008-25 2023/04/01
National Institutes of Natural Sciences, an Inter-University Research InstituteCorporation, Basic Rules on Information Security Countermeasures
September 23, 2016
NINS Rules No. 111
Table of Contents
Chapter 1 General Provisions (Article 1 - Article 4)
Chapter 2 Organization (Article 5 - Article 19)
Chapter 3 Protection of Information Assets (Article 20)
Chapter 4 Information System Life Cycle (Article 21)
Chapter 5 Incident Handling (Article 22)
Chapter 6 Network Supervision, etc. (Article 23 - Article 24)
Chapter 7 Information Security Audit and Inspection (Article 25 - Article 26)
Chapter 8 Information Security Policy, etc. Review (Article 27)
Chapter 9 Miscellaneous Provisions (Article 28)
Chapter 1 General Provisions(Purpose)
Article 1
The purpose of these Rules is to ensure information security in NINS as well as
contribute to the smooth operation and protection of information assets of NINS basedon the Basic Policy of Ensuring Information Security (Decision by the Board of Directorsof 2016; hereinafter referred to as the “Basic Policy”) of the National Institutes of
Natural Sciences, an Inter-University Research Institute Corporation (hereinafterreferred to as “NINS”).
(Information Security Countermeasures Policy)
Article 2 In order to achieve the objectives of the Basic Policy, NINS shall observe thefollowing information security countermeasures policy and implement
countermeasures:(i) Construction and maintenance of the information security management system(ii) Ensuring

thenecessarybudgettocountermeasures1

implementtheinformation

security

008-25 2023/04/01(iii) Protection of information assets and personal information(iv) Implementation of information security education, training, and awareness raising
activities for information system users including executive officers and employees(v) Infiltration of the organization of the information security policy and related rules(vi) Information system security maintenance and improvement(vii) Improve the system, procedure manual, etc. against information security incidents.
(viii) Network monitoring, etc. and use information acquisition(ix) To grasp the situation of managing the information system and implementation ofrequired measures(x)

Review of information security policy based on self-inspection for information
security countermeasures, audit implementation, and their results, or the like.

(xi) Other countermeasures in responding to information security threats, etc.
surrounding NINS
(Definitions)
Article 3 In this rule, the definitions of the terms listed in the following items shall be asprovided in the respective items:(i) Networks

mean

information

system(s)implemented

with

a

collectionofinterconnected components including communication lines, routers.
(ii)

Information systems mean systems consisting of hardware and software that areused for information processing or communication (supercomputers, servers, personal
computers, mobile terminals, general-purpose machines, software, etc. (including
operating systems), hardware, software, etc. for preparation, use, management, etc.
of information) and unless otherwise specified, mean those procured or developed by
NINS (including systems and external services for which management is outsourced).
(iii)

Information facilities and equipment mean computer rooms, communications

branch panel, distribution boards, power supply cables, communications cables, etc.
(iv)

Electronic or magnetic storage media mean physical devices or writing surfaces

including magnetic tapes, optical disks, magnetic disks, Large Scale Integration (LSI)
memory chips, onto which information is recorded, stored, or printed within an
information system(v)

Information handled in networks and information system means any

communication or representation of knowledge such as facts, data, or opinions in any
medium or form, including textual, numerical, graphic, cartographic, narrative, oraudiovisual.

2008-25 2023/04/01(vi)

System-related

documentsmeansystemdesigndocuments,

program

specifications, operation manuals, terminal management manuals, network
configuration diagrams, etc.
(vii) Information assets mean Networks, Information systems, Information facilities
and equipment, Electronic or magnetic storage media, Information handled in
networks and information system and System-related documents.
(viii) Information security means the protection of information and information
systems from unauthorized access, use, disclosure, disruption, modification, or
destruction in order to provide confidentiality, integrity, and availability based on theinformation asset classification provided in Appended Table 1.
(ix)

Information security policy means the Basic Policy, these rules, and the National

Institutes of Natural Sciences, an Inter-University Research Institute Corporation,
SecurityCountermeasures

Standards(hereinafterreferred

to

as

the

“Countermeasures Standards”) provided by the Chief Information Security Officer(hereinafter referred to as the “CISO”) based on Paragraph 3, Article 5.
(x)

Implementation regulations mean regulations and plans provided by the CISO

based on the information security policy.
(xi)

Incidents mean a violation or imminent threat of violation of the security policyof NINS, laws, acceptable use policies, or standard security practices intentionally or
accidentally.
(xii) Personal information means personal information prescribed in the National
Institutes of Natural Sciences, an Inter-University Research Institute Corporation,
Personal Information Protection Rules (NINS Rules No. 54 of 2005).
(xiii) Each institute means the inter-university research institutes provided in
Paragraph 1, Article 2 of the National Institutes of Natural Sciences, an Inter
University Research Institute Corporation, General Rules for Organization andOperation (General Rules No. 1 of 2004; hereinafter referred to as the “General Rules
for Organization and Operation).
(xiv) Each institute, etc. means the category including institutes set forth in Appended
Table No. 2.
(xv)

Executive officers, employees, etc. mean executive officers and all persons who areemployed based on the employment regulations provided by NINS.
(xvi) Joint users, joint researchers, etc. mean all persons other than those listed in thepreceding item who use information assets of NINS.

3

008-25 2023/04/01(xvii) Electronic or magnetic storage means records made by an electronic form, amagnetic form, or any other form not recognizable to human perception, which is used
in information processing by computers.
(xviii) Research information means information arising from research activities(including analysis) from among information, etc. listed in Item 5 and Item 6.
(Scope)Article 4 The scope of application of the information security policy shall be the scope prescribedin any of the following items; provided however, that it excludes those provided in the
countermeasures standards by the CISO.
(i) Information assets owned or managed by NINS(ii) Information equipment linked to the network and information system owned or
managed by NINS and those deemed not to fall under the preceding item(iii) Information assets provided based on a contract or agreement concluded with NINS(iv) Information which was prepared or acquired for research, education, or otheroperations of NINS by persons who use information assets provided in Item 1 or
the preceding item or information equipment provided in Item 2 (including persons
other than executive officers, employees, joint users and joint researchers and thesame applies hereinafter) and those stored in such information system or
information equipment(i)

Information which was prepared and acquired for research, education, or otheroperations of NINS by executive officers, employees, joint users, joint researchers, etc.
and those deemed not to fall under the preceding two items

2 Persons who operate, manage, or use information assets provided in the items of thepreceding paragraph shall observe the information security policy.
Chapter 2 Organization(Chief Information Security Officer)
Article 5 The CISO shall be assigned to NINS and the Executive Director in charge of
information or Vice President in charge of information shall serve as the CISO.
2 The CISO shall have comprehensive authority and responsibility concerning thedevelopment, management, and operation of information assets of NINS andinformation security countermeasures (hereinafter referred to as “Information Security
Countermeasures, etc.”)4008-25 2023/04/01
3 The CISO shall have full powers concerning the Countermeasures Standards and shallestablish these to appropriately implement matters provided in the Basic Policy andthese rules.
4 The duties and responsibilities of the CISO shall be provided in the Countermeasures
Standards.
(Institute Information Security Officer)
Article 6 The Institute Information Security Officer (hereinafter referred to as the“Institute CISO”) shall be established as shown in Appended Table No. 2.
2 The Institute CISO shall conduct overall management concerning the implementationof Information Security Countermeasures provided in Article 25, etc. at the organization
under his/her jurisdiction.
3 The duties and responsibilities of the Institute CISO shall be provided in theCountermeasures Standards.
(Information Security Auditing Office)
Article 7 NINS shall have an Information Security Auditing Office and it shall beorganized to consist of persons who falls under any of the following items to audit theobservance of the information security policy at NINS. (i) Information Security Audit
Manager(ii) Information Security Audit Implementer
2 The Information Security Audit Manager shall be the Information Security Auditing
Office Director.
3 The duties of the Information Security Auditing Office shall be as follows:(i) Establish the information security audit schedule and audit plan at NINS.
(ii) Implement the information security audit at NINS.
(iii) Compile the results of the information security audit into a report(iv) Other matters relating to the information security audit at NINS
4 Other necessary matters concerning the Information Security Auditing Office shall be
provided by the Information Security Auditing Office Director.
(Information Security Audit Manager)
Article 8 The Information Security Audit Manager shall be appointed by the President
from among the executive officers, employees, etc. of NINS.
2 The Information Security Audit Manager shall conduct overall management concerning
the information security audit provided in Article 25.
(Information Security Audit Implementer)5

008-25 2023/04/01
Article 9 The Information Security Audit Implementer shall be appointed by the
Information Security Audit Manager from among the executive officers, employees, etc.
2 Notwithstanding the provisions of the preceding paragraph, where the Information
Security Audit Manager deems necessary, a person outside NINS including an expert in
the private sector may be selected as the Information Security Audit Implementer withthe consent of the President.
3 The Information Security Audit Implementer shall be a person independent of thedepartment being audited.
4 The Information Security Audit Implementer shall be a person with expert knowledge
on audit and information security.
5 The Information Security Audit Implementer shall implement the audit provided in
Article 25 based on the instructions of the Information Security Audit Manager.
(Information Security Advisor)
Article 10 NINS may establish an Information Security Advisor as needed.
2 The Information Security Advisor shall be commissioned by the CISO from among NINS
employees who have expert knowledge and experience on information security.
3 Notwithstanding the provisions of the preceding paragraph, where the CISO deems
necessary, a person outside NINS including an expert in the private sector may be
selected as the Information Security Advisor with the consent of the President.
4 The duties of the Information Security Advisor shall be provided by the CISO.
(Information Security Officer)
Article 11 The Information Security Officer shall be established under the Institute CISO
and assumed by a person appointed by the Institute CISO.
2 The duties and responsibilities of the Information Security Officer shall be provided in
the Countermeasures Standards.
(CSIRT)
Article 12 A CSIRT (Computer Security Incident Response Team) shall be establishedunder NINS.
2 The CSIRT shall consist of Institute CSIRTs as prescribed in the following paragraph.
The Institute CSIRT shall be established under the Institute CISO and composed of
persons appointed by the Institute CISO.
4 The Institute CISO may designate persons by dispatch and entrustment of businessother than executive officers and employees as the Institute CSIRT ; provided however,that not less than 1 person shall be designated from among executive officers andemployees.
6008-25 2023/04/01
5 The duties and responsibilities of the CSIRT and Institute CSIRT shall be provided in
the Countermeasures Standards.

(Information System Manager)
Article 13 The Information System Manager shall be established under the Institute CISO
and assumed by a person appointed by the Institute CISO.
2 The Information System Manager may be appointed more than one, however, one
information system shall have one Information System Manager; provided however,that this shall not apply in cases where the Institute CISO deemed it necessary.
3 The Institute CISO shall designate the Information System Manager in cases where
networks, information system, and external electronic or magnetic storage media(limited to those which falls under Item (i) and Item (iii), Paragraph 1, Article 4;
hereinafter referred to as the “Management Information System”) are operated.
4 The Institute CISO may designate the Information System Manager if necessary withregard to networks, information systems, external electronic or magnetic storage media
other than the Management Information System set forth in the preceding paragraph.
5 The duties and responsibilities of the Information System Manager shall be provided in
the Countermeasures Standards.
(Person in Charge of Information System)
Article 14 The person who engages in work including the development of information
assets, change, operation, update, etc. of settings under the order of the Information
System Manager shall be the person in charge of information system.
2 The person in charge of information system shall be assumed by a person appointed by
the Information System Manager.
(Technical Officer, etc.)
Article 15 The Institute CISO may establish an Information System Deputy Manager,
Information Security Technical Officer, Information Security Deputy Technical Officer,
etc. as needed.
2 Necessary matters in the preceding paragraph shall be provided by the Institute CISO
of the relevant institute.
(Information Security Manager)
Article 16 The Institute CISO shall have an Information Security Manager and assumed
by the Document Controller provided in Article 5 of the National Institutes of Natural7

008-25 2023/04/01
Sciences, an Inter-University Research Institute Corporation, Corporate Document
Management Rules (NINS Rules No. 50 of 2004).
2 The Information Security Manager shall have authority and responsibility concerning
information security measures of the division, office, etc. under his/her jurisdiction.

(Information Security Committee)
Article 17 Based on Article 12-6 of the General Rules for Organization and Operation, an
information security committee led by the CISO in NINS as the chairperson shall beestablished to make decisions on important matters concerning Information Security
Countermeasures, etc. in NINS as a whole including information security, mattersconcerning crisis management, and matters concerning ethics.
2 Necessary matters concerning the organization and operation of the committee provided
in the preceding paragraph shall be provided for separately.
(Institute Information Security Committee)
Article 18 An information security committee led by the Institute CISO in institutes, etc.
as the chairperson shall be established to carry out Information Security
Countermeasures, etc. to be treated individually in NINS and make decisions onimportant matters concerning Information Security Countermeasures, etc. including
information security policies in institutes, etc.
2. Necessary matters concerning the organization and operation of the committee provided
in the preceding paragraph shall be provided for separately.
(Prohibition of concurrent service)
Article 19 The following roles may not concurrently be served by the same person inprinciple in the implementation of Information Security Countermeasures.
(i) Person who obtains approval or permission and person who provides the approval or
permission (excluding cases acknowledged by the Institute CISO)(ii) Person who receives the audit and person who conducts the audit
2 Notwithstanding the preceding paragraph, the CISO may hold a concurrent position as
Information Security Audit Manager.
Chapter 3 Protection of Information Assets(Classification, Rating, and Handling Restrictions of Information Assets)8008-25 2023/04/01
Article 20 The Information Security Manager shall classify information assets underjurisdiction into confidentiality, integrity, and availability, assign an appropriate rating,and implement handling restrictions based on the classification, rating, and handling
restrictions of information assets provided in Appended Table 1.
2 With respect to research information, when the Institute CISO finds the assigning ofclassification, rating, and handling restrictions of information assets provided inAppended Table 1 grossly unreasonable, the Institute CISO may provide for thisseparately.
3 Necessary matters concerning the application of the provisions of Paragraph 1 shall be
provided in the Countermeasures Standards.
Chapter 4 Information System Life Cycle(Information System Life Cycle)
Article 21 Necessary matters concerning the installation, operation, and disposal of
information systems owned or managed by NINS shall be provided in theCountermeasures Standards.
Chapter 5 Handling of Incidents(Handling of Incidents)
Article 22 Necessary matters concerning the handling of incidents shall be provided in theCountermeasures Standards.
Chapter 6 Monitoring, etc. of Networks(Monitoring, etc. of Networks)
Article 23 The person who manages, operates, or uses information assets provided in Item(i) or Item (iii), Paragraph 1, Article 4 or information equipment provided in Item (ii) of
the same paragraph must not intercept transmission conducted via networks. Provided
however, that the person appointed by the CISO or Institute CISO in advance andInformation System Manager who manages the network (limited to the scope of thejurisdiction)(hereinafter referred to as the “network supervisor”) may conduct themonitoring of transmission conducted via networks (hereinafter referred to as“monitoring”) for the purpose of ensuring security.

9008-25 2023/04/01
2 The network supervisor in the preceding paragraph must not communicate the contentsof the transmission or personal information known by monitoring to another person
except in cases specified by the Countermeasures Standards as necessary for theprevention of critical security infringement inside or outside NINS.
3 The scope and procedure of the monitoring, handling of the records collected bymonitoring and other necessary matters shall be provided by the Countermeasures
Standards.
(Record of Use)
Article 24 The collection and handling of the record of use of the information system shallbe provided by the Countermeasures Standards.
Chapter 7 Information Security Audit and Inspection(Audit)Article 25 The Information Security Audit Manager shall engage in the audit of the statusof implementation of the information security policy and implementation regulations
and status of the Information Security Countermeasures pertaining to information
assets periodically for each year or as needed.
2 Where entrusted to an outsourcing company, the Information Security Audit Manager
shall engage in the audit of the observance of the information security policy as needed
including the trustee company as a subcontractor from the outsourcing company.
3 The Information Security Audit Manager shall formulate the audit plan and obtainapproval of the President and CISO in engaging in the audit.
4 The Information Security Audit Manager shall compile the results of the audit andreport to the President and CISO in case of conducting the audit.
5 The Information Security Audit Manager shall appropriately retain the audit evidencecollected through the conduct of the audit and audit record for the preparation of theaudit report to prevent loss, etc.
(Self-inspection)
Article 26 The Institute CISO shall conduct self-inspection of the status of implementationof the information security policy and implementation regulations in the institute andreport to the CISO, more than once a year.
Chapter 8 Information Security Policy, etc. Review

10008-25 2023/04/01(Renewal of the Policy and Implementation Regulations)
Article 27 The CISO shall regularly review the information security policy andimplementation regulations taking into account the audit in Article 25, result of the selfinspection in the preceding article, and incidents in NINS.
Chapter 9 Miscellaneous Provisions(Other)
Article 28
In addition to what is provided for in these Rules, necessary matters concerning theinformation security of NINS shall be specified by the Countermeasures Standards.
Supplementary Provisions
1 These Rules shall come into force from September 23, 2016.
2 The National Institutes of Natural Sciences, an Inter-University Research InstituteCorporation, Basic Rules on Informatization of Business and Assurance of Information
Security (NINS Rules No. 67 of 2007) shall be abolished.
Supplementary Provision
These Rules shall come into force from December 22, 2016.
Supplementary Provision
These Rules shall come into force from March 1, 2018.
Supplementary Provision
These Rules shall come into force from April 1, 2018.
Supplementary Provision
These Rules shall come into force from November 1, 2018.
Supplementary Provision
These Rules shall come into force from December 1, 2019.
Supplementary Provision
These Rules shall come into force from December 4, 2020.
Supplementary Provision
These Rules shall come into force from November 24, 2022.
Supplementary Provision (Revised on February 16, 2023)
These Rules shall come into force from April 1, 2023.

11

008-25 2023/04/01
Appended Table 1 Classification, Rating, and Handling Restrictions of Information
Assets (related to Article 3 and Article 20)
Classification of information assets by confidentiality
Classification

Classification Standards

Handling Restrictions

Confidentiality

Information assets thathave serious and material
impact to the operations of
NINS where contents
including those in regard
tonational
security,
specific
personal
information,etc.
areleakedIn addition to the handling

4(Top Secret)

restrictions of confidentiality
3, unless permitted by theInstitute CISO, measures areset forth below.
・ Prohibition of reproduction
and distribution
・Prohibition of access toother than the designated
place

・

Confidentiality
3(Secret)The operation shall belimited to the scope ofstandalone or independent
networks.

Among information assets In addition to the handling
handledinassets (excluding

information
requiring

NINS, restrictions of confidentiality 2
exceptional

confidentiality measures), measures except inequivalent tosuch cases as permitted by theConfidential Documents

Institute CISO are set forth
below.
・General prohibition of workin other information systemterminals which are assets
of NINS・Prohibition of reproduction
and distribution that are
more than necessary12008-25 2023/04/01

Classification

Classification Standards

Handling Restrictions
・Retention of a place where
electronicormagnetic

storage media can be locked
Confidentiality
2

Among information assets ・Restriction on place ofhandled in the operations

storage and prohibition of(NINS

of NINS, confidentiality

bringing

electronic

Confidential)

equivalent to Confidential

magnetic

storage

Documents

is

etc.

is

required,

however,

information
have

a

not

assetsthatormedia,

more

thannecessary into the place ofthatstoragepossibilityof ・ Encryption and password
breaching the rights ofsetting during transmission
individuals or interferingofwith the performance of(including

personal

information

when

persontheinquestion has given consent
tohandleitclassification category)intransport

and provision of information

operations of NINS upon
disclosure

information,assets and storage in alocked case
Disposal subjected to・treatment

beyondrestoration
・Choice of a secure network
line
・ Provisions of measures toensuresecurity

management
conducting

wheninformation

processing externally【Exceptional measures】
Exceptional measures of theCountermeasures

Standards

shall apply notwithstanding13008-25 2023/04/01

Classification

Classification Standards

Handling Restrictions
the foregoing in cases where itis provided for in exceptional
measuresby

theCountermeasures
Standards.
Confidentiality

Published1

information(Disclosure)

information,
that

is

allowed to be published,
and other information andinformation assets otherthan information assets ofmore thanconfidentiality 2

Classification of information assets by integrity
Classification

Classification Standards

Integrity 3

Information assets which In addition to the handlingare difficult to recover due to restrictions of integrity 2,
damage and alteration and measures are set forth below.
information assets which ・Multiple backups ofwould have serious anddifferent storage areas
material impact to the ・ Detection of tampering by
operations of NINS
digital sign, storage of hash,time stamp authentication,etc. or implementation of
prevention measures

Integrity 2

Among information assets ・ Backups and granting ofhandledby
NINS,
electronic signature
information assets that are ・ Detection of tampering by
likely to infringe the rights
digital sign, storage of hash,of individuals or obstructtime stamp authentication,
the appropriate execution of
etc. or implementation ofoperations
of
NINS
prevention measures1(excluding minor ones) andinformation assets that do

14

Handling Restrictions

008-25 2023/04/01

Classification

Integrity 1

Classification Standards

Handling Restrictions

not fall under integrity 3
due to alteration, error, anddamageExcluding cases where it isrecognized by the Institute
CISO
・ Provisions of measures toensure security management
when conducting information
processing externally・ Retention of a place where
electronicormagnetic
storage media can be locked

Information assets otherthan information assets ofmore than confidentiality
2

1 Require no tamper prevention measures on media in the case where tamper-proof
media (WORM media, etc.) are used
Classification of information assets by availability
Classification

Classification Standards

Handling Restrictions

Availability 3

Information assets which In addition to the handlingwould have serious and restrictions of availability 2,
material impact to the measures are set forth below.
operations of NINS unless ・Clustering configuration
used regularly
based on fail-over andfailsafe

Availability 2

Among information assets ・Backups and recovery
handledby
NINS,
within the designated time
information assets that are ・ Retention of a place where
likely to infringe the rights
electronicormagneticof individuals or obstruct thestorage media can be locked
appropriate execution ofwork of NINS (excluding
minor ones) and informationthat does not fall underconfidentiality 3 due toextinguishment, loss, or it is
impossible to use the15008-25 2023/04/01

Classification

Classification Standards
information assets between
one hour and 24 hours

Availability 1

Information assets otherthan information assets ofmore than availability 2

16

Handling Restrictions

008-25 2023/04/01
Appended Table 2 (related to Article 6)
Category including
Institutes

Institutes, etc.

Institute CISO

National
A person designated by the
Astronomical
National
Astronomical Director General of the National
Observatory of Japan Observatory of Japan
Astronomical
Observatory of Japan
National Institute for National
Institute
Fusion Science
Fusion Sciencefor Director General of the National
Institute for Fusion Science

National Institute for Basic
Biology
National
Institute
Physiological Sciences

Three
Institutesfor

Deputy Director General, ViceDirector General,
OkazakiExecutive Director, or Chief
designated
Joint
Use
Research Chairperson
Facilities, Organizations, together by the three (3)etc. for the Three Okazaki Director Generals
Institute
ScienceforMolecular

Institutes

Exploratory
ResearchCenter on Life and Living
Systems

Administrative
Bureau, etc.

Among the Administrative
Bureau and organizations,etc.
providedforinParagraph 1, Article 2-2
and Article 3 of the General Concurrent service by the CISO
Rules for Organization andOperation, organizations,etc. that do not fall under
the foregoing

Note: In regard to the Co-Creation Strategy Headquarters in Item (i), Article 2-2,
Astrobiology Center specified in Item (ii) of the same article of the General Rules
for Organization and Operation, the Institute CISO of the institutes, etc. shall havejurisdiction.

17