........................................................................................................... 16
2.3
Assessment.......................................................................................................................... 17
2.3.1 Self-check of information security measures................................................................. 17(1) Formu lation of self-check plans and establishment of procedures .................... 17(2) Conducting self-check .............................................................................................. 17(3) Evaluations and improvements based on self-check ............................................ 17
2.3.2 Informat ion security audit................................................................................................. 18(1) Formu lation of audit plans ....................................................................................... 18

2.4
2.4.1

(2) Conducting information security audit................................................................... 18(3) Responding to audit results ...................................................................................... 18
Review ................................................................................................................................. 19
Review of information Security measures ..................................................................... 19(1) Review of information security related provisions............................................... 19(2) Review of promotion plan of measures.................................................................. 19

Chapter 3 Information Handling .....................................................................................................20
3.1
Informat ion Handling ........................................................................................................ 20
3.1.1 Informat ion handling ......................................................................................................... 20(1) Maintenance of provisions related to informat ion handling ............................... 20(2) Prohibition of use or handling of information for non-job related purposes .... 20(3) Determination and labeling, etc. of classifications and handling restrictionsof information ............................................................................................................ 21(4) Use and storage of information ............................................................................... 21(5) Provision and disclosure of information ................................................................ 22(6) Transportation and transmission of information ................................................... 22(7) Deletion of informat ion ............................................................................................ 23(8) Backup of information .............................................................................................. 23
3.2
Informat ion Handling Areas ............................................................................................. 23
3.2.1 Informat ion handling areas ............................................................................................... 23(1) Determine the standards for measures for the areas requiring control
measures ..................................................................................................................... 23(2) Determine the measures to be implemented in each area.................................... 24(3) Implementation of measures for the areas requiring control measures ............. 24
Chapter 4 Outsourcing .......................................................................................................................25
4.1
Subcontracting .................................................................................................................... 25
4.1.1 Subcontractingt................................................................................................................... 25(1) Maintenance/establishment of provisions related to subcontracting ................. 25(2) Subcontracting agreements ...................................................................................... 26(3) Implementation of measures by subcontractors.................................................... 27(4) Informat ion handling when subcontracting tasks ................................................. 27
4.2
Use of External Services ................................................................................................... 27
4.2.1 External services to handle confidential information ................................................... 27(1) Maintenance/establishment of provisions related to use of external services .. 28(2) Selection of external services (in cases of cloud services).................................. 29(3) Selection of external services (in cases of non-cloud services).......................... 29(4) Procurement and contract for use of external services ........................................ 31(5) Approval for use of external services ..................................................................... 31(6) Measures for implementing and building information systems on external
service infrastructure................................................................................................. 31(7) Measures for operation and maintenance of information systems by the useof external services.................................................................................................... 32(8) Measures for renewal or disposal of information systems by the use of
external services ........................................................................................................ 32
4.2.2 External services to handle non-confidential information only .................................. 33(1) Maintenance/establishment of provisions related to use of external services .. 33(2) Implementation of measures for use of external services.................................... 33
Chapter 5 Lifecycle of Information Systems.................................................................................34
5.1
Maintenance of Documents and Inventories of Information Systems ....................... 34
5.1.1 Maintenance of documents and inventories of information systems.......................... 34(1) Maintenance of information system inventories................................................... 34(2) Maintenance of documents related to information systems ................................ 34

5.1.2
5.2
5.2.1

5.2.2

5.2.3
5.2.4
5.2.5
5.3
5.3.1

Establishment/maintenance of provisions related to procurement of equipment,
etc. ........................................................................................................................................ 34(1) Maintenance of provisions related to procurement of equipment, etc............... 35
Measures at Each Phase of Informat ion System Lifecycle .......................................... 35
Planning and definition of requirements for information systems.............................. 35(1) Ensuring the implementation of frameworks ........................................................ 35(2) Formu lation of security requirements for information systems.......................... 36(3) Measures when subcontracting the construction of information systems ......... 37(4) Measures when subcontracting the operation and maintenance of
information systems .................................................................................................. 37
Procurement and construction of information systems ................................................ 37(1) Measures when selecting equipment, etc............................................................... 37(2) Measures when constructing information systems ............................................... 37(3) Measures for inspections on delivery ..................................................................... 38
Operation and maintenance of information security..................................................... 38(1) Measures for information systems during operation and maintenance ............. 38
Update and disposal of information systems ................................................................. 39(1) Measures for update and disposal of information systems.................................. 39
Review on measures for information systems ............................................................... 39(1) Review on measures for information systems....................................................... 39
Operational Continuity Plan of Information Systems................................................... 39
Ensuring consistency between information security measures for information
systems and the systems’ operational continuity plans................................................. 39(1) Ensuring consistency between information security measures for
information systems and the systems’ operational continuity plans .................. 40

Chapter 6 Security Requirements for Information Systems .....................................................41
6.1
Security Functions of Information Systems ................................................................... 41
6.1.1 User/entity authentication functions................................................................................ 41(1) Implementation of the user/entity authentication functions ................................ 41(2) Management of the identification code and the user/entity authentication
information ................................................................................................................. 41
6.1.2 Access control functions ................................................................................................... 41(1) Implementation of access control functions .......................................................... 42
6.1.3 Authority control................................................................................................................ 42(1) Authority control....................................................................................................... 42
6.1.4 System logs retrieval and management........................................................................... 42(1) Event logs retrieval and management..................................................................... 43
6.1.5 Encryption and digital signatures .................................................................................... 43(1) Implementation of encryption and digital signature functions ........................... 43(2) Management of encryption and digital signature ................................................. 44
6.2
Measures against Information Security Threats ............................................................ 44
6.2.1 Measures against software vulnerabilit ies...................................................................... 44(1) Implementation of measures against software vulnerabilities ............................ 45
6.2.2 Measures for protection against malware ....................................................................... 45(1) Implementations of measures against malware..................................................... 45
6.2.3 Measures against denial-of-service attacks .................................................................... 46(1) Implementation of measures for denial-of-service attacks.................................. 46
6.2.4 Measures against targeted attacks.................................................................................... 46(1) Implementation of measures for targeted attacks ................................................. 47
6.3
Creation and provision of applications and contents .................................................... 47
6.3.1 Measures upon creating applications and contents ....................................................... 47(1) Establishment/maintenance of provisions related to creation of applications
and contents................................................................................................................ 47

6.3.2(2) Formu lation of security requirements for applications and contents ................. 48
Measures upon providing applications and contents .................................................... 48(1) Use of government domain name ........................................................................... 48(2) Prevention of users from being lured to malicious websites............................... 49(3) Notification of applications and contents .............................................................. 49

Chapter 7 Information Systems Components...............................................................................50
7.1
Terminals, Server Equip ment ........................................................................................... 50
7.1.1 Terminals ............................................................................................................................. 50(1) Measures when introducing terminals.................................................................... 50(2) Measures when operating the terminals ................................................................. 50(3) Measures when terminating the operation of terminals ....................................... 51(4) Measures for the adoption and use of Agency-furnished terminals (onlywhen used outside of areas requiring control measures) ..................................... 51(5) Measures for the adoption and use of non-Agency-furnished terminals........... 51
7.1.2 Server equipment ............................................................................................................... 53(1) Measures when implementing server equipment.................................................. 53(2) Measures when operating the server equipment................................................... 54(3) Measures when terminating the operation of server equipment......................... 54
7.1.3 Multifunction devices and equipment for specific purposes ....................................... 54(1) Multifunction devices ............................................................................................... 55(2) Equip ment for specific purposes, including IoT devices..................................... 55
7.2
E-mail, Web, and others .................................................................................................... 55
7.2.1 E-mail .................................................................................................................................. 55(1) Measures when introducing e-mail services.......................................................... 55
7.2.2 Web ...................................................................................................................................... 56(1) Measures when introducing and operating webservers ....................................... 56(2) Measures when developing and operating web applications .............................. 56
7.2.3 Domain Name Systems ..................................................................................................... 56(1) Measures when introducing the DNS..................................................................... 57(2) Measures when operating the DNS ........................................................................ 57
7.2.4 Database .............................................................................................................................. 57(1) Measures when implementing or operating the database.................................... 58
7.3
Co mmunication Lines ....................................................................................................... 58
7.3.1 Co mmunication lines......................................................................................................... 58(1) Measures when installing communication lines ................................................... 58(2) Measures when operating communication lines ................................................... 59(3) Measures when terminating the operation of communication lines................... 60(4) Measures when introducing wireless LAN environments................................... 60
7.3.2 IPv6 co mmunication lines ................................................................................................ 60(1) Measures related to information systems with IPv6 communications .............. 61(2) Control and monitor for unintended IPv6 communications ................................ 61
Chapter 8 Use of Information Systems...........................................................................................62
8.1
Use of Information Systems ............................................................................................. 62
8.1.1 Use of information systems .............................................................................................. 62(1) Establishment/maintenance of provisions related to the use of information
systems........................................................................................................................ 62(2) Measures to encourage information systems users to comply with theprovisions ................................................................................................................... 62(3) Basic measures for the use of information systems.............................................. 63(4) Measures when using e-mail and web.................................................................... 64(5) Handling of identification codes and user/entity authentication information... 64(6) Measures for the use of encryption and digital signatures .................................. 65(7) Prevention of malware infection ............................................................................. 65

8.1.2
8.1.3(8) Measures when a web conference services is used .............................................. 65
Dissemination of information via social media services .............................................. 65(1) Measures for dissemination of information via social media services .............. 66
Teleworking ........................................................................................................................ 66(1) Establishment of operative provisions ................................................................... 67(2) Measures for teleworking environment.................................................................. 67(3) Measures for teleworking operations ..................................................................... 67

Chapter 1
1.1

General Provisions

Purpose and Scope of these Common Standards for Measures(1) Purpose of these Standards
The basic principal of information security is to ensure “confidentiality”, “integrity”, and“availability” of the information handled by Agencies according to the degree of importance of
information, and it is a fundamental responsibility for each government agency to duly
implement measures to ensure information security. However, under the current circumstanceswhere the Agencies use and share the common IT environment as well as information, it isnecessary to formulate a unified framework to raise the level of information security standards
across the agencies.
These Common Standards constitute information security measures deemed necessary in ashared manner across all of the Agencies. Their purpose is to strive to uniformly raise the levelof information security of Agencies by regulating matters that the Agencies must comply withfor each information security measure (hereinafter referred to as “requirements”) as necessary
conditions for implementing the Common Model within the common framework for Agencies
in accordance with the Common Model of Cybersecurity Measures for Agencies (established by
the Cybersecurity Strategic Headquarters).
(2) Scope of these Standards(a) These Standards shall apply to all employees engaged in administrative services at
Agencies.
(b) These Standards shall apply to the information defined below:(i)

Information recorded on the systems for providing information processing orcommunication, or on external electromagnetic recording media procured ordeveloped by the Agencies to be used by employees to perform their duties (including
information described on a paper outputted from the said system or information
inputted into information system).

(ii)

Information for use of employees, recorded on other information systems or otherexternal storage media (including the information printed out from, or input in thesystem).

(iii) In addition to (i) and (ii), information concerning the design or operational
management of the system procured or developed by Agencies.
(c) These Standards shall apply to all information systems which process the information
stipulated herein.
(3) Revisions of these Standards
It is important to precisely understand changes in circumstances and accordingly review
information security measures to maintain an appropriate level of information security. Therefore,
these Standards shall be regularly reviewed and necessary additions and amendments shall bemade according to information technology development.

(4) Compliance with laws and regulations
When taking information security measures, laws and regulations which stipulate handling of
information and information systems (hereinafter referred to as “relevant laws and regulations”)
should be respected in addition to these standards. These Standards provide no reference to such
relevant laws and regulations, as they should be respected regardless of information security
measures. Equally the government's resolutions set forth in response to changing environmentof information security should be duly observed.
(5) Contents of the measures
In these Common Standards, measures to be implemented by Agencies are classified into threelayers, namely chapters, sections, and items according to the purpose, with the purposes, generalintent, and requirements specified for each item.
The Guidelines for Establishing Agencies’ Standards for Information Security Measuresformulated separately by the NISC enumerate basic measures that must be taken in order to meetthe requirements of the Common Standards (hereinafter referred to as “basic measures”), while
also offering explanations of the approaches for formulating and implementing standards. Since
the basic measures comply with the requirements, Agencies must meet the corresponding
requirements by taking the measures enumerated in the basic measures or measures that are equal
to or greater than these.
In addition, Agencies must set in place implementation procedures to implement measuresprescribed in the standards they formulated.

1.2

Classification of Information and Handling Restrictions(1) Classification of information
These Standards classify information in three aspects namely confidentiality, integrity, andavailability, whose definition are shown below.
When changing or adding the definitions of classifications at Agencies, each Agency must handle
information categorized according to the definitions below via a level of security established in
the requirements of these Common Standards or an equal or greater level of security. When
providing information to other Agencies, Agencies must ensure that they appropriately
communicate regarding the classifications set forth in their own standards, as well as responses
for the classifications in these Common Standards.
Classifications for confidentiality
Classification

Classification criteria

Confidentiality class- Among information handled as part of the work of national
3 information
administrative organs, information required to be handled asconfidential documents prescribed in the Guidelines forManagement of Administrative Documents (decided by thePrime Minister, on April 1, 2011; hereinafter referred to as"Document Management Guidelines")
Among information handled as part of the work of Incorporated
Administrative Agencies and Designated Corporations,information corresponding to the above
Confidentiality class- Among information handled as part of the work of national
2 information
administrative organs, except for Confidentiality class-3
information, items which include information with highprobability of being regarded as Non-Disclosure Information
stipulated in Article 5 of the Act on Access to Information Heldby Administrative Organs (Act No. 42 of 1999; hereinafterreferred to as "Information Disclosure Act").
Among information handled as part of the work of Incorporated
Administrative Agencies, except for confidentiality class-3
information, items which include information with highprobability of being regarded as Non-Disclosure Information ineach item of Article 5 of the Act on the Protection of Personal
Information Held by Incorporated Administrative Agencies,
etc. (Act No. 140 of 2001; hereinafter referred to as the“Incorporated Administrative Agencies, etc. Information
Disclosure Act”). Moreover, the same shall apply to those
Designated Corporations that are listed in Appendix I of theIncorporated Administrative Agencies, etc. Information
Disclosure Act (hereinafter referred to as “DesignatedCorporations listed in the appendix”).
Among information handled as part of the work of DesignatedCorporations other than Designated Corporations listed in the
appendix, information corresponding to the above.
Confidentiality class- Among information handled as part of the work of national
1 information
administrative organs, information which does not include items
which should be regarded as Non-Disclosure Information
stipulated in each paragraph of Article 5 of the Information
Disclosure Act.
Among information handled as part of the work of Incorporated
Administrative Agencies or Designated Corporations listed in
the appendix, information which does not include items whichshould be regarded as Non-Disclosure Information stipulated ineach paragraph of Article 5 of the Information Disclosure Act.
Among information handled as part of the work of DesignatedCorporations other than Designated Corporations listed in the
appendix, information corresponding to the above.
Information which comes under Confidentiality class-2 information and Confidentiality
class-3 information is called “confidential information”.

Classifications for integrity

Classification

Classification criteria

Integrity class-2
information

Among information for administrative use (except for written
information), items whose manipulation, errors, and damage
may infringe citizens' rights or hamper proper administrative
operations (except for negligible cases).

Integrity class-1
information

Information other than Integrity class-2 information (except for
written information)

Note that Integrity class-2 is called “critical information”.
Classifications for availability
Classification

Classification criteria

Availability class-2
information

Among information for administrative use (except for written
information), items whose disappearance, loss, or
unavailability may infringe citizens' rights or stableadministrative operations (except for negligible cases).

Availability class-1
information

Information other than Integrity class-2 information (except
written information.)

Note that Availability class-2 information is called “vital information”.
Also, information classified as any of confidential information, critical information, orvital information is called “classified information”.
(2) Types of handling restrictions“Handling restrictions” means restrictions to ensure proper handling of information by
employees, such as to prohibit copying, removing, and distributing information, as well as
mandatory encryption and disposal of the data after use.
The employees should appropriately handle the information according to its classification, andfollow the types of handling restrictions to demonstrate proper and practical handling of theinformation. Agencies should set forth the basic definitions of handling restrictions fromperspectives of three aspects, namely confidentiality, integrity, and availability.

1.3

Definition of Terms【A】
“Applications and contents” means a collective term for application programs, web contents andso forth.

“Areas requiring control measures” means areas under the control of the Agencies (including
facilities leased by said Agency from external Agencies), where control measures for thefacilities and work environment are required to protect information handled.

【C】
“Cloud services” means a capabilities which is offered via a paradigm for enabling network
access to scalable and elastic pool of shareable physical or virtual resource with self-service
provisioning and administration on-demand, by the provider-defined interface, and is flexible
about setting of information security condition adequately.

“Common platform system” means information system shared by multiple agencies, excluding
such information systems whose entire operations including hardware and software arecontrolled and managed by a single agency.

“Communication line” means mechanisms for transmitting and receiving information among
several information systems, and also among several equipment (including devices notpurchased by Agencies), as well as between information systems and equipment, usingprescribed communication protocol. Unless otherwise specified, it is a generic term referring to
the communication lines used for information systems at Agencies. Communication line
includes the one which is not directly managed by Agencies and also includes all connections
regardless of their types (such as wire or wireless, physical or virtual).

“Communication line equipment” means a device which connects communication lines, as wellas communication lines and information systems, and controls information transmitted andreceived over these lines. Communication line equipment includes hubs, switches, routers, andfirewalls.

“Communication line inside the Agencies” means a communication line used forcommunication between the server equipment and terminals managed by an Agency, which has
no logical connection with the server equipment and terminals not being managed by said
Agency. Communication lines inside the Agency also include those physical lines that are not
managed by the Agency, such as proprietary lines and VPNs.

“Communication line outside the Agency” means a communication line other than“Communication line inside the Agency”.

“Subcontracting” means subcontracting part or all of tasks of an Agency, including all forms ofagreement such as “mandate,” “quasi-mandate,” or “contract”; however, only when the
Agency’s information is handled in those tasks.

“Cryptographic erasure” means a logical deletion method that disables decryption of
information encrypted and recorded on an electromagnetic recording medium by erasing the key
used to decrypt the information and makes the information unavailable when information
erasure is required. Examples of encryption features used for cryptographic erasure include

encryption by software (Windows’s BitLocker, etc.), and encryption by hardware (SelfEncryption Drive, etc.).
“CSIRT” means a system established at Agencies to respond to information security incidents
which occur therein. An acronym for Computer Security Incident Response Team.

“CYMAT” means a system established in the National center of Incident readiness andStrategy for Cybersecurity which provides proactive support for information security incidents
which require unified actions with the government, in the event of, or fear of information
security failure at Agencies due to cyber-attacks and so forth. An acronym for Cyber Incident
Mobile Assistance Team (information security emergency support team).

【E】
“Employees” means legal employees such as government officials engaged in administrative
work at national administrative organs, executives of Incorporated Administrative Agencies andDesignated Corporations engaged in the work of said Agencies, and other people serving under
the supervision of other Agencies who handle information and information systems managed by
the Agencies. Employees also include dispatched workers and trainees accepted temporarily,
though it depends on individual work conditions.

“Equipment, etc.” means a collective term for information systems components (such as servers,
terminals, communication line equipment, multiple function devices and other apparatus for
specified purposes, and software), as well as external storage media.

“Equipment for specific purposes” means information system components for specific purposes
as in the systems for TV conference, IP phones, network cameras, entry control systems, facility
management systems, environment monitoring systems, and so forth, which are connected tocommunication lines or equipped with built-in electromagnetic recording media.

“Erasure” -> See “Information erasure”

“External service” means a service through which any person other than Agencies provides thegeneral public with part or all of information system functions; however, only when information
on Agencies is handled in those functions.

“External service administrator” means a person engaging in the management of an external
service as designated by the person authorized to permit use applications when approval is given
for the use of the external service.

“External service provider” means an operator providing an external service. An operator
providing Agencies with its own service by using an external service is not included.

“External service users” mean employees of Agencies who use an external service, or in casesof subcontracting, employees of a subcontractor when the external service is used by thesubcontractor.

【G】
“Government agency’s own standards” means standards for information security measures toensure information security of information and systems at Agencies.

“Government domain name” means a domain name ending with “.go.jp.” Government agencies,
Incorporated Administrative Agencies, and special corporations (except for special companies)
may register (acquire) this domain name.

【I】
“Implementation procedures” means practical procedures need to be determined beforehand to
implement the measures prescribed in the standards for measures for individual information
systems and tasks of Agencies.

“Information” means the information set forth in 1.1. (2) (b) of these Standards.

“Information erasure” means to make all the information recorded in external storage media
unusable and unrestorable. Erasing information shall mean deletion of information as well as
cryptographic erasure using a cryptographic algorithm whose safety is confirmed by
Cryptography Research and Evaluation Committees (CRYPTREC) and physical destruction of
the storage media containing the information. If the information can be recovered by revoking
deletion or using a recovery tool, it cannot be referred to as “Information erasure”.

“Information security rules” is a collective term for all standards for measures and operational
procedures implemented by Agencies.

“Information security incidents” means information security incidents set forth in JIS Q
27000:2019.

“Information security measure promotion structures” mean structures established within the
Agencies in order to perform duties related to promoting the information security measures of
the Agencies in question.

“Information system” means systems consist of hardware and software (including thosemanaged by outsourcing subcontractors), which are used for information processing orcommunications, and developed and procured by Agencies unless otherwise specified.

【L】
“Labeling, etc.” means a measure to make information's classification clear to all who handle
the information. This means to display the classification of information and any other actions tomake the information classification a common knowledge. One of the examples of such measureis, to indicate the classifications of information recorded in a specific information system bydescribing them in regulations, and to make them known to all the users of said system.

【M】
“Malware” (a short form for malicious programs or software) means software in general whichcauses unsolicited results to information systems such as computer viruses, worms (not parasitic

but self-replicating program), and spywares (program which collects various information against
users’ will).
“Mobile terminal” means, regardless of its type, a terminal designed to be carried aroundaccording to users’ business needs.

【N】
“National administrative organs” collectively refers to organizations stipulated by law andestablished within or under jurisdiction of the Cabinet, the Imperial Household Agency,organizations stipulated in Article 49 Paragraph (1) or (2) of the Act for Establishment of the
Cabinet Office (Act No. 89 of 1999), organizations stipulated in Article 3 Paragraph (2) of the
National Government Organization Act (Act No. 120 of 1948), or other organizations which fallunder these organizations.

【S】
“Server equipment” means the components of information system which provide own services
to terminals and other devices getting access to it via communication lines and other means(including components such as pre-loaded software, built-in mouse and keyboard), and unlessotherwise specified those procured or developed by Agencies.

“Storage media” means media in which information is recorded or written. Storage media
includes written document, and any paper or other tangible objects on which humanrecognizable information such as characters or diagrams are written (hereinafter referred to as“hardcopies”), and those on which information unrecognizable by human is recorded
electronically or magnetically, and are processed by computers (hereinafter referred to as“electronic or magnetic data”, “external storage media”, respectively). The external storage
media can be internal storage media built into server equipment, terminals, and communicationequipment, or external storage media such as USB memories, external HDDs, and DVD-Rs.

【T】
“Teleworking” means a flexible work style that enables employees to effectively use any placeor time to work by making use of information and communication technology (ICT). The formsof teleworking are categorized into the following according to the workplace: remote workthrough which employees work at home; satellite office work through which employees work in
any working environment other than their main working government offices; and mobile workthrough which employees work during transportation or places where they are staying by making
use of items such as mobile devices.

“Terminal” means the equipment of information system component, which employees directly
operate to perform information processing (including installed software and peripheral devices
such as keyboard and mouse directly connected and treated as an integral part of the equipment),
and unless otherwise specified those procured or developed by the Agencies. “Terminal” alsomeans mobile terminals. In particular, otherwise specified case examples would include “non-Agency-furnished terminals”, which indicate terminals that were neither procured nor developedby the Agency. In addition, both terminals procured or developed by Agencies and non-Agencyfurnished terminals are collectively referred to as “terminals (including non-provided terminals).”【W】
“Web conference services” means an external service through which participants are able to meetwithout colocation using pictures or sounds by the use of a dedicated application or web browser.
A service through which communication between special purpose devices takes place (such as avideo conference system) is not included.

Chapter 2
2.1

Basic Framework of Information Security Measures

Introduction and Plan

2.1.1 Establishment of organizations and systems
Purpose
Implementation of information security measures can be accomplished when employees therein fully
understand the authority and responsibilities related to their job positions and functions, and duly
fulfil those responsibilities. To achieve this it is essential to clearly define such authority andresponsibilities and establish necessary organizations and systems. In particular, the chief information
security officer should direct and encourage the entire Agency to systematically execute measures toensure a steady promotion of information security measures.
The chief information security officer can delegate part of their own responsibilities stipulated in these
Common Standards to responsible officers in charge set forth in these Common Standards, such as
their deputy chief information security officer.
Compliance Requirements(1) Designation of the chief information security officer and deputy chief information security
officer(a) The chief information security officer shall be designated to direct tasks associated withinformation security measures at Agencies.
(b) Agencies may, as needed, designate one deputy chief information security officer who
assists the chief information security officer by organizing work related to information
security at the Agency and oversee work related to the Agency’s information security under
the orders of the chief information security officer.
(2) Establishment of the Information Security Committee(a) The chief information security officer shall establish the Information Security Committee,
which consists of representatives of the information security measure promotion structureand of departments engaged in other operations, and whose function is to deliberate overprovisions such as standards.
(3) Designation of the chief information security auditor(a) The chief information security officer shall designate the head information security auditor
who directs tasks associated with audits conducted under the direction of the chief
information security officer.
(4) Designation of the head information security officer and information security officers(a) The chief information security officer shall designate an information security officer who
directs tasks of information security measures for each unit of organization where the same
quality of such measures can be implemented due to the characteristics of their duties. Oneof the information security officers shall be designated by the chief information security
officer as the head information security officer, who directs all information security officers
and assists the chief information security officer and deputy chief information security
officer.
(b) Information security officers shall designate an area information security officer who
directs tasks of information security measures for each area set forth in the compliancerequirements 3.2.1(2)(a).
(c) Information security officers shall designate a division/office information security officer
for each office who directs information security related work.
(d) In the planning phase of such information security, information security officers shalldesignate information system security officers who are responsible for tasks concerning
information security measures in the divisions under their management.
(5) Designation of the chief information security advisor(a) The chief information security officer shall designate the chief information security advisor
with expertise and experience in information security, and define the job descriptions of theposition including advisory functions for the chief information security officer.
(6) Establishment of an information security measure promotion structure(a) The chief information security officer shall establish an information security measurepromotion structure and stipulate its duties.
(b) The chief information security officer shall designate the person in charge of theinformation security measure promotion structure.
(7) Establishment of the system for information security incidents(a) The chief information security officer shall manage and clarify the role of CSIRT.
(b) The chief information security officer shall designate employees deemed to have expertiseand competence in information security as officers in charge of CSIRT. One of the CSIRT

officers shall be designated as the head CSIRT officer who directs measures in the event of
information security incident at Agencies. The chief information security officer shalldesignate the employees in charge of management inside of CSIRT, coordination withothers, and so forth.
(c) The chief information security officer shall establish a reporting system through which allconcerning parties immediately report to him or her in the event of security information
incident.
(d) The chief information security officer shall designate employees who are in charge of
CYMAT (this is only for national administrative organs).
(8) The roles that should not be concurrently undertaken by the same person(a) Employees shall not concurrently undertake the following roles when implementing
information security measures.
(i)

A submitter of an application for approval or permission (hereinafter referred to as“approval, etc.” in this paragraph), and a person who approves the application(hereinafter referred to as “the approval authority, etc.” in this paragraph).

(ii)

An auditee and an auditor(b) When applying for approval, etc., if employees themselves are the approvers, or if it isirrelevant for the approval authority, etc. to decide whether the application should beapproved or denied, such approval, etc. should be submitted to, and granted by, theirsupervisors or other parties deemed relevant.

2.1.2 Establishment of standards for measures and promotion plan of measures
PurposeIn order to appropriately maintain the level of information security at Agencies and comprehensively
reduce information security risks, it is important to both establish standards for the measures withwhich Agencies should comply and systematically implement measures based on the results of risk
assessments of information security.
Compliance Requirements(1) Establishment of the government agency’s own standards(a) The chief information security officer shall establish the standards conforming to the
Common Standards for Measures, through deliberation by the Information Security
Committee. In addition, they shall establish standards based on the results of risk
assessments related to the Agency’s work, the information it handles, and the information
systems in its possession.
(2) Establishment of the promotion plan of measures(a) The chief information security officer shall establish a plan to comprehensively promote
information security measures (hereinafter referred to as the “promotion plan of measures”)

through deliberation by the Information Security Committee. In addition, the promotion
plan of measures shall include an overall policy based on the risk assessment results of thetasks and information handled by Agencies, as well as the information systems owned bythese Agencies. The plan shall also contain the policies for initiatives, significant points,
and the implementation schedules which are indicated below.
(i)

Education on information security(ii)

Self-check of information security measures(iii) Information security audit(iv) Initiatives to promote technical measures related to information systems(v)

Any other important initiatives related to information security measures listed in thepreceding items

2.2

Operation

2.2.1 Enforcement of information security related provisions
PurposeIt is necessary for Agencies to establish specific operational procedures to implement the measures
stipulated in the government agency’s own standards.
If the operational procedures for the measures are improperly organized or lack some processes, they
may not be duly implemented. Therefore, it is important for the chief information security officer to
instruct the head information security officer to maintain operational procedures and receive periodic
reports to clearly understand the maintenance status.
Compliance Requirements(1) Operation of information security measures(a) The head information security officer (unless otherwise specified in this Standards) shallmaintain the operational procedures for information security measures at Agencies anddirect tasks concerning the operational procedures, and report the maintenance status to thechief information security officer.
(b) The head information security officer shall maintain personnel management rules for
information security measures, such as the start and end of employment, and personnel
changes.
(c) The information security measure promotion structure shall carry out the necessary tasks
according to the roles that have been designated for it by the chief information security
officer.
(d) The information security officers or division/office information security officers shallreport to the head information security officer, if there are any issues or problems withinformation security related provisions reported by employees.
(e) The head information security officer shall determine the application status regarding
information security-related rules and regulations, including any issues or problems for this,in a timely manner and report the details of this to the chief information security officer as
needed.
(2) Handling violations(a) Employees shall report to the information security officers when they become aware of any
serious breach of information security related provisions.
(b) The information security officers shall instruct the violator and concerned parties to takenecessary measures to maintain information security when he or she is informed of, or
becomes aware of any serious breach of information security related provisions, and shallreport to the chief information security officer through the head information security officer.

2.2.2 Exceptional measures
PurposeAs exceptional measures are used only in case of exception, they should not be overused. However,there may be situations where employing methods other than those prescribed, or not implementin g
the prescribed measures should be approved, due to the reasons such as applying certain information
security related provisions shall significantly hinder appropriate execution of administrative tasks. To
handle such situations, it is necessary to establish procedures for exceptional measures.
Compliance Requirements(1) Maintenance of exceptional measures(a) The chief information security officer shall designate a person who examines applications
for exceptional measures (hereinafter referred to as “the permission authority” in thisprovision) and shall establish the examination procedure.
(b) The head information security officer shall maintain the records of exceptional measureapplication and request the permission authority to regularly report on application status.
(2) Operation of exceptional measure(a) Employees shall follow the stipulated examination procedures when submitting
applications for exceptional measures to the permission authority. In case that a task should
be executed immediately and can be handled with utmost respect for provisions, where
taking measures other than those prescribed in the information security related provisions
or not taking prescribed measures is unavoidable, applications for such exceptional
measures shall be promptly submitted afterwards.
(b) The permission authority shall examine applications for exceptional measures submitted by
employees in accordance with the stipulated approval procedures and determine whether
or not to approve.
(c) The permission authority shall establish records of exceptional measure application andreport them to the head information security officer.

(d) The head information security officer shall review information security measures fornecessary revisions or additions based on the application status of exceptional measures,and report them to the chief information security officer.

2.2.3 Education
PurposeEven when the information security related provisions are appropriately maintained, the level of
information security cannot be enhanced if employees are not aware of, nor comply with their contents.
Therefore, it is essential to educate all employees to let them acquire deeper knowledge of theinformation security rules.
It is necessary to bring up skilled human resources with expertise in information security for the reasonof recent increase of information security incidents in Agencies and so forth.
Compliance Requirements(1) Establishment of structures for information security measures education and formulation of
education implementation plans(a) The head information security officer shall establish education plans on information
security measures based on the measures promotion plans, and maintain their enforcement
framework.
(b) The head information security officer shall revise the education implementation plans in
the event that matters on which education should newly be provided to employees come tolight according to changes in the information security environment.
(2) Enforcement of information security measures education(a) The division/office information security officer shall ensure employees duly participate in
the education concerning information security-related regulations based on the education
implementation plan.
(b) Employees shall duly participate in information security measure education, according to
the education plan.
(c) The division/office information security officer shall ensure officers affiliated to theinformation security measure promotion structure and CSIRT duly participate in
information security measure education. In addition, division/office information security
officers at national administrative organs shall ensure that employees affiliated withCYMAT properly receive information security measure education.
(d) The division/office information security officer shall record the information security
measure education implementation status and report this to the information security officer
and head information security officer.
(e) The head information security officer shall analyze and assess the information security
measure education implementation status and report to the chief information security
officer on the enforcement status of information security measures education.

2.2.4 Handling of information security incidents
PurposeIf an information security incident is detected, it should be immediately reported to the chief
information security officer, and the measures to prevent the spread of damage as well as for recovery,should be implemented. Also, after handling the incident, it is important to identify the lessons to belearned by investigating the root causes, and utilize those lessons to prevent recurrence, and to review
the systems and procedures.
Compliance Requirements(1) Preparation for information security incidents(a) The head information security officer shall establish/maintain reporting procedures,
including points of contact within the Agencies in the event of information security
incidents (including potential incidents), and shall inform all employees of these procedures
including examples of reporting.
(b) The head information security officer shall establish/maintain procedures for measures
including sharing information with parties other than Agencies in the event of information
security incidents (including potential incidents).
(c) In preparation for information security incidents, the head information security officer shallestablish an emergency communication network containing emergency contacts,
communication methods, and contents to report, for the information systems deemed
especially critical to execute administrative tasks.
(d) The head information security officer shall examine the necessity of education on measuresagainst information security incidents, and establish/maintain the contents and frameworkof the education for the information systems deemed especially critical to executeadministrative tasks.
(e) The head information security officers shall establish/maintain points of contact to receive
reports on information security incidents from parties other than Agencies, and show themthe method to communicate with such point of contact.
(f)

The head information security officers shall confirm that the procedures for measures work
adequately, through education and so forth.

(2) Handling of information security incidents(a) Employees shall report to the points of contact at Agencies and follow their instruction in
the event of information security incidents (including potential incidents).
(b) The CSIRT shall check the reported information security incident (including potential
incident) and verify whether or not it is an information security incident.
(c) The head CSIRT officer shall immediately report to the chief security officer in the eventof information security incidents.

(d) The CSIRT shall provide the relevant information security officers concerning theinformation security incident with instructions or advice on emergency measures to prevent
spread of damage and to recover from the incident.
(e) Information security officers shall implement appropriate measures based on procedures
stipulated by Agencies, or on CSIRT instructions or advice, in the event of information
security incidents against the information security system under their management.
(f)

In the event of information security incidents affecting the common platform system, where
the information security provisions for system operation and management of such common
platform system are available, information security officers shall duly follow those
provisions when implementing measures.

(g) The CSIRTs at national administrative organs shall immediately report to the National
center of Incident readiness and Strategy for Cybersecurity in the event of information
security incidents against information security systems at their respective administrative
organs. Furthermore, in the event that the CSIRTs at Incorporated Administrative Agencies
and Designated Corporations detect an information security incident with the information
systems of the agency or corporation in question, they shall promptly report said incident
to the national administrative organ that has jurisdiction over the said agency or corporation.
Upon being notified, the CSIRTs at national administrative organs must promptly notify the
National center of Incident readiness and Strategy for Cybersecurity.
(h) In case that the detected information security incidents are cyber-attacks or likewise, CSIRT
shall report to the police depending on the contents of such information security incidents.
(i)

Furthermore, in the event that the detected information security incidents or information
security incidents reported to CSIRTs at national administrative organs by Incorporated
Administrative Agencies and Designated Corporations constitute threats or potential threats,such as large scale cyber-attacks which cause or may cause significant damage to thecitizen’s life, body, property, or national land, CSIRT shall provide a report and notificationin accordance with “Initial countermeasures for large-scale cyber-attacks” (March 19, 2010,
decided by the Deputy Chief Cabinet Secretary for Crisis Management ).

(j)

The CSIRT shall be aware of handling status of the information security incident and, if
necessary, provide with instructions or advice on handling.

(k) The CSIRT shall record the handling of the information security incident.
(l)

The CSIRT shall share the details of information security incidents with concerning bodies,including Agencies.

(m) The CSIRT shall provide necessary information to CYMAT when receiving their supports.
(3) Prevention of recurrence of information security incidents and sharing of lessons learned(a) Information security officers shall, upon receiving instructions or advice from CSIRT on
emergency measures and recovery, investigate the cause of information security incidents
based on such instructions or advice, and review the measures for prevention and reportthem to the chief information security officer.

(b) The chief information security officer shall examine the report on information security
incidents submitted by information security officers, and take necessary measures toprevent recurrence.
(c) The head CSIRT officer shall share the lessons learned from consequences of the incident
handling with the head information security officer, the relevant information security
officers and so forth.

2.3

Assessment

2.3.1 Self-check of information security measures
PurposeTo ensure effectiveness of information security measures it is vital to assess how the information
security related provisions are complied with, and to analyze the results of such assessments.
It is important to appropriately carry out self-check to see if an employee duly carries out the measures
implemented according to his or her role, and also to assess the level of information security in theentire Agency.
In addition, it is important for each concerning party to implement the necessary revised measures
within the scope of his or her responsibility for the role, based on the results of self-check.
Compliance Requirements(1) Formulation of self-check plans and establishment of procedures(a) The head information security officer shall formulate an annual plan for self-checks basedon the measures promotion plan.
(b) Information security officers shall maintain self-check forms and procedures for each
employee based on the annual plan for self-checks.
(c) The head information security officer shall revise the annual plan for self-checks in theevent that matters that should be newly checked come to light according to changes in theinformation security environment(2) Conducting self-check(a) Information security officers shall instruct employees to conduct self-check in accordancewith the annual self-check plan.
(b) Employees shall conduct self-check using the self-check forms and procedures prepared byinformation security officers.
(3) Evaluations and improvements based on self-check(a) The information security officers shall analyze and evaluate the results of the self-checks
in the interest of confirming whether there are any problems unique to the Agency they
oversee as a whole. They shall also report the evaluation results to the head information
security officer.

(b) The head information security officer shall analyze and evaluate the results of the selfchecks in the interest of confirming whether there are any problems commonly sharedthroughout the Agency. They shall also report the evaluation results to the chief information
security officer.
(c) The chief information security officer shall evaluate the overall results of self-check andinstruct information security officers to make improvements on any identified issues. The
chief information security officer shall be reported concerning the results of improvements.

2.3.2 Information security audit
PurposeTo ensure effectiveness of information security measures it is also vital to ensure that an independent
party to carry out information security audit, while parties engaged in information security measures
to conduct self-check.
In addition, it is important for the chief information officer to instruct information security officers to
implement necessary measures based on the issues identified by the audit.
Compliance Requirements(1) Formulation of audit plans(a) The head information security auditor shall formulate plans for information security audit
based on the promotion plan of measures.
(b) The head information security auditor shall establish an additional audit implementation
plan in case it is necessary to perform an audit that is not defined in the promotion plan ofmeasures, responding to situational changes in information security.
(2) Conducting information security audit(a) The head information security auditor shall instruct information security auditors to
conduct audits in accordance with the promotion plan of measures, and provide the chief
security officer with an audit report containing the following items.
(i)

The audit shall confirm that the matters stipulated in the government agency’s own
standards are in accordance with the Common Standards for Measures.

(ii)

The audit procedures shall be in accordance with the government agency’s own
standards(iii) The audit shall confirm if operations in auditees’ departments are in accordance with
the information security related provisions, by verifying matters such as adequately
conducted self-checks.
(3) Responding to audit results(a) The chief information security officer shall instruct the head information security officer
and information security officers to formulate improvement plans for any issues pointed
out in the audit report.

(b) The head information security officer shall formulate improvement plans after first taking
the necessary measures for items requiring cross-sectoral improvements within the Agency
from among those for which the chief information security officer has requested
improvements. They shall also report the results of the measures taken and the improvement
plans to the chief information security officer.
(c) The information security officers shall, after taking the necessary measures, formulate
improvement plans for the issues requiring specific improvements for the Agencies they
oversee as a whole from among those for which the chief information security officer has
requested improvements. The information security officers shall report the results of taking
the necessary measures and the improvement plans to the chief information security officer.

2.4

Review

2.4.1 Review of information Security measures
PurposeAs the environment surrounding information security is constantly changing, the level of information
security cannot be maintained if these changes are not appropriately addressed. Therefore, it isnecessary to conduct periodical reviews on the information security related provisions which serve as
the basis for information security measures for Agencies. At that time, it is essential to assess risks byanalyzing potential threats and damages in case of their occurrence concerning possessed informationand information systems, taking into account the matters such as issues with actual operations, resultsof self-inspections and audits, and change of circumstances surrounding information security.
It is also vital to reflect these results in the standards and promotion plan of measures to further
promote the initiatives for information security.
Compliance Requirements(1) Review of information security related provisions(a) The chief information security officer shall comprehensively evaluate the information
security operation and the results of self-checks and audits, and conduct a necessary review
on the government agency’s own standards, taking into account the significant situationalchanges in information security, and after deliberations of the Information Security
Committee.
(b) The head information security officer shall review the information security operation
procedures, taking into account the information security operations and the results of selfchecks and audits, or shall instruct who prepared the procedures to review the provisions,and report the results to the chief information security officer.
(2) Review of promotion plan of measures(a) The chief information security officer shall comprehensively evaluate the information
security operation and the results of self-checks and audits, and conduct a necessary review

on the measures promotion plan, taking into account the significant situational changes in
information security, and after deliberations of the Information Security Committee.

Chapter 3
3.1

Information Handling

Information Handling

3.1.1 Information handling
PurposeThe execution of work requires information handling such as preparation, obtainment, use, storage,
provision, transportation, transmission, and deletion (hereinafter referred to as “use or handling” inthis provision). In order to maintain the security of certain information, all employees who use or
handle such information need to implement appropriate measures corresponding to its characteristics
at each phase of the information lifecycle. For this reason, it is necessary for employees to take actions
such as labeling classifications and handling restrictions of information upon its preparation or
obtainment, to share the same understanding on handling of such information, as well as to implemen t
measures in accordance with its classification and handling restrictions.
The Document Management Guidelines shall be primarily applied for management of confidential
documents at national administrative organs. For the matters related to information security measures
not stipulated in the Guidelines, it is essential to ensure appropriate information handling based on
the Common Standards. In addition, measures shall be taken based on the provisions of these
Common Standards regarding the management of confidentiality class-3 information at Incorporated
Administrative Agencies and Designated Corporations.
Compliance Requirements(1) Maintenance of provisions related to information handling(a) The head information security officer shall maintain the provisions of information handlingwhich contains the following items and notify them to employees.
(i)Definitions of “classifications and handling restrictions of information”(ii)

Procedures of labeling, etc. of “classifications and handling restrictions of information”(iii) Procedures of maintenance and review of “classifications and handling restrictions of
information”(2) Prohibition of use or handling of information for non-job related purposes(a) Employees shall limit the use or handling of the information within the scope of their job
functions.

(3) Determination and labeling, etc. of classifications and handling restrictions of information(a) When preparing information or start managing information prepared by parties other thanAgencies, employees shall determine the classifications and handling restriction of
information in accordance with its definitions, and take necessary actions of labeling, etc.
(b) When preparing or duplicating information, employees shall maintain the same
confidentiality classification and handling restrictions as the original, if the obtained orreferred original information is already classified according to its level of confidentiality.
(c) If the existing classifications and handling restrictions deem necessary to be reviewed foramendments, additions, deletions, and for other reasons, employees shall consult with aperson, or his or her senior, who determines the classifications and handling restrictions(including those who follow the determination- hereinafter referred to as the “classifying
authority in this section), and conduct reviews based on the outcome of such consultation.
(4) Use and storage of information(a) Employees shall appropriately handle information in accordance with the classification andhandling restrictions, which is labeled, or otherwise specified.
(b) Employees shall obtain permission from their division/office information security officers
when processing confidentiality class-3 information outside of the areas requiring control
measures.
(c) Employees shall take necessary security management measures when processing classified
information outside of the areas requiring control measures.
(d) Employees shall appropriately manage information in accordance with the classificationand handling restrictions of information, such as setting access control when saving
information. The employees of Incorporated Administrative Agencies and DesignatedCorporations shall take the following steps when storing confidentiality class-3 information
to devices. However, when confidentiality class-3 information is handled in a mannerequivalent to national administrative organs by Incorporate Administrative Agencies andDesignated Corporations, their employees may take steps equivalent to those taken bynational administrative organs in lieu of the following steps.
(i)When storing confidentiality class-3 information to devices, devices such as terminals,
servers, and so on that are not connected to the internet or information systems withinternet connections must be used.

(ii) The said information must be stored in an encrypted state.
(iii) Measures must be taken to protect the devices on which the said information is storedfrom physical threats, such as theft or their unauthorized removal.
(e) Employees shall follow the prescribed procedures when handling information using
external storage media, such as USB memories and so on.

(5) Provision and disclosure of information(a) When disclosing information, employees shall make sure the information is classified asclass 1 information.
(b) When providing information to parties outside of the scope of viewing restrictions,employees shall consult with the classifying authority and follow his or her decision. In
addition, employees shall ensure that the information is properly handled in accordancewith the prescribed classification and handling restrictions at the parties’ sites. To achieve
this employees shall take measures such as to assuredly inform the parties of points to be
noted when handling such information.
(c)When providing confidentiality class-3 information to parties outside of the scope ofviewing restrictions, employees at Incorporated Administrative Agencies and DesignatedCorporations shall receive the approval of their division/office information security officer.

(d) When providing or disclosing information in electronic or magnetic format, employees shalltake measures to prevent inadvertent information leakage.
(6) Transportation and transmission of information(a) When transporting an external storage media which stores or contains classified
information to places outside the areas requiring control measures, employees shall selectthe means of transportation with considerations to security and take appropriate measures
to ensure security in accordance with the classification and handling restrictions of theinformation. When the employees of Incorporated Administrative Agencies and DesignatedCorporations take confidentiality class-3 information outside of areas requiring control
measures, this is to be transported via the method specified by the division/office
information security officer after first encrypting the information. In case that the media istransported only to an area pre-designated by the head security officer, which is defined as
the areas requiring handling restrictions by other Agencies, such an area shall be regarded
as an area requiring control measures.
(b) When transmitting classified information in electronic or magnetic format such as e-mail,employees shall select the means of transmission with considerations to security, and takeappropriate measures to ensure security in accordance with the classification and handling
restriction of information. When the employees of Incorporated Administrative Agencies
and Designated Corporations use communication lines outside the Agency (excluding theinternet) to transmit confidentiality class-3 information, they shall transmit this via themethod specified by the division/office information security officer after first encrypting
the information. However, when confidentiality class-3 information is handled in a mannerequivalent to national administrative organs by Incorporate Administrative Agencies andDesignated Corporations, their employees may take steps equivalent to those taken bynational administrative organs in lieu of the above action.

(7) Deletion of information(a) Employees shall immediately erase the information stored in an external storage media
when it becomes unnecessary for their job functions.
(b) When disposing of an external storage media, employees shall erase all the information
stored, making it completely unrestorable and ensuring there is no remaining informationin the media.
(c) When disposing of confidential information in written format, employees shall make it
unrestorable.
(8) Backup of information(a) Employees shall take backup of information in an appropriate manner in accordance withthe classification of information.
(b) Employees shall determine the place, manner, period for storage and so on, of the backup
information, and appropriately manage it in accordance with the classification and handling
restriction of information.
(c) Employees shall appropriately delete, erase or dispose of the information with exceededstorage period, in accordance with the provisions set forth in the previous section.

3.2

Information Handling Areas

3.2.1 Information handling areas
PurposeWhen the server equipment, terminals and other equipment are installed in an environment physicallyaccessible by unspecified large number of publics, there are risks such as malicious impersonation,
physical destruction to the equipment, and information leakage caused by illegal removal of such
equipment. Other threats concerning the environment where the systems are installed include damage
to information systems as a result of disasters.
Therefore, it is necessary to ensure security of information and information systems in the areas
including offices, conference rooms, and server rooms where information is handled, byimplementing measures such as physical countermeasures, as well as entrance and exit management
systems, and so on.
Compliance Requirements(1) Determine the standards for measures for the areas requiring control measures(a) The head information security officer shall determine the scope of the areas requiringcontrol measures.
(b) The head information security officer shall determine the standards for measures for theareas requiring control measures according to the characteristics of each area which include
the following items.

(i)Physical measures to prevent easy access to the areas by unauthorized persons,
including maintenance and installation of facilities such as lockable doors andpartitions.

(ii)

Entrance and exit management systems to restrict unauthorized persons to enter theareas, as well as to prevent illegal actions by authorized persons while they are in theareas.

(2) Determine the measures to be implemented in each area(a) Information security officers shall determine areas per unit where they implement measures
for facilities and work environments based on the standards set forth by the headinformation security officer.
(b) Area information security officers shall determine measures to be implemented in the areas
they manage, considering the matters such as the standards set forth by the head information
officer, surrounding environment, type of administrative tasks, and information handled insuch areas.
(3) Implementation of measures for the areas requiring control measures(a) Area information security officers shall implement measures determined in the areas they
manage. As for the measures need to be carried out by employees, area information security
officers shall take actions to ensure that employees duly understand and recognize suchmeasures.
(b) Area information security officers shall implement physical measures to protect
information systems which handle vital information from disasters.
(c) Employees shall use the areas in accordance with the measures determined by area
information security officers. Employees shall ensure those who belong to parties other thantheir own Agencies use the areas in accordance with the prescribed measures when allowing
such external parties to enter the areas.

Chapter 4
4.1

Outsourcing

Subcontracting

4.1.1 Subcontractingt
PurposeWhen the development, operation, or maintenance of information systems or application programs iscontracted out to external parties which makes it difficult for employees to directly manage theinformation security measures at the subcontractors, it would be vital to specify requirements for
subcontractors in documents such as procurement specifications and include them in terms ofcontracts, in order to ensure the information security measures conforming to the government
agency’s own standards are duly implemented by subcontractors.
There are a variety of forms of subcontracting as shown in the examples below, and forms ofagreement vary from fixed-price contracts, delegation contracts and semi-delegation contracts toconsent to general terms and conditions, and so on. In any case where an agreement is entered into
for subcontracting tasks for which it is necessary that information security measures conforming to
the government agency’s own standards are duly implemented by subcontractors as stated above, it
is important to clearly define the scope of tasks contracted out and responsibilities incurred bysubcontractors, and to reach a mutual agreement on details of information security measures.
In cases where a subcontractor uses an external service, the provisions of section 4.2 “Use of ExternalServices” shall also be included in the requirements for the subcontractor, since the subcontractor
would also be exposed to risks specific to external services.
<Examples of subcontracting>

Development and construction of information systems



Development of applications and contents, and so on.

Operation of information systemOperation support services (statistics, data aggregation, data entry, media conversion, andso on.)



Project management support services



Investigation and research (investigation, research, examination, etc.)

Compliance Requirements(1) Maintenance/establishment of provisions related to subcontracting(a) The head information security officer shall maintain/establish provisions related to
subcontracting which include the following items.
(i)

Criteria for determining the scope of information and information systems that may
be accessed by subcontractors (hereinafter referred to as the “criteria and proceduresfor selection” in this provision).

(ii)

Criteria and procedures for selecting subcontractors.

(2) Subcontracting agreements(a) Information system security officers or division/office information security officers shallsubcontract tasks in accordance with the criteria and procedures for selection.
(b) When subcontracting tasks, information system security officers or division/office
information security officers shall select subcontractors in accordance with the criteria andprocedures for selection. Implementation of the below specified information security
measurements by subcontractors shall be the terms of selection, which should be includedin the contractual specifications.
(i)

Prohibition of use of information by subcontractors for non-job related purposes.

(ii)

Implementation and management systems of information security measures carriedout by subcontractors.

(iii) Management systems to prevent any alternation of data and so on, made against the
Agency’s intention, by subcontractor companies or their employees, or subsubcontractors or any other parties, while executing tasks contracted out.
(iv) Information of subcontractors including their capital ties, executives, the sites wheretasks contracted out are processed, professional affiliations and expertise(qualifications and training experience on information security), experience andnationality of employees of the subcontractors.
(v)

Measures (including framework and procedures) for information security incidents(vi) Systems for checking implementation status of information security measures as wellas other matters in the agreement.
(vii) Remedial actions in case of insufficient implementation of information security
measures.
(c) Information system security officers or division/office information security officers shall
examine matters such as the classification of information handled by the subcontractors andinclude the following items in the contractual specifications as necessary.
(i)

Acceptance of information security audits(ii)

Service level assurance(d) In cases where subcontractors subcontract a part of tasks contracted out, information systemsecurity officers or division/office information security officers shall make sure thesubcontractors implement the above specified measures (b) and (c) to ensure a sufficientlevel of information security against the threats caused by subcontracting. In addition,
information system security officers or division/office information security officers shall
include in the contractual specifications the term that subcontractors give to the Agency
information necessary to verify the implementation of information security measures in
sub-subcontractors, and receive the approval of the Agency. In addition, decisions onwhether or not to provide approval for subcontracting shall be made based on criteria andprocedures for selection and subcontractor selection criteria.

(3) Implementation of measures by subcontractors(a) Information system security officers or division/office information security officers shallcheck implementation

status of information security measures implemented

bysubcontractors based on the contract.
(b) Information system security officers or division/office information security officers shalltake necessary measures such as temporal stop of tasks contracted out, and then makesubcontractors to take the measures based on the contract, in case that they become aware,or are informed by employees, of information security incidents or use of information for
non-job related purposes by subcontractors while executing tasks contracted out.
(c) Information system security officers or division/office information security officers shallensure the information handled by subcontractors to be returned or erased upon thetermination of the contract.
(4) Information handling when subcontracting tasks(a) Employees shall comply with the following requirements when providing information andso on, to subcontractors.
(i)When providing classified information to subcontractors, restrict it to the minimum
and use a prescribed safe delivery method.

(ii)

When the provided classified information is no longer required by subcontractors,
make sure the subcontractors will duly return or erase the information.

(iii) Immediately report to information system security officers or division/office
information security officers in the event of information security incidents or use of
information for non-job related purposes while tasks contracted out are being
performed.

4.2 Use of External Services
4.2.1 External services to handle confidential information
PurposeThe expansion of the use of external services such as cloud services by Agencies in the future is
expected. When using external services, it is necessary to ensure the security by looking over theentire distribution channels of information including the external service infrastructure part and by
designing/configuring measures comprehensively.
Information whose handling is entrusted by Agencies to external service providers should be handledappropriately at the providers. However, in using external services, it is not generally easy to confirm
directly that the information is appropriately handled. Furthermore, in external services, it may bedifficult to receive the information related not only to themselves but also to other users, since multiple
users may use a common external service infrastructure. When an Agency handles confidential
information using an external service, in order to properly select an external service provider, it isnecessary to understand such characteristics of the external service, fully consider matters necessaryfor ensuring security in the use and the effectiveness of governance to the external service provider

by the Agency, clarify roles and responsibilities shared between the Agency and the external service
provider, and then ensure that the external service meets selection criteria and security requirements.
In addition, it is necessary to take security measures in using external services not only when external
service providers are selected and agreements are entered into with the providers, but also when
information systems are introduced and constructed after the agreements are entered into with theproviders, and then operated and maintained, and furthermore, throughout the lifecycle of the relevant
information system until the termination of its agreement. In particular, the content of each external
service varies in a very fast cycle, and it is possible that security measures taken at the start of use of
the external service become ineffective before the termination of use of the service. Therefore, it isnecessary to regularly and thoroughly implement the measures in the operation and maintenancephase.
<Examples of external services>

Cloud servicesWeb conference services

SNS (social networking services)

Search services, translation services, mapping services



Hosting servicesInternet connection services

In most of cases of external services that are provided by private service providers to an unspecified
number of users and become available only on consent to standard general terms and conditions, termsof services, etc., it is impossible to request that those providers take security measures or handle data
in a special manner for Agencies, and it is generally difficult to satisfy necessary and sufficient
security requirements for the handling of confidential information. Therefore, in principle, handlingof confidential information in this type of external services is not allowed.
Compliance Requirements(1) Maintenance/establishment of provisions related to use of external services(a) The head information security officer shall establish/maintain provisions related to use of
external services (in cases where confidential information is handled), which contain thefollowing items.
(i)

Criteria on types of tasks and information systems to allow use of external services,and on location restrictions for handling confidential information (hereinafter referred
to as the “Criteria for Allowing Use of External Services” in this section 4.2)

(ii)

Criteria for selecting external service providers(iii) Permitting authority and procedures for starting use of external services(iv) Designation of the external service administrator and management of use of eachexternal service

(2) Selection of external services (in cases of cloud services)(a) Information system security officers or division/office information security officers shallreview the use of external services while taking into account the classification of andhandling restrictions on information to be handled in accordance with the Criteria for
Allowing Use of External Services.
(b) Information system security officers or division/office information security officers shallselect external service providers while taking into account the classification of and handling
restrictions on information to be handled in external services in accordance with the criteria
for selecting external service providers. If there are risks specific to any tasks, necessary
information security measures shall be included in the terms of selection of external service
providers.
(c) Information system security officers or division/office information security officers shallestablish security requirements and select external services while taking into account theclassification of and handling restrictions on information to be handled, as well as the scopeof roles and responsibilities of the external services regarding information security.
(3) Selection of external services (in cases of non-cloud services)(a) Information system security officers or division/office information security officers shallreview the use of external services while taking into account the classification of andhandling restrictions on information to be handled in accordance with the Criteria for
Allowing Use of External Services.
(b) Information system security officers or division/office information security officers shallselect external service providers while taking into account the classification of and handling
restrictions on information to be handled in external services in accordance with the criteria
for selecting external service providers. Information security measures containing thefollowing items shall be included in the terms of selection of external service providers.
(i)

Prohibition of use by external service providers for non-job related purposes of
information that is handled by Agencies through the use of external services(ii)

Implementation and management systems of information security measures to betaken by external service providers(iii) Management systems to prevent any alternation of data and so on, made against the
Agency’s intention, by external service providers or their employees, subsubcontractors, or any other parties, while providing external services(iv) Provision of information on external service providers including their capital ties,
executives, locations such as facilities where external services are provided, and theaffiliation, expertise (qualifications, training experience, etc. on information security),
experience, and nationality of each person engaged in the provision of external
services(v)

Measures (including framework and procedures) for information security incidents

(vi) Systems for checking implementation status of information security measures as wellas other matters in the agreement(vii) Remedial actions in cases of insufficient implementation of information security
measures(c) Information system security officers or division/office information security officers shallconsider measures for transferring the relevant tasks smoothly at the time of discontinuationor termination of external services, and include them in the terms of selection of external
service providers.
(d) Information system security officers or division/office information security officers shall
examine matters such as the classification of information to be handled by Agencies throughthe use of external services and include the following items in the terms of selection of
external service providers.
(i)

Acceptance of information security audits(ii)

Service level assurance(e) Information system security officers or division/office information security officers shallselect external service providers by evaluating the risk of applying laws, ordinances, andregulations other than domestic laws to the information to be handled by Agencies throughthe use of external services, and as necessary, include in the terms of selection the place
where information on Agencies is handled and the governing law and jurisdiction provided
for in an agreement.
(f)

In cases where an external service provider subcontracts part of its services, information
system security officers or division/office information security officers shall have theexternal service provider make sure that requirements contained in the terms of selectionof external service providers ensure a sufficient level of information security against thethreats caused by subcontracting. In addition, information system security officers ordivision/office information security officers shall include in the terms of selection of
external service providers the term that external service providers provide Agencies withinformation necessary to verify the implementation of information security measures in
sub-subcontractors to obtain the approval of Agencies. In addition, decisions on whether or
not to provide approval for subcontracting shall be made in accordance with the Criteria for
Allowing Use of External Services and criteria for selecting external service providers.

(g) Information system security officers or division/office information security officers shallestablish security requirements according to the classification of and handling restrictions
on information to be handled for the selection of external service providers, and as security
requirements for external services, require that external services meet the international
standard concerning security or any standard equivalent or superior thereto.
(h) Information system security officers or division/office information security officers shallestablish security requirements based on the scope of roles and responsibilities of external
services regarding information security after designing security in such a way as looking
over the entire distribution channels of information, while taking the characteristics of theexternal services into consideration so that security over the entire distribution channels of
information including the part provided by the external services is appropriately ensured.
(i)

Information system security officers or division/office information security officers shallevaluate and determine comprehensively and objectively that the reliability of each external
service provider is sufficient, from the contents of reports of information security audits,
the application status of various certification/authentication systems, etc.

(4) Procurement and contract for use of external services(a) In cases of procurement of external services, information system security officers ordivision/office information security officers shall include in procurement specifications thecriteria and terms of selection of external service providers as well as security requirements
established upon selection of external services.
(b) In cases of procurement of external services, information system security officers ordivision/office information security officers shall confirm that the external service provider
and its services meet procurement specifications before concluding the agreement, and havean agreement with the provider include the procurement specifications.
(5) Approval for use of external services(a) In cases of use of external services, information system security officers or division/office
information security officers shall submit applications for use of external services to theperson authorized to permit use applications.
(b) The person authorized to permit use applications shall examine use applications for external
services by employees, and decide whether or not to use the services.
(c) The person authorized to permit use applications shall, when approving use applications
for external services, keep records of approved external services and designate the external
service administrator.
(6) Measures for implementing and building information systems on external service infrastructure(a) The head information security officer shall establish provisions on security measures forbuilding an information system using an external service, including the following items,
based on matters such as the characteristics of the external service and ways of thinking
about the demarcation point.
(i)

Access controls for the prevention of unauthorized access(ii)

Encryption for the protection of confidentiality of information to be handled(iii) Security measures at the time of development(iv) Prevention of errors at the time of design and settings(b) The external service administrator shall confirm and keep records of the implementation of
the provisions established under the preceding paragraph at the time of construction of thesystem.

(7) Measures for operation and maintenance of information systems by the use of external services(a) The head information security officer shall establish provisions on security measures for
operation of an information system using an external service, including the following items,
considering external service characteristics and concepts of applicable shared responsibility
model.
(i)

Provisions of the external service use policy(ii)

Education required for external services users(iii) Management of assets to be handled(iv) Access controls for the prevention of unauthorized access(v)

Encryption for the protection of confidentiality of information to be handled(vi) Controls over communication in the external service(vii) Prevention of errors at the time of design and settings(viii) Business continuity of the information system by the use of the external service(b) Information system security officers or division/office information security officers shallestablish/maintain procedures for measures taken when an incident that has occurred dueto the external service is detected, considering external service characteristics and concepts
of applicable shared responsibility model.
(c) The external service administrator shall regularly confirm and keep records of theimplementation of the provisions established under the preceding paragraphs at the time ofoperation and maintenance of the system.
(8) Measures for renewal or disposal of information systems by the use of external services(a) The head information security officer shall establish provisions on security measures fortermination of use of an external service, including the following items, consideringexternal service characteristics and concepts of applicable shared responsibility model.
(i)Measures for termination of use of the external service(ii) Disposal of information handled in the external service(iii) Deletion of an account created for the use of the external service(b) The external service administrator shall confirm and keep records of the implementation of
the provisions established under the preceding paragraph at the time of termination of useof the external service.

4.2.2 External services to handle non-confidential information only
PurposeEven if confidential information is not handled and the level of information management required forexternal service providers is not high, it is required that external services be used after full recognition
that various information is sent from Agencies and a decision on whether or not to use them has been
made in full consideration of risks. On the other hand, requirements for security measures equivalent
to cases where confidential information is handled will hinder the promotion of use of external
services. Therefore, in cases where external services are used on the premise that confidential
information is not handled, it is required that information security measures be appropriately taken inaccordance with Compliance Requirements set forth in this section 4.2.2.
Compliance Requirements(1) Maintenance/establishment of provisions related to use of external services(a) The head information security officer shall establish/maintain provisions related to use of
external services (in cases where confidential information is not handled), which include
the following items.
(i)

Scope of tasks for which external services are usable(ii) Permitting authority and procedures for starting use of external services(iii) Designation of the external service administrator and management of use of eachexternal service(iv) Operational steps for use of external services(2) Implementation of measures for use of external services(a) Employees shall make sure that the risks of using external services are tolerable bychecking the terms and conditions and other terms of the services, and then apply for theuse of such services in cases where confidential information is not handled. The external
service administrator designated upon approval shall ensure that appropriate measures are
implemented upon using those services.
(b) The person authorized to permit use applications shall examine use applications for external
services submitted by employees to determine whether or not to permit them, and also keep
records of external services approved.

Chapter 5
5.1

Lifecycle of Information Systems

Maintenance of Documents and Inventories of Information Systems

5.1.1 Maintenance of documents and inventories of information systems
PurposeTo sustain the level of information security of information systems managed by Agencies, and to
appropriately, as well as promptly respond to information security incidents, it is vital to centrally
examine the details of information security measures for said systems in the information systeminventories. It is also important to regularly manage the information such as procurement
specifications and settings of system components in a written format, and to be aware of where tolocate them, in order for said information to be promptly referred to when necessary.
Compliance Requirements(1) Maintenance of information system inventories(a) The head information system security officer shall establish/maintain the mattersconcerning the security requirements for all the information systems in the information
system inventories.
(b) When newly constructing or updating an information system, information system security
officers shall record or state the contents of the security requirements described in theinformation security inventory of said system, and report them to the head information
security officer.
(2) Maintenance of documents related to information systems(a) Information security officers shall maintain documents required to implement information
securities measures for the information systems under their management, containing all theitems specified below.
(i)

Information of the server equipment and terminals composing the information
systems(ii)

Information of the communication lines and communication equipment composing
the information systems(iii) Procedures to maintain the security level of information security of each componentof the information systems(iv) Procedures when detecting information security incidents

5.1.2 Establishment/maintenance of provisions related to procurement of equipment, etc.
PurposeConfidentiality, integrity and availability of information processed by information systems may becompromised if a procured equipment lacks required security functions, or any malicious alternation
was made during its manufacturing process, or in those cases where information security measures
cannot be continuously implemented to the procured equipment.

To address these issues, it is necessary to establish/maintain criteria for selecting equipment etc., aswell as procedures for checks and inspections at the time of delivery, to ensure the procurement ismade in accordance with the government agency’s own standards.
Compliance Requirements(1) Maintenance of provisions related to procurement of equipment, etc.
(a) The head information security officer shall establish/maintain the criteria for selecting
equipment, etc. The criteria should contain, if necessary, a scheme which enables Agencies
to monitor the management of equipment to ensure no malicious alternation is madethroughout the lifecycle of equipment, such as its development phase.
(b) The head information security officer shall maintain the checks and inspections proceduresat delivery of equipment, etc., considering perspectives of information security measures.

5.2

Measures at Each Phase of Information System Lifecycle

5.2.1 Planning and definition of requirements for information systems
PurposeTo appropriately maintain information security throughout the lifecycle of information system, it isnecessary to define security requirements appropriately.
Ambiguous, excessive, or insufficient security requirements may result in disadvantages such as cost
increase due to excessive measures for information security, unfair competitive biddings caused bydifferent proposal contents due to widely varied interpretations of requirements, and rework indesigning and development, as well as information security incidents after commencement ofoperations.
Therefore, it is important to review measures for expected threats against information systems and to
appropriately include sufficient security requirements in specifications, after taking consideration of
the scope of tasks, information handled, users who handle the information, as well as the environments
and methods and so on used for information processing.
In addition, it is vital to examine the measures to protect the information systems to be constructedfrom vulnerabilities at the planning phase of the systems, before its construction.
The provisions in section 4.1 “Subcontracting” shall also be observed when subcontracting
construction, operation, and maintenance of information systems.
Compliance Requirements(1) Ensuring the implementation of frameworks(a) Information system security officers shall request that chief information security officers
ensure the implementation frameworks, which enable them to maintain information
security throughout the information system's lifecycle.
(b) When constructing a system based on the common platform system, information systemsecurity officers shall request that chief information security officers ensure frameworks inaccordance with the operational management provisions and so on, set forth by the
Agencies, which maintain, operate, and manage the common platform system.
(c) When the cooperation of the person responsible for the management of information systems(chief information officer (CIO)) must be obtained to ensure the frameworks required in
the previous two items, the chief information security officer shall request that said person
responsible for the management of information systems set said frameworks in place inwhole or in part.
(2) Formulation of security requirements for information systems(a) Information system security officers shall formulate security requirements including thefollowing items, based on the matters such as purpose of constructing the information
system, task requirements for the targeted tasks and so on, as well as classification of
information handled by said system, after determining whether it is necessary to isolate said
system from the internet or from systems connected to the internet (including external
services).
(i)

Requirements for security functions to be incorporated to the system such as
user/entity authentication, access control, authority control, log management, andencryptions(ii)

Requirements for operational management functions such as monitoring, while theinformation systems are in operation (if the data to be monitored has been encrypted,
it must be decrypted as needed).

(iii) Requirements for measures against vulnerabilities of the information systems(b) When constructing an information system connected to the internet, information systemsecurity officers shall decide the communication lines to connect and define security
requirements for multiple protection to diminish risks of leakage, manipulation and so forth,caused through the internet such as targeted attacks.
(c) Information system security officers shall refer to the “List of Requirements for Ensuring
Security in Procurement of IT Products” when procuring an equipment, and shall analyze
the threats in the environments where the equipment is used, and formulate security
requirements to counter the information security threats in said equipment, etc.
(d) When constructing systems based on the common platform system, information systemsecurity officers shall formulate security requirements in accordance with the operational
management provisions and so on related to the security measures for such common
platform system, in order to maintain the level of information security of entire common
platform system.

(3) Measures when subcontracting the construction of information systems(a) When subcontracting the construction of information systems, information system security
officers shall oblige the subcontractors to ensure compliance on the following requirements
by implementing measures such as indicating them in the procurement specifications(i)Appropriate implementation of information security requirements(ii)

Systems tests conducted from perspectives of information security(iii) Information security measures in the environment and process of information systemdevelopment.
(4) Measures when subcontracting the operation and maintenance of information systems(a) When subcontracting the operation and maintenance of information systems, information
system security officers shall ensure the subcontractors to comply with the requirementsfor proper operation of the system’s security functions, by indicating these requirements inthe procurement specifications, and so on.
(b) When subcontracting the operation and maintenance of information systems, information
system security officers must have the subcontractors promptly report to them regarding
the contents of any changes to the information systems resulting from the information
security measures for information systems instituted by the said subcontractors in order toproperly grasp the said measures.

5.2.2 Procurement and construction of information systems
PurposeWhen procuring and constructing information systems, it is necessary to procure an equipment basedon the selection criteria and to carry out information system measures at the development phase of
the system, in order to appropriately implement information security measures in accordance with theprescribed security requirements.
It is also required to conduct system inspections following the established/maintained inspection
procedures at the time of delivery or reception of information systems, to ensure appropriate
incorporation of security and management functions to protect the information handled by such
systems.
Compliance Requirements(1) Measures when selecting equipment, etc.
(a) Information system security officers shall validate if the equipment, etc.is conformed to its
selection criteria and use the result as one of the factors for its selection.
(2) Measures when constructing information systems(a) When constructing information systems, information system security officers shall
implement measures deemed necessary from perspectives of information security.

(b) When the constructed information systems are migrated to the operation and maintenancephase, information security officers shall implement the measures for procedures andenvironments of migration deemed necessary from perspectives of information security.
(3) Measures for inspections on delivery(a) Information system security officers shall conduct validations and inspection at the time ofdelivery, following the inspection procedures prescribed in the specifications and so on, inorder to ensure the procured equipment, etc. and the received information systems areconforming to the requirements for information security measures.
(b) When an information system transitions from the development phase to the operation andmaintenance phase, information system security officers shall confirm that content
necessary for information security measures is included in the items handed down from thedeveloper of the information system in question to its operator/maintainer.

5.2.3 Operation and maintenance of information security
PurposeWhen information systems are migrated to the operational phase, it is necessary to establish theresource allocation system in operation, and to perform regular checks of parameters settings on theequipment and other components, as well as to manage records of operation and maintenance, in orderto ensure proper implementation of the security requirements determined upon planning, procurement,
and construction of the system.
Most of information security incidents normally occur during operation, so it is important to duly
monitor the operation of information systems to confirm effectiveness of the implemented information
security measures.
Also, the information security measures for system maintenance need to be appropriately
implemented in the same manner as those for system operation. In those cases such as individually
outsourcing system maintenance work, it is essential to duly implement the information security
measures in accordance with the government agency’s own standards.
Compliance Requirements(1) Measures for information systems during operation and maintenance(a) Information system security officers shall appropriately operate the security functions
incorporated to the system during its operation and maintenance.
(b) For the systems constructed based on the common platform system, information systemsecurity officers shall appropriately operate the information systems under the operational
management framework in accordance with the segregation of duties with the other
Agencies which maintain, operate and manage the common platform system. Information
system security officers shall also operate the information systems following the common
platform system’s operational management provisions and so on, in order to maintain thelevel of information security of entire common platform system.

(c) Information system security officers shall manage the records of operation and maintenance,in order to facilitate tracing of incidents such as malicious activities and unintended accessto the systems.

5.2.4 Update and disposal of information systems
PurposeWhen updating or disposing of information systems, it is necessary to prevent leakage of highly
confidential information contained in the system during disposal or recycling.
If the highly confidential information is saved on the information systems, or classifications or
handling restrictions of information stored on the systems are unclear, it is essential to implemen t
measures to ensure complete erasure of such information.
Compliance Requirements(1) Measures for update and disposal of information systems(a) When updating or disposing of information security systems, information security officers
shall implement the following measures, taking into account of classifications and handling
restrictions of the information stored in said systems.
(i)Information security measures for transferring data when updating information
security systems.

(ii)Erasure of unnecessary data when disposing of information security systems

5.2.5 Review on measures for information systems
PurposeAs the environments surrounding information security are constantly changing, the level of
information security cannot be maintain if emerging threats are not precisely addressed. For thisreason, it is necessary to regularly review the information security measures, and conduct further
reviews in the event of drastic changes in external environments, and so on.
Compliance Requirements(1) Review on measures for information systems(a) Information security officers shall duly examine necessity of review on information
security measures on information systems, in response to the status such as emerging threats,
operation, and monitoring, and take necessary measures if they are deemed necessary.

5.3

Operational Continuity Plan of Information Systems

5.3.1 Ensuring consistency between information security measures for information
systems and the systems’ operational continuity plans
PurposeIt is essential, even in emergencies, to ensure the continuity of business whose interruption may cause

a serious threat to the safety and benefit of citizens. As such, national administrative organs establish
and carry out business continuity plans for government agencies and operational continuity plans for
information systems. Incorporated Administrative Agencies and Designated Corporations likewise
establish and carry out corporate business continuity plans and operational continuity plans for
information systems according to the characteristics of their work following their mid-term targets
and other instructions.
On the other hand, when continuing operation of information systems at the time of emergency, it isvital to examine and determine the measures for information security in emergency.
It is also necessary to ensure that the requirements prescribed in such business continuity plan andinformation system operational continuity plan, and those prescribed in the information security
related provisions are in accordance with each other, and contain no inconsistencies among them.
Compliance Requirements(1) Ensuring consistency between information security measures for information systems and thesystems’ operational continuity plans(a) When it is necessary to set in place information system operational continuity plans, which
support the highly prioritized tasks during emergencies at Agencies, the head information
security officer shall review the matters related to measures for information security inemergency.
(b) The head information security officer shall confirm if the measures for information systems
in emergencies are feasible, when performing tasks such as education and training as wellas maintenance and revision on the operational continuity plan of information systems.

Chapter 6
6.1

Security Requirements for Information Systems

Security Functions of Information Systems

6.1.1 User/entity authentication functions
PurposeIn order to limit users/entities accessible to the information or the information systems, it is necessary
to introduce user/entity authentication functions. It is important to take measures to prevent
unauthorized access through abusing vulnerability or impersonation.
In case of providing services for general public from information systems of Agencies, it is necessary
to appropriately protect user/entity authentication information, considering that it is general public
who access its information systems.
Compliance Requirements(1) Implementation of the user/entity authentication functions(a) Information system security officers shall implement the user/entity identification andauthentication functions when identification and verification of authorized users/entities arenecessary.
(b) When establishing information systems that provide online procedures for submitting
applications and notifications between the public or companies and Agencies, information
system security officers shall formulate requirements for user/entity authentication basedon an assessment of the risks involved with these online procedures.
(c) Information system security officers shall implement measures to prevent malicious
activities caused by leakage of user/entity authentication information and so on, as well as
the measures against unauthorized attempts of user/entity authentication.
(2) Management of the identification code and the user/entity authentication information(a) Information system security officers shall implement measures to appropriately give
identification code and user/entity authentication information to all the entities who accessinformation systems, and manage them.
(b) Information system security officers shall implement measures to prevent malicious use ofidentification code and user/entity authentication information, soon after it becomes nolonger necessary for the entity to use the information system.

6.1.2 Access control functions
PurposeAccess control means control of entities who access information systems and information. In casethat multiple users operate information systems, risks of information leakage, etc. can be diminishedby restricting access to some specific information in the information system only to entities necessary
to use it.

Compliance Requirements(1) Implementation of access control functions(a) Information system security officers shall implement a function which enables only theauthorized persons to set access control according to the characteristics of information
systems, and the classification and handling restrictions of information handled in thesystems.
(b) Information system security officers shall appropriately operate access control functions so
as to surely restrict the entities who permit the access to information systems andinformation.

6.1.3 Authority control
PurposeIn order to operate appropriately access control functions of important systems, it is necessary to set
appropriately authority of access from entities to the object. Without appropriate authority control, therisks of unauthorized access to information or information systems would arise.
Administrator authority is one of the authority control functions on the information system, which
generally includes privileges to allow all operations on the system.
If such privileges were stolen by malicious third parties, there would be dangers such as leakage ormanipulation of user/entity authentication information, or disabling of information security functions
by unauthorized setting changes on the information system. Therefore, it is vital to limit theadministrator authority only to the relevant users.
Compliance Requirements(1) Authority control(a) Information system security officers shall implement measures to set appropriately
authority of access from entities to the object.
(b) Information system security officers shall implement measures to minimize damages causedby thefts of identification codes and user/entity authentication information ofadministrator’s privileges, and to prevent malicious and erroneous operations which areinternally performed.

6.1.4 System logs retrieval and management
PurposeLogs of the information system are the records of operation, user access history, communication
history, and other essential information of management of the system, which are important tools for
detecting information security incidents and signs of an incident, such as unauthorized access andoperations by malicious third parties.
If any incident concerning information security on the system takes place, these logs will serve asimportant material for identifying and clarifying the causes in the course of investigations after theincident. For this reason, information systems’ logs should be duly retrieved in accordance with

system specifications and need to be appropriately maintained and protected to prevent these logs
from being manipulated or lost.
Compliance Requirements(1) Event logs retrieval and management(a) Information system security officers shall retrieve logs of information system which arenecessary to verify the information systems are appropriately used and free fromunauthorized access and operation.
(b) After determining the purpose to retrieve logs according to the characteristics, information
system security officers shall determine items such as equipment, etc. in which logs should
be retrieved, types of information recorded in the log, storage periods, log information
handling methods from a viewpoint of classified information handling, as well as measures
to implement when log retrieval is not possible, and appropriately manage the logs.
(c) Information system security officers shall establish a function to examine or analyze thelogs retrieved from the information systems, and perform examinations or analysis to detect
unauthorized access and operations, etc. by malicious third parties, and so on.

6.1.5 Encryption and digital signatures
PurposeEncryption and digital signatures are effective means to prevent leakage and manipulation of
information handled by information system, so it is essential to appropriately implement thesefunctions to the system.
When introducing encryption and digital signatures, it is necessary to take into account the issues suchas adequacy of algorithms and the protocols using it, measures in case that said algorithm wascompromised during operation or in case that a vulnerability is found in said protocol, as well as
appropriate key information management.
Compliance Requirements(1) Implementation of encryption and digital signature functions(a) Information system security officers shall take the following measures to prevent leakage
and manipulation of information handled by information systems(i)

Examine the necessity of encryption functions for the information systems handlingconfidential information, and duly implement them when it is deemed necessary.

(ii)

Examine the necessity of digital signature and verification functions for the
information systems handling critical information, and implement them when it isdeemed necessary.

(b) Information system security officers shall refer to the “e-Government Recommended
Ciphers List” whose security and performance is confirmed by CRYPTREC (theCryptography Research and Evaluation Committees) and shall establish operational

methods of encryption and digital signature algorithm used on information systems, andsafe protocol using it and operation method, which include the following items.
(i)

For encryption and digital signature algorism used by employees and safe protocol
using it, ensure the one in the “e-Government Recommended Ciphers List”(CRYPTREC) is to be applied where possible.

(ii)

When introducing encryption or digital signature upon implementations or updates of
information systems, apply algorithms in the “e-Government Recommended Ciphers
List” and safe protocol using it, expect for unavoidable circumstances.

(iii) Establish emergency response procedures in the event that the algorithm iscompromised or in the event that a vulnerability is found in safe protocol using it.
(iv) Establish procedures for managing keys for decryption of encrypted information, andfor granting digital signatures(c) When assigning a digital signature, information system security officers shall ensure theuse of an appropriate public key infrastructure according to the purpose, if the one which isapplicable and serves the purpose of digital signature exists, after examining the algorithm
and operational methods of encryption and digital signature applied at their own Agencies.
(2) Management of encryption and digital signature(a) Information system security officers shall take the following measures to ensure proper useof encryption and digital signature(i)

For the information systems which assign digital signatures, securely provide theverifiers of signatures with information and methods of verifying the validity of thesignatures(ii)

For the information systems which perform encryption, or those which performassignment or verification of digital signatures, regularly obtain information on
threats which compromise the algorithm selected for such operations or raise
vulnerability in protocol, and share it with employees as necessary.

6.2

Measures against Information Security Threats

6.2.1 Measures against software vulnerabilities
PurposePotential threats against the information systems of Agencies include attacks such as third party
intrusions to the systems resulting in the theft or destructions of important information belonging to
the Agencies, as well as suspension thereof due to excessive workloads imposed by the third party. In
particular, third party intrusions perpetrated against services for the general public resulting in theleakage of important information such as personal information could have an enormous impact on thedaily lives of the general public and undermine public trust in the Agencies.
As for these types of threats in general, attackers are likely to abuse vulnerability of software in theserver, terminals, and communication line equipment which compose of information systems.
Therefore, for information systems in Agencies, it is necessary to quickly and appropriately takemeasures against software vulnerabilities.
By the same token, the hardware of information systems may contain such vulnerabilities, so it isessential to refer to the provisions in section 5.2.2 “Information system procurement andconfiguration”, and to implement necessary measures.
Compliance Requirements(1) Implementation of measures against software vulnerabilities(a) When installing or starting operations of servers, terminals, and communication line
equipment, information system security officers shall implement measures against publicly
disclosed vulnerabilities of the software used on said equipment.
(b) When the publicly disclosed information about vulnerabilities is yet to be known, andapplicable measures for servers, terminals, and communication line equipment are available,
information system security officers shall implement such measures.
(c) Information system security officers shall regularly verify the status of measures against
vulnerabilities in the software used on servers, terminals, and communication line
equipment.
(d) When it has been confirmed that measures against vulnerabilities have not been taken as aresult of the regular verification of the status of such measures, or when information about
vulnerabilities of the software used on servers, terminals, and communication line
equipment becomes available, information system security officers shall apply security
patches, or establish plans for addressing software vulnerabilities and implement measures,
after examining the effects upon information systems due to software updates and so on.

6.2.2 Measures for protection against malware
PurposeIf information systems were infected by malware, potential threats would be system breakdown andleakage of important information stored on said systems. Moreover, such infected information
systems can spread infections to other systems, and possibly used as a platform to send spam e-mails
and for denial-of-service attacks and so on, as well as a source of targeted attacks, which could givea threat to other entities and other information systems.
In order to prevent such incidents from occurring, it is necessary to duly implement measures against
malware.
Compliance Requirements(1) Implementations of measures against malware(a) Information system security officers shall install anti-malware software and other tools onserver equipment and terminals. However, this shall not apply when no anti-malware
software and so on, which are operational on said server equipment and terminals is readily
available.

(b) Information system security officers shall take measures against malware, such as installing
anti-malware software to protect all possible malware infection routes.
(c) Information system security officers shall regularly examine the implementation status of
measures against malware as needed and take necessary measures.

6.2.3 Measures against denial-of-service attacks
PurposePotential threats against information systems accessed through the internet would be a denial-ofservice attack by third parties, which disables legitimate users to access the services. Therefore, for
the information systems of Agencies that are accessed through the internet, it is vital to take denialof-service attacks into account and duly implement measures to ensure continuous availability of thesystems. Recently, it is known that large-scale attacks by botnet consisting of so-called IoT (Internetof Things) devices connected to the Internet, or DDoS (Distributed Denial of Service) attack agency
services that enable attacks without specialized technology or equipment exist. It is necessary to
become more wary of those attacks.
Compliance Requirements(1) Implementation of measures for denial-of-service attacks(a) For information systems (referring to only those systems accessed through the internet,
hereinafter the same in this section) handling vital information, system security officers
shall implement measures for denial-of-service attacks, by using the functions incorporated
in the equipment necessary for providing such services, like server equipment, terminals,
and communication line equipment, or the methods offered by private business providers,and so on.
(b) For information systems handling vital information, system security officers shall construct
information systems equipped with tools which minimize impacts of denial-of-service
attacks.
(c) For information systems handling vital information, system security officers shall identify
equipment to be monitored among the server equipment, terminals, communication line
equipment, and communication lines which are subject to denial-of-service attacks, andconduct monitoring.

6.2.4 Measures against targeted attacks
PurposeTargeted attacks are attacks targeting a specific Agency, where attackers conduct a thoroughinvestigation in advance, on the matters such as business practices and other internal information of
the target, then make tenacious attacks with a combination of various types of attacks, applying themost effective method to violate the target Agency.
A typical and likely example of such attacks is the one made by intruding into a system of certain

Agency, then expand the intrusion areas to stole or destroy their critical information. A series of suchattacks are also made by using unknown methods, which make it difficult to perfectly detect andprevent them.
Therefore, it is necessary to be prepared for targeted attacks by establishing the multiple protection
system for information security, which consists of measures to reduce targeted attack intrusions
against the Agency (gateway measures), and measures for early detection and response to theintrusions, and measures to make expansion of intrusions harder, as well as measures for detection
and response to unauthorized communications with external entities (inter-Agency measures).
Recently, not only direct attacks to target organizations but also indirect attacks to organizations
related thereto, such as subcontractors, are confirmed. It is required that a wider range of measures be
considered.
Compliance Requirements(1) Implementation of measures for targeted attacks(a) Information security officers shall implement measures for information systems which
reduce targeted attacks intrusions against the Agency (gateway measures).
(b) Information security officers shall implement measures for information systems to
immediately detect and respond to the intruded attacks, and to make expansion of the
intrusion harder, as well as to detect and respond to unauthorized communication withexternal entities (internal measures and exit control measures).

6.3

Creation and provision of applications and contents

6.3.1 Measures upon creating applications and contents
PurposeAgencies prepare applications and contents and make them widely available to offer administrative
services such as providing information, executing administrative procedural tasks, and collecting
opinions. The information security level of user’s terminal should not be deteriorated when using
these applications and contents. Agencies need to implement information security measures whenproviding applications and contents. In addition, when subcontracting the development and provisionsof applications and contents, the requirements in section 4.1.1 “Subcontracting” should be observed.
Compliance Requirements(1) Establishment/maintenance of provisions related to creation of applications and contents(a) The head information security officer should maintain provisions to prevent actions whichcause deterioration of information security level of the systems other than those of their own
Agencies when providing applications and contents.

(2) Formulation of security requirements for applications and contents(a) Information security officer shall include the following items in the specifications ofapplications and contents, in order not to deteriorate the level of information security of theusers other than those of their own Agencies.
(i)Applications and contents to be provided shall contain no malware.

(ii) Applications and contents to be provided shall contain no vulnerability.
(iii) The contents shall not be provided in the format of an executable program, except forcases in which there is no other way to provide them.
(iv) Means to verify that the applications and contents are authentic and free frommanipulation, such as a signature that uses a digital certificate and likewise shall be
provided to the recipients of the applications and contents.
(v) When developing applications and contents, methods of providing them shall beselected to ensure the users of the OS and software will not be prompted to change thesetting which might deteriorate the information security level, including the changes
which force them to use the OS version and software, etc. with vulnerabilities.
(vi) Applications and contents should be developed ensuring that functions not essential
for using the service, such as those which allow third parties to obtain the informationof service users and other parties against their will, are not incorporated in theapplications or contents.
(b) When subcontracting the development and creation of applications and contents, employees
shall include the requirements listed in each item of the preceding paragraph.

6.3.2 Measures upon providing applications and contents
PurposeAgencies prepare websites and make them available to citizens to offer administrative services suchas providing information, executing administrative procedural tasks, and collecting opinions. As these
services are normally provided through the internet, it is important for citizens to be sure that these
services are genuinely offered by authentic Agencies. Furthermore, if no measures are taken against
websites which impersonate Agencies, there would be a fear that the public trust for them would beundermined, and also that the citizens could be directed to unauthorized websites, and infected withmalware. Therefore, it is essential to implement measures to respond to such situations.
Compliance Requirements(1) Use of government domain name(a) Information system security officers shall use government domain name in the information
systems so that the users can confirm that the websites offered to users outside the Agency
are provided by the actual Agency itself. However, this shall not apply in the following
instances.
(i)

In the event that a Designated Corporation is not eligible to register a government
domain name. In such cases, said corporation must use a domain name, which requires

the corporation’s organizational affiliation as its eligibility for obtaining so that it
cannot be obtained by unspecified individuals or organizations.
(ii) In the event that an educational institution, which is either an Incorporated
Administrative Agency or a Designated Corporation, uses a domain name for institutesof higher education. In such cases, the corporation in question must make a decisionin advance based on a comparative consideration of whether it should use agovernment domain name or domain name for higher educational institution from theperspective of ensuring information security.
(iii) In the event that information is disseminated via the social media services listed in
8.1.2(1).
(b) When subcontracting the creation of a website for users outside the Agency, the use of
domain names applicable to the Agencies in question shall be specified in the procurement
specifications, pursuant to the provisions of (i) and (ii) in the above item and the areas notlisted in the same item.
(2) Prevention of users from being lured to malicious websites(a) Information system security officers shall implement measures to prevent users from being
lured, through pages such as search engine sites, to malicious websites which impersonate
Agencies.
(3) Notification of applications and contents(a) When notifying users of applications and contents, employees shall implement themeasures in order to ensure that general users are led to use said applications and contents.
(b) When notifying users of applications and contents provided by the parties other than theirown Agencies, employees shall keep the effectivity of URL and so on in notification.

Chapter 7
7.1

Information Systems Components

Terminals, Server Equipment

7.1.1 Terminals
PurposeWhen using terminals, there are risks such as leakage of stored information due to external causes,
such as malware infection and intrusions. Moreover, internal causes such as improper system handlingor negligence of employees might result in information security incidents, including malware
infection. As for the mobile use of terminals, there is a higher risk of information leakage caused bytheft or loss and so on, of the device. These issues should be taken into consideration when
implementing measures.
Terminals provided by Agencies should be used when executing the work of the Agencies. However,
it is considered that there are situations where use of non-Agency-furnished terminals is necessary toprocess information, such as while on business trips or away from the office. In such situations, thelevel of security standards for information processed on such terminals may not meet the Agency’s
standards. Therefore, in cases where the possibility exists that non-Agency-furnished terminals will
be used for work, it is essential to properly assess whether the information security standards required
for this use can be ensured, restrict available functions of and take additional security measures forsuch terminals, and then have employees use such terminals under the strict control of the Agency sothat they are able to perform the work.
In addition to the requirements in this provision, requirements regarding measures for functions suchas user/entity authentication, access control, authority control, and log management in section 6.1“Security Functions for Information Systems”, section 6.2.1 “Measures against software
vulnerabilities”, section 6.2.2 “Measures for protection against malware”, and section 7.3.2 “IPv6communication lines” should also be complied with.
Compliance Requirements(1) Measures when introducing terminals(a) For terminals which handle classified information, information system security officers
shall implement measures against physical threats such as theft and unauthorized removalof terminals, unauthorized use of terminals by malicious third parties, as well as
unauthorized viewing of display devices of terminals.
(c) To eliminate the possible increase in vulnerability due to use of variety of software,
information system security officers shall specify the software which is approved, or
prohibited to be used on the terminals.
(2) Measures when operating the terminals(a) Information system security officers shall periodically conduct a review of software which
is approved, or prohibited to be used on the terminals.
(b) Information system security officers shall periodically verify the status of all software usedon the terminals under their management, and implement corrective measures whenidentifying any terminal in inappropriate status, and so on.
(3) Measures when terminating the operation of terminals(a) Information system security officers shall erase all the information stored on the external
storage media of the terminal when terminating its operation.
(4) Measures for the adoption and use of Agency-furnished terminals (only when used outside ofareas requiring control measures)(a) In preparation for cases where employees handle classified information through the use of
Agency-furnished terminals (only when used outside of areas requiring control measures),head information security officers shall establish usage protocols and approval procedures,
taking into account the risks of information leakage from these terminals and thecommunication lines used.
(b) Head information security officers shall establish provisions related to technical measures
to prevent the theft of data as a result of theft, loss, infection with malware, etc. for Agencyfurnished terminals (only when used outside of areas requiring control measures) that
handle confidential information.
(c) In cases where approval is granted to connect Agency-furnished terminals connected tocommunication lines outside the Agency outside of areas requiring control measures tocommunication lines inside the Agency after whether or not to approve this has beenreviewed and a decision to approve has been made, the head information security officers
shall establish provisions related to security control measures and approval procedures thattake into account the risk of information systems being infected with malware from said
terminals via communication lines inside the Agency.
(d) When employees use Agency-furnished terminals (only when used outside of areas
requiring control measures) to handle confidential information, information system security
officers shall take technical measures referred to in (b) of this section 7.1.1(4) for thecorresponding terminals.
(5) Measures for the adoption and use of non-Agency-furnished terminals(a) The chief information security officer shall determine the advisability of using non-Agencyfurnished terminals at the Agency by taking into consideration the prospects for meeting therequired information security standards when doing so. This determination shall also bebased on factors such as the classification of the information to be handled and restrictions
on handling it, the security control measures taken by the Agency, and the understandingthat the management of the terminal in question is carried out by its owner instead of the
Agency.
(b) The head information security officer shall establish procedures for granting approval andso on when employees perform information processing pertaining to the Agency’s workthrough the use of non-Agency-furnished terminals.

(c) In preparation for cases where employees handle classified information through the use of
non-Agency-furnished terminals, the head information security officer shall establish usage
protocols and approval procedures, taking into account the risks of information leakage
from these terminals and the communication lines used.
(d) The head information security officer shall establish the following provisions related tosecurity control measures for non-Agency-furnished terminals that handle confidential
information:(i)Technical measures to prevent the theft of data as a result of theft, loss, infection withmalware, etc.
(ii) Usage measures to prevent the theft of data as a result of infection with malware or thelike(e) In cases where approval is granted to connect non-Agency-furnished terminals connected
to communication lines outside the Agency outside of areas requiring control measures tocommunication lines inside the Agency after whether or not to approve this has beenreviewed and a decision to approve has been made, the head information security officer
shall establish provisions related to security control measures and approval procedures thattake into account the risk of information systems being infected with malware from said
terminals via communication lines inside the Agency.
(f)Information security officers shall designate officers responsible for managing theimplementation status of security control measures concerned with processing theinformation involved in the Agency’s operations through the use of non-Agency-furnishedterminals (hereinafter referred to as “terminal management officers”).

(g) When employees use non-Agency-furnished terminals to handle confidential information,
terminal management officers shall take the security control measures established in (d)(i)of this section 7.1.1(5) for the corresponding terminals.
(h) Terminal management officers shall have employees take those security control measuresestablished in (d)(i) of this section 7.1.1(5) that they cannot take on their own despite theprovisions of the previous paragraph, as well as those security control measures establishedin (d)(ii) of this section 7.1.1(5), for non-Agency-furnished terminals used to handle
confidential information.
(i)

Employees shall take those security control measures established in (d)(i) in the previous
paragraph that the terminal management officer cannot take on his/her own, as well as thosesecurity control measures established in (d)(ii) of this section 7.1.1(5), for non-Agencyfurnished terminals used to handle confidential information.

(j)When processing information pertaining to the Agency’s work through the use of nonAgency-furnished terminals, employees shall obtain the approval of the relevant terminal
management officer.

(k) Upon completion of the purpose of information processing, employees shall delete allclassified information from non-Agency-furnished terminals.

7.1.2 Server equipment
PurposeServer equipment such as e-mail servers, webservers, and file servers normally store large size of
information, so that the impact of leakage and manipulation of such information is far larger than thatof terminals. In addition, server equipment is subject to a higher risks of malware infection andintrusions, because their functions are generally utilized via communication lines. If the server
equipment used by Agencies were used for unauthorized access or relaying spam e-mails, it would
seriously undermine the public trust in these Agencies.
Moreover, as a large number of users simultaneously use server equipment, failure of its functions
would result in a greater impact. These issues should be taken into consideration when implementing
measures.
In addition to the requirements in this provision, requirements regarding measures for functions suchas user/entity authentication, access control, authority control, and log management set forth in section
6.1 “Security Functions for Information Systems”, as well as requirements concerning server
equipment set forth in section 6.2.1 “Measures against software vulnerabilities”, section 6.2.2“Measures for protection against malware”, section 6.2.3 “Measures against denial-of-service attacks”,
and section 7.3.2 “IPv6 communication lines” should be complied with. For e-mail servers,
webservers, DNS servers, and database in particular, the requirements set forth in section 7.2 “E-mails ,Web, and so on” should be complied with, in addition to the common measures stipulated in thisprovision.
Compliance Requirements(1) Measures when implementing server equipment(a) For server equipment which handles classified information, information system security
officers shall implement measures against physical threats such as theft and unauthorized
removal of server equipment, unauthorized use of server equipment, as well as
unauthorized viewing of display devices of server equipment.
(b) To prevent situations where services are suspended due to failure, excessive access, andother problems with information systems which handle vital information, information
system security officers shall ensure system’s availability by setting up the server
equipment for such services in a redundant configuration, and so on.
(c) To eliminate the possible increase in vulnerability due to use of variety of software,
information system security officers shall specify the software which is approved, or
prohibited to be used on the server equipment.
(d) Information system security officers shall implement measures to prevent leakage of
information sent and received while the server equipment maintenance is being performed
via communication lines.

(2) Measures when operating the server equipment(a) Information system security officers shall periodically conduct a review of software which
is approved, or prohibited to be used on the server equipment.
(b) Information system security officers shall periodically verify the software andconfiguration of all server equipment under their management, and implement corrective
measures when identifying any server equipment in inappropriate status, and so on.
(c) Information system security officers shall implement measures to monitor the server
equipment in case it is necessary to detect the occurrence of unintended incidents such as
malicious acts and unauthorized access to the server equipment. However, this shall not beapplied if such monitoring is deemed unnecessary due to the usage environment of theserver equipment.
(d) For server equipment handling vital information, information system security officers shall
implement measures which enable to recover the operation in case where the server
equipment becomes unavailable.
(3) Measures when terminating the operation of server equipment(a) Information system security officers shall delete all information stored on the external
storage media of server equipment when terminating its operation.

7.1.3 Multifunction devices and equipment for specific purposes
PurposeMultifunction devices, containing a combination of printer, fax, image scanner, and copier functions,
are used at Agencies. These multifunction devices are often connected to internal communication lines,
as well as to the public telephone networks and other communication lines when in use, in which casevarious kinds of threats are expected, because many services including web console, file transfer, filesharing, as well as remote maintenance will be operating on such devices.
Moreover, information systems for specific purposes, such as systems for video conference, IP phone,
network camera, entry control systems, facility management systems, and environment monitoring
systems are also used at Agencies. With such information systems, in addition to devices for general
purposes, equipment for specific purposes with functions needed to achieve the objectives dedicatedto the system are also used. Furthermore, so-called IoT devices, which are connected to the internet,
are included among equipment for specific purposes. Numerous attacks that exploit vulnerabilities inthese IoT devices have occurred in recent years, and attacks such as those in which IoT devices areused as a jumping-off point to attack other information systems have come to pose a social problem.
Therefore, information security measures must be taken for these devices as well.
Given these situations, it is important to treat these multifunction devices and equipment for specificpurposes, including IoT devices, as part of the information system components, and to implement
measures in an appropriate manner by assigning personnel and clarifying who is in charge.

Compliance Requirements(1) Multifunction devices(a) When procuring multifunction devices, information system security officers shall establish
appropriate security requirements according to functions, installation environments, as well
as classification and handling restrictions of information handled by such devices.
(b) Information system security officers shall implement measures for information security
incidents against multifunction devices while in operation, by taking actions such as toappropriately set up the functions available on said devices.
(c) Information system security officers shall delete all information stored on the external
storage media of multifunction device when terminating its operation.
(2) Equipment for specific purposes, including IoT devices(a) For equipment for specific purposes, if there are possible threats depending on information
handled, methods of use, and connection types of the communication lines and so on,
information system security officers shall implement

measures suitable for thecharacteristics of said equipment

7.2

E-mail, Web, and others

7.2.1 E-mailPurposeAs sending and receiving e-mails is nothing but an exchange of information, there are risks against
confidentiality, including information leakage caused by inappropriate use, as well as risks that
employees who use e-mail to be victimized by illegal acts abusing e-mails, such as impersonation bymalicious third parties. In order to prevent these problems, proper e-mail server management isessential.
In addition to the requirements in this provision, the same for the server equipment in section 7.1.2“Server equipment” should be complied with.
Requirements(1) Measures when introducing e-mail services(a) Information system security officers shall set up the e-mail servers, ensuring no illegal email relaying occurs.
(b) Information system security officers shall provide functions of user/entity authentication
when sending and receiving e-mails between e-mail clients and servers.
(c) Information system security officers shall implement measures to prevent e-mail spoofing.
(d) Information security officers shall take measures to encrypt communications between email servers in order to prevent the theft or manipulation of e-mails sent over the internet.

7.2.2 Web
PurposeWebservers are open to public access on the internet and under constant risk of attacks. As possible
damage includes manipulation of web contents (information published on web pages), webservers to
be made unavailable, and inducement to false website, it is necessary to address such damage by
combining appropriate measures and implement them.
In addition to requirements in this section, the same for the server equipment in section 7.1.2 “Server
equipment” should be complied with.
Compliance Requirements(1) Measures when introducing and operating webservers(a) For management and setting of webservers, information system security officers shall
implement measures to ensure information security, including the following items.
(i)Unnecessary functions of webservers shall be stopped or restricted(ii)

Personnel responsible for editing web contents shall be limited.

(iii) Manage web contents to ensure no senseless nor prohibited contents shall be
published.
(iv) Terminals used for editing web contents shall be restricted, and ID codes anduser/entity authentication information shall be appropriately managed.
(v)

Measures for encryption and authentication by digital certificates shall be taken for
all information in order to prevent the eavesdropping or manipulation of information
sent over the internet.

(b) Information system security officers shall verify the information saved on webservers, andensure no information unnecessary for providing services is stored therein.
(2) Measures when developing and operating web applications(a) When developing web applications, information system security officers shall implement
measures to eliminate known vulnerabilities of existing web applications. In addition, thesemeasures shall be periodically reviewed during operation for any oversights, andappropriate action should be taken when identifying such oversights.

7.2.3 Domain Name Systems
PurposeA domain name system (DNS: Domain Name System) is hierarchical and decentralized system on theinternet which is mainly used to manage correspondence (forward lookup and reverse lookup)
between host names on the internet or domain names in E-mail and IP addresses. DNS serves, after
receiving queries from clients (DNS clients) including terminals to return responses such ascorresponding relationships between IP addresses and domain names and host names. DNS includes
content servers which return responses to queries about the domains which the government agency
manages and cache servers which make queries to content servers according to queries from DNS

clients. If a cache server becomes unavailable, the websites and e-mails which use the host names andthe domain names, etc. will be unusable. In addition, if the integrity of information supplied by acontent server is compromised and incorrect information is provided, there is a risk of damage such
as DNS clients, including terminals, will be connected to malicious servers. Furthermore, if there isany error in the setting of a DNS, detection of e-mail spoofing becomes impossible, because the DNS
partially handles the measure against spoofing of e-mails. To avoid such problems, appropriate DNS
server management is essential.
In addition to the requirements in this provision, the same for server equipment in section 7.1.2“Server equipment” should be complied with.
Compliance Requirements(1) Measures when introducing the DNS(a) For the content servers which provide name resolution to information systems handlingvital information, information system security officers shall implement measures to ensure
there is no interruption to the name resolution.
(b) For the cache servers, information system security officers shall implement measures toensure appropriate responses to the name resolution queries.
(c) When the content servers are used to provide the resolution of the names exclusive to theirown government agency, information system security officers shall implement measures toensure no such information managed in said content server is leaked outside of the Agencies.
(2) Measures when operating the DNS(a) When installing multiple DNS content servers, information system security officers shallmaintain consistency among the servers with regards to the information of the domains
under their management.
(b) Information system security officers shall periodically verify the accuracy of theinformation about the domains managed on the DNS content servers.

7.2.4 Database
Purpose“Database” described in this provision means server equipment composed of database management
system and the data files, which storages classified information, which manages the data constructedsystematically and has several functions which can easily serve for searching, extracting and so forth.
There are various risks for database which storages classified information, for example, the risk by
external factors such as malware infection or the unauthorized access and the risk by the internal
factors such as the inappropriate use or negligence by employees. It is necessary to take technicalmeasures to prevent an abuse of the administrator authority.
Especially, a database storing a large quantity of data may will be a target of cyber-attacks. Breach ofsuch a database has considerable impact on administrative affairs.
In addition to the requirements in this provision, requirements regarding measures for functions suchas user/entity authentication, access control, log management, and encryptions and digital signatures

in section 6.1 “Security Functions for Information Systems”, section 6.2.1 “Measures against software
vulnerabilities”, section 6.2.2 “Measures for protection against malware”, and section 7.3.2 “IPv6communication lines” should also be complied with.
Compliance Requirements(1) Measures when implementing or operating the database(a) Information system security officers shall appropriately perform authority control ofadministrator’s privileges to prevent malicious operations which are internally performed.
(b) Information system security officers shall implement appropriate measures to specify the users
who access data stored in database.
(c) Information system security officers shall implement measures to detect malicious operations
which are performed by a user having authority to access internal data.
(d) Information system security officers shall implement measures to prevent maliciou soperations of data, which abuses the vulnerabilities of database or equipment, etc.
(e) Information system security officers shall appropriately encrypt the data which have to beprevented from leaking caused by malicious method or theft of electric and magnetic storage
media.

7.3

Communication Lines

7.3.1 Communication lines
PurposeMost of unauthorized access and denial-of-service attacks against server equipment and terminals arecarried out through the communication lines and the communication line equipment. Therefore, when
implementing information security measures for communication lines and communications line
equipment, it is necessary to examine potential risks thoroughly and implement measures at theconstructing phase of information systems. Types of information security risks vary depending on thecommunication line providers and the physical line types. These differences should be fully taken into
account when implementing measures.
In addition, configuration of the communication lines and conditions of information systems
connected to them at the launch of information systems may change after operating them for a certain
period of time. Also, there may be some changes in types of attacks.
The measures estimated to be sufficient at the construction phase of information systems may become
insufficient, so it is vital to continually implement measures throughout the operation ofcommunication lines.
Compliance Requirements(1) Measures when installing communication lines(a) During the communication lines installation, information system security officers shallselect appropriate line types according to the classification and handling restrictions of theinformation handled by the information systems connected to the communication lines, andimplement measures necessary for said lines to prevent impacts of information security
incidents.
(b) Information system security officers shall have the communication lines equipped with thefunctions to perform access control and route control on the server equipment and terminals.
(c) Information system security officers shall implement measures to ensure the confidentialityof communication contents, if assuring the confidentiality thereof is deemed necessary
when connecting information systems handling confidential information

to thecommunication lines.
(d) Information system security officers shall implement measures, which enable them toconfirm that the information system is the one that employees are approved to be connectedto the communication lines. The same shall apply when connecting non-Agency-furnishedterminals to communication lines inside the Agencies.
(e) Information system security officers shall install communications line equipment in theareas requiring control measures. However, when it is difficult to install them in said areas,measures such as physical protections to keep the equipment from destruction andunauthorized operation by malicious third parties shall be implemented.
(f) Information system security officers shall implement measures to ensure continuous
operation of communication lines connected to the information systems handling vital
information.
(g) When connecting the internal communication lines to the external communication lines
such as internet access lines and public communication lines, information system security
officers shall implement measures to ensure the information security of the internal
communication lines and the information systems connected to them.
(h) Information system security officers shall implement measures to monitor communication
contents sent and received between the internal communication lines and the external
communication lines.
(i)

Information system security officers shall specify the software required for operating
communication line equipment and maintain/establish authorization procedures forchanging software. This shall not be applied to the communication line equipment whose
software is difficult to change.

(j)

Information system security officers shall ensure information security of remote access,where communication line equipment are remotely accessed for maintenance and diagnosis.

(k) When using communication line services of telecommunication carriers, informatio nsystem security officers shall establish agreements, upon signing a contract with thesubcontractors who construct information systems, on measures to ensure the level of
information security of said line services as well as its service level.
(2) Measures when operating communication lines(a) Information system security officers shall implement measures required to prevent
information security incidents during the operation of communications line equipment.

(b) Information system security officers shall appropriately perform route control and access
control, and review its settings when any change made to the communication lines and therequirements for establishing communication. This review shall also be conductedperiodically.
(c) Information system security officers shall periodically check the status of software requiredfor operating communications line equipment, and implement corrective measures if any
improper status is detected, such as unauthorized software is installed on the equipment.
(d) In the event of incidents which endanger information security of certain information system,
information security officers shall protect other information systems which share thecommunication lines with the endangered information system, by changing the line
configuration to establish a closed and independent communication line, separated from theshared ones.
(3) Measures when terminating the operation of communication lines(a) When terminating the operation of communication line equipment, information security
officer shall take appropriate measures, such as erasing all the information recorded on theexternal storage media on said equipment to prevent leakage of information stored during
the operation, in case that such equipment composing the communication lines are reusedor discarded after terminating its operation.
(4) Measures when introducing wireless LAN environments(a) When constructing the internal communication lines with wireless LAN technologies,
information system security officers shall, on top of implementing the common measuresfor communication line construction, encrypt the communication routes to ensure theconfidentiality of communication contents, then implement other measures required toensure information security.

7.3.2 IPv6 communication lines
PurposeAgencies have been taking initiatives to comply with the IPv6 communication protocol, but there aremany issues to be considered when applying the protocol, such as direct IP reachability and coexisting of two different protocols during the migration from the IPv4 communications protocol.
In recent years, a large number of server equipment, terminal, and communication line equipment,
etc. which are equipped with IPv6 communication technology (hereinafter referred to as “IPv6communications”) by default have been released. When using these products, unintended IPv6
communications could occur on the communication network, which may be abused for unauthorizedaccess. Therefore, necessary measures should be implemented.
There will be further changes in IPv6 technology trends, while the associated information security
measures are expected to develop further, making it essential for Agencies to closely watch thesetechnological trends of information security and duly respond to them.
Compliance Requirements(1) Measures related to information systems with IPv6 communications(a) When constructing information systems using IPv6 technologies for communication,
information system security officers shall select, when possible, a Phase-2 compliant
product based on the IPv6 Ready Logo Program, as the equipment, etc. to procure.
(b) For information systems to be constructed are expected to perform communication with
IPv6 technology, information system security officers shall take into account thecharacteristics of IPv6 communication and so on, and review the threats and vulnerabilities
including the following items, and shall implement necessary measures.
(i)

Threats related to direct IP reachability via global IP addresses(ii)

Threats related to unauthorized access due to incomplete settings of IPv6
communication environments, and so on.

(iii) Vulnerabilities due to lack of consideration for the required process when IPv4 andIPv6 communications coexist in the information system.
(iv) Vulnerabilities due to lack of consideration for the required IPv6 addresses handlingon the applications.
(2) Control and monitor for unintended IPv6 communications(a) When connecting server equipment, terminals and communications line equipment tocommunication lines for which no IPv6 communication is intended, the information systemsecurity officers shall implement measures to control IPv6 communications in order toprevent information security threats caused by unauthorized IPv6 communications received
from said lines, such as arrival of unexpected IPv6 communication packets as a result of
automatic tunneling functions.

Chapter 8
8.1

Use of Information Systems

Use of Information Systems

8.1.1 Use of information systems
PurposeEmployees use a wide range of information systems, including e-mail, web, and the systems forprocessing tasks on terminals, in order to execute their duties. There is a risk for information security
incidents if these systems are not used appropriately.
Therefore, it is essential to maintain/establish provisions related to the use of information systems,
and employees should comply with the provisions when using the systems.
Refer to Compliance Requirements in 7.1.1(4) for the establishment/maintenance of provisions
related to Agency-furnished terminals (only when used outside of areas requiring control measures),and to Compliance Requirements in 7.1.1(5) for the establishment/maintenance of provisions related
to non-Agency-furnished terminals.
Compliance Requirements(1) Establishment/maintenance of provisions related to the use of information systems(a) The head information security officer shall establish/maintain provisions related to
information security when using information systems at Agencies.
(b) The head information security officer shall establish procedures for handling information
using external electromagnetic recording media, such as USB memory sticks. The
following items shall be included in these procedures.
(i)

Employees shall use external electromagnetic recording media provided by national
administrative

organs, incorporated administrative

agencies, or designatedcorporations, or received from organizations other than the Agency with which their
Agency has concluded an agreement over complying with handling information
through the use of external electromagnetic recording media, stipulated in the usage
protocols regulated by this provision.
(ii)

External electromagnetic recording media received from an organization other than
one’s own shall only be used for the purpose of transporting information between
one’s own Agency and the organization in question. The necessary measures shall betaken to ensure safety when reading information from or writing information to theexternal electromagnetic recording media in question.

(c) The head information security officer shall establish approval procedures for taking
external electromagnetic recording media, such as USB memory sticks, to which
confidentiality class-3 information, critical information, or vital information has beenrecorded outside of areas requiring control measures.
(2) Measures to encourage information systems users to comply with the provisions(a) Information system security officers shall examine, from perspectives of information

security risks and work efficiency, the scope of support functions which encourage
employees to comply with the provisions, and shall construct the information systems
equipped with such functions.
(3) Basic measures for the use of information systems(a) Employees shall not use information systems for non-work related tasks.
(b) Employees shall not connect the information systems at their own Agencies to thecommunication lines other than the ones so authorized by information system security
officers.
(c) Employees shall not connect the information systems which are not authorized byinformation system security officers, to the internal communication lines at Agencies.
(d) Employees shall not use any software prohibited to use on information systems. If using
unauthorized software is required to execute tasks, an approval from the information systemsecurity officer shall be granted.
(e) Employees shall not connect unauthorized equipment, etc.to information systems,(f) In such cases when an employee leaves the area where information systems are installed
and there is a risk for unauthorized operation by third parties, he or she shall implement
measures to protect the systems from unauthorized use.
(g) When handling classified information through the use of Agency-furnished terminals (onlywhen used outside of areas requiring control measures) and non-Agency-furnishedterminals, employees shall follow the prescribed usage protocols.
(h) When using the terminals listed in the following items to handle the information stipulated
in the said items, employees shall obtain the permission of the division/office information
security officer.
(i)Agency-furnished terminals (only when used outside of areas requiring control
measures): Confidentiality class-3 information, critical information, or vital
information

(ii)
(i)

non-Agency-furnished terminals: Classified information

When connecting terminals (including non-Agency-furnished terminals) connected tocommunication lines outside the Agency outside of areas requiring control measures tocommunication lines inside the Agency in areas requiring control measures, employees
shall take the established security control measures.

(j)When connecting terminals (including non-Agency-furnished terminals) connected tocommunication lines outside the Agency outside of areas requiring control measures tocommunication lines inside the Agency in areas requiring control measures, employees
shall obtain the permission of the division/office information security officer.

(k) When taking external storage media, such as USB memory sticks, to which confidentiality
class-3 information, critical information, or vital information has been recorded outside ofareas requiring control measures, employees shall obtain the permission of thedivision/office information security officer.

(4) Measures when using e-mail and web(a) When sending and receiving e-mails containing confidential information, employees shalluse e-mail services provided by the servers which are operated by, or outsourced by, theirown Agencies.
(b) When sending and receiving information by e-mail to parties outside their own Agencies,
employees shall use their government’s domain name as the domain name of such e-mail’s
sender address. However, this does not apply in the cases listed below.
(i)

In the event that a Designated Corporation is not eligible to register a government
domain name. In such cases, the said corporation’s organizational affiliation serves as
its eligibility requirement, and it must use a domain name that cannot be obtained byunspecified individuals or organizations.

(ii)

In the event where it has been determined that a corporation that is an educational
institution and is either an Incorporated Administrative Agency or DesignatedCorporation is using a domain name for higher education institutions.

(iii) In the event that the party of the outside Agencies receiving an e-mail can
acknowledge that it has been sent from an employee (only in cases where agovernment domain name or domain name obtained pursuant to the previous twoitems cannot be used).
(c) When receiving suspicious e-mails, employees shall handle them following the prescribed
procedures.
(d) When it is necessary to review the web client settings, employees shall not make any settingchanges which might impact on the information security.
(e) When downloading the software to the server equipment or terminals on which the web
client is running, employees shall check the integrity of the software by verifying its
distributor’s digital signatures.
(f) When inputting and submitting the confidential information in a web form on the website
they are viewing, employees shall ensure the followings.
(i)

The contents to be submitted will be encrypted.

(ii)

The website genuinely belongs to the organization where the contents are intended to.

(5) Handling of identification codes and user/entity authentication information(a) Employees shall not use the information system by accessing the system through user/entity
authentication with identification codes other than the ones assigned to them.
(b) Employees shall appropriately manage the identification codes assigned to them.
(c) If an employee is granted an identification code with administrator privileges, the use ofsuch identification code shall be limited to only when they execute administrator’s tasks.
(d) Employees shall manage their user/entity authentication information with utmost care.

(6) Measures for the use of encryption and digital signatures(a) Employees shall follow the prescribed algorithms and methods when encrypting
information, as well as assigning the digital signatures to the information.
(b) Employees shall follow the prescribed key management procedures, and appropriately
manage the keys for decrypting the encrypted information, as well as those for assigning
digital signatures to information.
(c) Employees shall take the backup of the key, following the prescribed backup procedures of
the keys for decrypting the encrypted information.
(7) Prevention of malware infection(a) Employees shall make efforts to implement measures against malware infection.
(b) If an employee becomes aware that an information system (including non-Agencyfurnished terminals) could have been infected by malware, he or she shall implemen tnecessary measures, such as to immediately disconnect the infected information system(including non-Agency-furnished terminals) from the communication lines.
(8) Measures when a web conference services is used(a) Employees shall follow procedures prescribed by Agencies to implement information
security measures according to participants in and information handled during a web
conference.
(b) Employees shall, when holding a web conference, take measures so that any person notrelated to the conference is unable to participate therein.

8.1.2 Dissemination of information via social media services
PurposeSocial media services are now being generally used by Agencies for proactive public relations
activities and other purposes. However, it is necessary to make sure that the citizens can verify whether
the account is authentic, because the government domain name is inapplicable in such social media
services provided by the private sector. Furthermore, there is the possibility of hijacking of the
Agencies’ accounts, as well as a situation where vital information cannot be disseminated due tounannounced discontinuation of these social media services. Therefore, when widely disseminatingvital information to the citizens, it is necessary to consider methods of disseminating information to
enable the citizens to access the original information sources. In addition, the originator of theinformation needs to implement measures against threats such as impersonation, to protect parties
including the citizens from confusions caused by false information.
Also, these social media services undergo rapid technology developments such as functionality
expansion and additional services, so it is essential to promptly respond to changes in these external
environments, including the business trends of the providers of such services.
While social media services become available only on consent to standard general terms andconditions, terms of services, etc., it is generally difficult to satisfy necessary and sufficient security

requirements for the handling of confidential information. Therefore, social media services shall be
used only in cases where confidential information is not handled and the level of information
management required for subcontractors is not high.
Compliance Requirements(1) Measures for dissemination of information via social media services(a) The head information security officer shall establish information security measures related
to operational procedures which include the following items, given that the social media
services are used with the accounts managed by Agencies. The head information security
officer shall also stipulate that no confidential information should be handled when using
such services.
(i)

Measures to prevent impersonation, such as to clearly indicate the Agency which
manages the accounts, in order to assure the information disseminated from accountsof Agencies is genuinely originated from authentic Agencies(ii)

Measures to prevent unauthorized access, such as proper management of passwords
and other information for user/entity authentication(b) When using social media services to provide vital information to the citizen, employees shallmake such information available for viewing on their own Agencies’ websites.

8.1.3 Teleworking
PurposeWhile it is required that an environment in which flexible work styles are easily adopted be establishedand maintained pursuant to the execution plan for the realization of work style reform (Decision of
the Council for the Realization of Work Style Reform on March 28, 2017), it is decided that employees
are not always required to come to their working government offices for work for the performance of
their own tasks, but are required to adopt a work style in which they perform their tasks remotely athome, a satellite office, or the like. Also in the situation where employees are requested to refrainfrom coming to their working government offices for work as infection prevention measures for alarge-scale infectious disease, it is necessary to establish and maintain the teleworking environment
so that most of employees are able to perform their tasks in any place other than their working
government offices.
As Provsion 8.1.3 only focuses on measures required for the implementation of teleworking only areprovided. Therefore, in addition to this provision 8.1.3, refer to 3.1.1 “Information handling,” 7.3.1“Communication lines” and 8.1.1 “Use of information systems,” as well as Compliance Requirementsof 7.1.1, section 7.1.1(4) “Measures for the adoption and use of Agency-furnished terminals (onlywhen used outside of areas requiring control measures)” and section 7.1.1(5) “Measures for the
adoption and use of non-Agency-furnished terminals.”Compliance Requirements(1) Establishment of operative provisions(a) The head information security officer shall establish provisions related to information
security measures when implementing teleworking. In principle, it shall be provided thatteleworking shall be performed using Agency-furnished terminals.
(2) Measures for teleworking environment(a) Information system security officers shall ensure security for communication paths andagainst attacks peculiar to remote access when an information system that remotely accesses
information systems at Agencies via communication lines outside the Agency due to theimplementation of teleworking is constructed.
(b) Information system security officers shall perform multiple factor authentications for remote
access.
(c) Information system security officers shall take measures so that terminals used for remote
access are limited to approved terminals.
(d) Information system security officers shall limit terminals used for remote access to terminals
on which the latest vulnerability or anti-malware measures are available.
(3) Measures for teleworking operations(a) Information system security officers shall specify items to be checked by employees before
and after the implementation of teleworking and have employees carry out the check.
(b) Employees shall select locations where teleworking is implemented so that shoulder surfing
and eavesdropping can be prevented, and when implementing teleworking in any location
other than at home, beware of theft while leaving their work desks.
(c) In principle, employees shall not implement teleworking using communication lines outside
the Agency, on which information security measures are uncertain or insufficient.