Regulations No. 9 of 2015
Established on July 3, 2015
Amended on September 17, 2015
Amended on October 13, 2015
Amended on October 29, 2015
Regulations on Implementation of Information Security Measures at External Asset Manager, Etc.

Article 1(Purpose)

The purpose of these Regulations is to set forth necessary matters in connection with information security measures
for a person who handles confidential information of the Government Pension Investment Fund (hereinafter,“GPIF”) and a person who may learn nonpublic information concerning the management and/or investment business ofGPIF and to seek to prevent information leaks from these persons.

Article 2(Definitions)

In these Regulations, an External Asset Manager, etc. means a person listed in each Item below:(1)

External Asset Manager(2)

Asset management institution (including custodian)(3)

A person to whom research study is entrusted and a counterparty to joint research project(4)

Counterparty to sale and/or purchase of bonds related to in-house investment and counterparty totransactions related to investment in short-term asset(5)

A person to whom the business related to information systems is entrusted(6)

In addition to the persons listed in the preceding items, a person who handles confidential information ofGPIF and a person who may learn nonpublic information concerning the investment behavior of GPIF
(excluding the persons who are under a legal obligation of confidentiality which if violated can result in
the imposition of criminal punishment)

Article 31(Notice to Candidate Such as Person to Be Selected as External Asset Manager, Etc.)

GPIF shall notify a candidate such as a person to be selected as an External Asset Manager, etc. (hereinafter,the “Candidate”) of the content of information security measures required for the External Asset Manager, etc.
in advance.

2GPIF shall notify the Candidate of External Asset Manager, etc. of the method of handling in the case whereinformation security is infringed at the Investment Manager, etc.

3If GPIF deems an information security audit necessary to confirm the status of implementation ofinformation security measures at the External Asset Manager, etc., GPIF shall notify the Candidate of theExternal Asset Manager, etc. of the content and method thereof, etc. in advance.
1Article 41(Selection of Investment Manager, Etc.)

When selecting an External Asset Manager, etc., GPIF shall select a person who is found to be capable of
implementing information security measures equal to or above the standard of GPIF.

2GPIF may require a Candidate of External Asset Manager, etc. to conduct a self-evaluation based on theinformation security measures benchmark and consider the results thereof as a factor for its evaluation; provided,
however, that if a Candidate of External Asset Manager, etc. obtains Information Security Management System(hereinafter, “ISMS”) certification based on ISMS Conformity Assessment Scheme or equivalent certification,this may be used in lieu thereof.

Article 5(Re-entrustment)

When the External Asset Manager, etc. re-entrusts all or part of its entrusted services to any other business operator,
GPIF shall require the External Asset Manager, etc. to have such other business operator take measures to ensure
information security at the same standard as that required by GPIF in accordance with a contract.

Article 61(Confidentiality Agreement)

GPIF shall execute an agreement concerning confidentiality (hereinafter, the “Confidentiality Agreement”)
with the External Asset Manager, etc.

2The matters set forth under the following items shall be included in the Confidentiality Agreement:(1)

Matters related to establishment of a framework to ensure information security(2)

Matters related to prohibition of leakage of information learned by the External Asset Manager, etc. or its
personnel in the course of performance of its entrusted service(3)

Matters related to restriction on copying, etc. of information learned in the course of performance of its
entrusted service(4)

Matters related to prohibition of usage of information learned in the course of performance of its entrustedservice for the purposes other than the purpose of providing service to GPIF

(5)

Matters related to measures to be taken in the events of any security incident such as leakage,(6)

Matters related to measures to ensure information security at a person to whom re-entrustment is made(7)

Matters related to a written report stating the matters set forth in (i) to (iv) below with respect to the External
Asset Manager, etc.
(i)

Framework system to implement information security measures, etc.

(ii)

Contents of specific activities relating to the implementation of information security measuresrequired under the Confidentiality Agreement(iii)

Organizational structure and person responsible for the performance of its entrusted service toGPIF (limited to the cases where GPIF deems it necessary)(iv)

Matters related to inspection or audit with respect to the framework for and status of management2

of information security(8)

Matters related to a report in the case where the content of a written report under the preceding Item ischanged(9)Matters related to the reporting provided for in paragraph 2 of the following Article or Article 8(10)

In addition to those set forth in the preceding items, matters necessary for the protection of information
concerning GPIF

Article 71(Confirmation of Situation of Performance of Information Security Measures)

GPIF shall establish a method to confirm whether information security measures are properly performed at
the External Asset Manager, etc.

2

GPIF shall have the External Asset Manager, etc. report the status of implementation of information security
measures related to information concerning GPIF regularly or as necessary.

3If GPIF deems that there is a material problem with the framework or status of management concerning
information security by the External Asset Manager, etc., it shall take necessary measures such as termination ofan agreement with such External Asset Manager, etc.

Article 8(Self-evaluation of Information Security Measures by External Asset Manager, Etc.)

GPIF shall require the External Asset Manager, etc. to conduct a self-evaluation based on the ISM benchmark andhave it report the results thereof at least annually; provided, however, that if the External Asset Manager, etc.
obtains ISMS certification based on ISMS Conformity Assessment Scheme or equivalent certification, this may
be used in lieu thereof.

Article 9(Evaluation and Report at GPIF)

GPIF shall evaluate the information security measures of the External Asset Manager, etc. annually based on thereports or the results provided for in Article 7 and the preceding Article, and report to the Information Security
Committee and Internal Control Committee.

Article 10(Announcement of Result)

When the External Asset Manager, etc. seeks to announce the content and results concerning GPIF, GPIF shall havethe External Asset Manager, etc. to obtain a prior written consent by GPIF.

Article 111(Exclusion from Application)

The Chief Information Security Officer may not apply part of these Regulations if it deems that a special
3circumstance exists.
2GPIF may separately prescribe matters it deems necessary concerning the performance of entrusted service
other than those provided for in these Regulations upon agreement with the External Asset Manager, etc.

Supplementary Provisions
These Regulations shall come into effect as from July 3, 2015; provided, however, that the provisions under
Article 3; Article 5; Article 6; Article 7, Paragraph 1; and Article 9 shall come into effect as from January 1, 2016.
Supplementary Provisions (Amendment on September 17, 2015)These Amendments shall come into effect as from September 17, 2015.
Supplementary Provisions (Amendment on October 13, 2015)
These Amendments shall come into effective from October 13, 2015.
Supplementary Provisions (Amendment on October 29, 2015)
These Amendments shall come into effect as from October 29, 2015.

4