Report of the Council of Experts on Outsourcing
in Financial Institutions

June 2016
The Center for Financial Industry Information Systems

Table of contents
Introduction ................................................................................................................................. 1
I.

Trends in outsourcing in recent years and changes in environmental conditions of
outsourcing ........................................................................................................................ 2
1.

Trends in outsourcing in recent years ............................................................................... 2

2.

Changes in environmental conditions of outsourcing ...................................................... 3(1) Cases of misconduct in recent years at outsourcees etc. ............................................. 3(2) Advancement of joint use ............................................................................................ 4(3) Necessity of human-resources development ............................................................... 5(4) Various issues related to subcontractor management (amendments to the Banking Act
etc. ) ............................................................................................................................. 6

3.

FISC initiatives through now in response to these environmental changes and thisCouncil’s recognition of issues......................................................................................... 7(1) Cases of misconduct by outsourcees and others in recent years ................................. 7(2) Advancement of joint use ............................................................................................ 7(3) Necessity of human-resources development ............................................................... 7(4) Various issues related to subcontractor management (amendments to the Banking Actetc.) .............................................................................................................................. 8

4.

Necessity of studying IT governance ............................................................................... 8

5.

Overview of outsourcing ................................................................................................ 10

II.

IT governance and IT management .............................................................................. 12
1.

IT governance necessary for security measures ............................................................. 13(1) Significance of IT governance necessary for security measures ............................... 13(2) Roles and responsibilities of top management in IT governance necessary forsecurity measures ...................................................................................................... 142.

IT management necessary for security measures ........................................................... 17(1) Roles and responsibilities of management ................................................................ 18(2) Roles and responsibilities of those responsible for management planning ............... 19(3) Roles and responsibilities of users ............................................................................ 19

3.

Notes on staffing plans ................................................................................................... 20

4.

Decision-making by top management concerning important IT-related matters .............. 21

III.

Risk-based approach....................................................................................................... 24

1.

The necessity of a new form for security measures........................................................ 25(1) The necessity of reviewing the concepts of security measure standards................... 25(2) Traditional thinking on security measures and related issues ................................... 26(3) Risk-based approach ................................................................................................. 27

2.

Basic principles of security measures............................................................................. 28i

3.

IT governance in accordance with the basic principles .................................................. 29(1) Significance ............................................................................................................... 29(2) Rules for information systems involving serious externalities and related subjects . 30
(3) Necessity of a simplified method .............................................................................. 30

4.

IT governance through a simplified risk-based approach............................................... 30(1) Significance ............................................................................................................... 30(2) Significance of “critical information systems”.......................................................... 31(3) Security measures and allocation of management resources for critical information
systems ...................................................................................................................... 31(4) Security measures and allocation of management resources for other information
systems ...................................................................................................................... 31(5) Significance of minimum necessary security guidelines........................................... 32

5.
IV.

Management responsibility for security measures ......................................................... 34
Risk Management in Outsourcing ................................................................................. 35

1.

Various issues related to subcontracting ......................................................................... 36

2.

Thinking on responses to various issues ........................................................................ 36

3.

Risk management in outsourcing ................................................................................... 39(1) Management processes in outsourcing ...................................................................... 39(2) Thinking on risk-management measures in each management phase ....................... 42

4.

Risk management measures for subcontracting ............................................................. 45(1) Formulating requirements for selection of subcontractors and implementing advancescreening.................................................................................................................... 45(2) Clear description of the right to audit subcontractors ............................................... 45(3) Responding to incidents ............................................................................................ 46

V.

Risk management at shared system centers ................................................................. 48
1.

The significance of shared system centers and their distinguishing features ................. 49(1) The significance of shared system centers ................................................................ 49(2) Profiles of shared system centers .............................................................................. 49

2.

Challenges involved in shared system centers ............................................................... 50

3.

Distinguishing features of shared system centers ........................................................... 52

4.

Ways of thinking on risk management measures specific to shared system centers ...... 52

5.

IT governance specific to shared system centers (forms of formulating risk management
measures) ........................................................................................................................ 54

VI.

Thinking on future revisions to Security Guidelines etc.............................................. 56

List of Members and Observers of the Council of Experts on Outsourcing in Financial
Institutions ....................................................................................................................... 57
VII. References ........................................................................................................................ 61ii

Reference 1: Sample IT skills map ........................................................................................ 62
Reference 2: Breakdown of system-related expenses by purpose ......................................... 63
Reference 3: Trends among overseas regulators and others regarding the risk-based approach........................................................................................................................................ 64
Reference 4: Thinking on externalities and sensitivity of information .................................. 67
Reference 5: FFIEC IT Examination Handbook: Management: Third-Party Management .. 69
Reference 6: History of shared system centers ...................................................................... 71
Reference 7: Timeline of use of shared system centers ......................................................... 72
Reference 8: Deposits of Financial Institutions using shared system centers ........................ 73
Reference 9: Issues addressed by this Council and related measures .................................... 75iii

Introduction
In recent years, reliance on outsourcing of operations related to information systems has been ata very high level among Financial Institutions in Japan, and the forms of such operations havebeen growing more diverse, as seen in the example of the advancement of sharing of
information systems through shared system centers.
At the same time, the Banking Act and other relevant laws and regulations have been amended
to add subcontractors handling the operations of banks and other Financial Institutions to thesubjects of demands for reports and on-site inspections by regulators, and there is a need toreview the forms of subcontractor management. In addition, increasing numbers of Financial
Institutions face the challenges of training and securing human resources with skills in
information technology (IT) in connection with developments such as the advancement of joint
use of information systems.
As described above, the conditions surrounding outsourcing of information systems haveundergone massive changes in recent years. Since each of these issues is very deep rooted andfew can be resolved by information systems sections alone, the first necessary step is that ofthinking of companywide initiatives that include top management – that is, IT governance.
Two years ago, the Center for Financial Industry Information Systems (“FISC” hereinafter) helda meeting of the Council of Experts on the Usage of Cloud Computing by Financial Institutions
to ascertain accurate information on the distinguishing features and risks of use of Cloudtechnology by Financial Institutions and discuss the form to take for security measures tomaximize the potential of such state-of-the-art technologies while minimizing their risks. After
publishing a report on the results of the Council, that report served as the basis of revisions to
the Security Guidelines on Computer Systems for Banking and Related Financial Institutions(“Security Guidelines” hereinafter) to enhance risk-management measures for the Cloud, as aform of outsourcing.
The Council of Experts on Outsourcing in Financial Institutions was established inconsideration of the need to address the above issues and review management measures withregard to more general outsourcing such as that of banks’ and companies’ own systems and useof shared system centers, in a form consistent with the concepts of the Cloud as a specific formof outsourcing.
Participants in this the Council included academic experts, Financial Institutions, IT solution
providers, and others as committee members, along with observers from regulators and others.
The meeting discussed the need to identify clear and practical guidelines regarding policies tocontribute to increasing the efficacy of external outsourcee management through thoroughgoingstudy of the form of external outsourcee management at Financial Institutions in Japan fromperspectives including those of IT governance and a risk-based approach. These deliberations
are summarized in this report.

1

I.

Trends in outsourcing in recent years and changes inenvironmental conditions of outsourcing

1.

Trends in outsourcing in recent years

Recent years have seen marked progress in outsourcing of operations related to computer
systems by Financial Institutions.
• A share of 91.5% of all Financial Institutions use outsourcing in core banking systems (as ofMarch 2015).

(Fig. 1) Trends in outsourcing (from FISC survey)
（％）
100

90
80
70
60
50
40
30

91.5% of all Financial Institutions use outsourcing(March 2015)

20
10
0
17

18

19

20

21

22

23

24

25

Total

City bank/trust bank

Regional bank

Second-tier regional bank

Shinkin bank

Credit union

2

26

FY
(surveyed
平成（年度）※ atend of each FY)

(Fig. 2) Methods of outsourcing of backbone systems by deposit-taking Financial Institutions(As of March 31, 2015; from a FISC survey)

2.

Changes in environmental conditions of outsourcing

The environment for outsourcing has experienced massive changes recently.
(1) Cases of misconduct in recent years at outsourcees etc.
Risk management for outsourcing has been reviewed and FISC Security Guidelines have beenrevised in response to cases of misconduct by skilled management at Financial Institutions’subcontractors and sub-subcontractors. In addition, management measures and expertise arebeing accumulated in individual fields of outsourcing as well.
(Fig. 3) Main cases in recent years and related trends
Announced November
2012
Announced February
2014
March 2014

Counterfeiting of ATM cards by an employee of a shared systemcenter outsourcee
Counterfeiting of ATM cards by an employee of a regional
bank’s sub-subcontractor
Financial Services Agency demands self-inspection by Financial
Institutions3(2) Advancement of joint use
Joint use of systems is increasing across various types of business and subject operations,
intended to enjoy better cost benefits than individual outsourcing and to enable use of expertiseof early adopters, among other considerations.
(Fig. 4) Advancement of joint use of accounting systems (regional banks, second-tier regionalbanks)(From the July 2014 Financial Services Agency Financial Monitoring Report)

User banks
Centers
Annual migration(Year)
Planned(Fig. 5) Shared system centers are used for numerous systems(Deposit-taking Financial Institutions) (from 2015 FISC survey)
0%

20%

40%

60%

80%

100%

1.5

Core banking system
3.3

International system
4.1

Funds/securities system

0.9

Telephone banking

1.8Internet/mobile banking
13.4

Data warehouse
Calculation system

5.4

Risk-management system

5.8
9.5

Sales support system

7.8

Financial support system
5.0

Centralized center system
Branch-office system

3.1

ATM system

1.9

Electronically recordedmonetary claims system

0.9

In useMigration underway

4

Under consideration

No plans to use(Fig. 6) Use of the Cloud also is in an increasing trend(Deposit-taking Financial Institutions, insurance, securities, credit, etc.) (from FISC
survey)The trend in Cloud usage
40.0%
33.8%
31.8%
35.0%
30.0%
20.9%
25.0%
20.0%
15.0%
10.0%
5.0%
Population:(749 subjects) (740 subjects) (743 subjects)
0.0%
FY2010FY2011FY2012

39.0%

37.1%

(698 subjects)(686 subjects)

FY2013

FY2014(Fig. 7) Use of the Cloud is advancing in the insurance industry(From the 2015 Financial Services Agency Monitoring Report)
Life insurers (42 companies)
Non-life insurers (33 companies)

Percentage of use
83%
76%

Among big four
75%
100%

(3) Necessity of human-resources development
Advancing shared use of computer systems has led to the issue of decreased IT skills withincompanies as their IT human resources decrease.
In addition, the Policy Approaches to Strengthen Cyber Security in the Financial Sector releasedby the Financial Services Agency in July of last year identifies the issues of securing andtraining skilled personnel, calling for raising awareness and training on the knowledge neededby cyber human resources not only among engineers but also among top management
responsible for decision-making and organizational direction and staff in the administrative
sections that support them.

5(Fig. 8) Trends in numbers of staff in IT sections; rate as of end of FY2013 vs. level of 100 at
end of FY1993 (2014 FISC survey)
100

100

100

100

100

90
74.7

80
70

61.3

60
44.7

50

38.1

40

1993
2013

30
20
10
0
Regional
banks

Second-tierregional banks

Shinkin banks

Credit unions(Fig. 9) Changes in bank staff skills accompanying adoption of shared systems(2009 Bank of Japan report Results of Survey of 108 Regional Banks)
Decreases in skills among those participating in shared system use (left) arepronounced compared to leading banks (right).
Leading banks
The use of shared system(included at left)(Unit: %)(Unit: %)Outsourcee management
skills*System project
management skills
System quality control
skillsRequirement definition
skillsSystem resource/performance
management skills
System design skills
Increased

Unchanged

Decreased<Number of Financial Institutions
included in totals: 55 (* 54)>

Increased

Unchanged

Decreased<Number of Financial Institutions
included in totals: 6 (* 5)>(4) Various issues related to subcontractor management (amendments to the Banking Act
etc. 1)
While individual Financial Institutions face the need to demand management responsibility andaccountability from subcontractors and those further upstream in the supply chain, in some1

Subcontractors in banking and other businesses (including those covering two or more levels) have been added to those fromwhom reports may be demanded and the subjects of on-site inspections (effective December 1, 2014).

6

cases the extent to which these should be demanded is not clear, leading to an increasing senseof burden.

3.

FISC initiatives through now in response to these environmental changes
and this Council’s recognition of issues(1) Cases of misconduct by outsourcees and others in recent years
 FISC initiatives
Following deliberation by the FISC Security Measures Export Committee/Study Meeting
last year, in June of last year the Security Guidelines were revised and appropriate measures
were implemented as interim responses for the time being with regard to areas such as
strengthening control of entry to and exit from computer rooms, making access authorization
for computer systems stricter, and identifying and preventing unauthorized use.
 Recognition of issues• With regard to basic response measures including the risk-management approach, there isa need for separate discussions from perspectives including those of IT governance.
• The following issues have been pointed out in response to cases of misconduct involving
shared-use systems.
• The need for Financial Institutions using shared system center to develop a postureof demonstrating governance jointly• The need for joint auditing
There is a need to consider matters including these in discussion of outsourcing itself, while
maintain consistency with Cloud risk-management measures.
(2) Advancement of joint use
 FISC initiatives
With regard to the Cloud, as one form of outsourcing, risk-management measures for the
Cloud (i.e., clarification of IT solution provider selection procedures and ascertaining
locations of data when considering use; agreement on SLA and measures to prevent vendor
lock-in when concluding agreements; measures to prevent leakage of data during use ofservices; formulation of structures including those for independent auditing and monitoring;and simplified risk-management measures corresponding to the importance of operations)were enhanced through revisions to the Security Guidelines following the Council of Expertson the Usage of Cloud Computing by Financial Institutions.
 Recognition of issues
There is a need for review of the ideal form of more general management measures foroutsourcing based on the opinions from the above the Council of Experts on the Cloud.
(3) Necessity of human-resources development
 FISC initiatives
The FISC Research Division and the Financial Services Agency are carrying out joint
research on IT human-resources development, through steps that include identifying
practical training plans and implementation methods and making clear the importance ofincorporating IT human-resources development into medium- and long-term plans.
 Recognition of issues
There is a need to make clear the IT skills and scale of the workforce needed by individual7

Financial Institutions in order to achieve their management objectives and businessobjectives and to think about how to formulate HR plans to secure these resources on acontinual basis and how to realize these plans through the engagement of top management.
(4) Various issues related to subcontractor management (amendments to the Banking Act
etc.)
 Recognition of issues
The ideal form of subcontractor management needs to be reviewed in connection withexpanded inspection authority resulting from amendments to the Banking Act and other laws
and regulations.

4.

Necessity of studying IT governance

Each of the above matters is related to Financial Institutions as a whole, and the perspectives ofIT governance – that is, appropriate involvement by top management based on assessment ofeach individual risk, are essential in order to address these properly.
(Fig. 10) Recognition of the issues faced by Financial Institutions in external outsourcee
management
These include issues for which the engagement of top management is essential,
including subcontractor management and securing human resources.
(Deposit-taking Financial Institutions, insurance, securities, credit, etc.) (From a 2015
FISC survey)
0%

40%

20%

60%

Management of subcontractors etc.

47.9

Securing human resources able to understand and manage outsourcee
operations

41.1

Outsourcee management

37.7

Improving efficiency of management operations

33.4

Measures to prevent improprieties by outsourcees etc.

31.0

Structure development/maintenance, skills of operations sections, riskmanagement sections, auditing sections

29.8

Responding to cyber attacks at outsourcees etc.

20.5

Negotiations with outsourcees (contracts, on-site audits, information
provision, damages, etc.)

20.2

Handling of contracts on use of ASP and other services, effective
management of their use

16.4

Joint center operations (coordinating requirements with vendors andjoint users)

14.4

Management of overseas facilities

2.7

Other

2.7

8

As of March 2015
Valid responses: 584

For purposes of these studies, the following definitions of IT governance are referred to.
The Financial Services Agency’s definition (from the July 2015 Financial Services Agency
Monitoring Report)
Management’s approach to ensure timely and appropriate investment in computer systems in
key areas for purposes of management strategy, efficient and stable operation of systems
adopted, and proper control of these and addressing them as an organization
The IT Governance Institute’s definition (also used in the Federal Financial Institutions
Examination Council [FFIEC] guidelines)
IT governance is an integral part of governance and consists of the leadership andorganizational structures and processes that ensure that the organization’s IT sustains andextends the organization’s strategies and objectives.

In addition, various domestic and international guidelines primarily consider outsourcing ofcomputer systems to be a domain of IT management, stressing IT management together with IT
governance.
Perspectives such as these also are referred to in these studies.2

2

In addition, the governance processes (assessment, instruction, and monitoring) defined in ISO38500 (IT Governance) andelsewhere also were referred to. Among ISO standards, ISO27014 (Information Security Governance) was referred to as well.

9

5.

Overview of outsourcing

The table below summarizes the concept of outsourcing assuming subcontracting by Financial
Institutions to IT solution providers or their use of IT solution providers’ services.
(Fig. 11) Scope of outsourcing related to computer systems
Subject

Type A: Subcontracting(development, operation),or use of services, by
individual Financial
Institutions fromIT
solution providers

Type B: Subcontracting (development, operation), or use of services, bymultiple Financial Institutions from IT solution providers(Including cases in which upper or cooperative organizations serve as
liaisons with outsourcees)

Relatedparties

Financial Institution : IT
solution provider = 1:1

Financial Institution : IT solution provider= n:1

ModelsFinancial
Institutiona)b)Financial
Institution

Financial
InstitutionrIT solution provider
IT

Specific
examples• Development andoperation of in-housesystems (including
outsourcing)(Including customizationof packages)• Hardware/software
maintenance

Shared system center

Financial
Institution

Financial
Institution

Shared system center(upper/cooperative organization)
IT solutionida) Cases in which Financial Institutions contract with IT solution
providers• Accounting shared system centers (Regional banks, Second-tier regionalbanks, Shinkin banks, Credit unions, etc.)• Internet-banking shared system centers (ANSER etc.)• Joint CMS 3• The Cloud• Data storage servicesb) Cases of contracting with IT solution providers through upper orcooperative organizations• SBK 4
• R-one system 5• JASTEM 6

Notes:
1. Handling of mutual systems and network services among Financial Institutions
Cases of use of mutual systems and network services among Financial Institutions (such as
the Zengin system, integrated ATM networks, and cooperative domestic-exchange relay
systems for Financial Institutions 7) are specified under the supervision guidelines of the
Financial Services Agency as being subject to risk management similar to that used foroutsourcing, and these can be considered separately from outsourcing.
⇒ Types A and B above can be said to differ for the following reason: While when
3
4

5
6
7

A center established jointly by leading Financial Institutions including city banks to provide multibank firm-banking services
A business association (shared system center) under which six second-tier regional banks in the Kyushu region jointly manage asystems center
Used by 13 Labour banks and the Rokinren Bank, established by the Rokinren Bank
A system used by agricultural cooperatives and their banks across Japan, operated by the Norinchukin BankThe ZenShinkin System (for Shinkin banks), the funds transfer system for credit unions, and the funds transfer relay system for
agricultural cooperatives

10

connecting to other parties measures are demanded such as checking whether the system
employs appropriate handling and reciprocal testing at times such as when starting or
updating connections, demands do not extend to the level of ascertaining the state ofoperations at the other parties (FISC Security Guidelines Operations 90-1).
These networks function as backbone infrastructure, and in many cases it would be
difficult and inefficient for individual Financial Institutions to select service providers andmanage them individually to the exact same degree as in management of outsourcing.
Other major systems that can be considered to fit into this category include the following:
SWIFT, LINC, 8 Sompo Net, 9 CAFIS
2. Handling of systems other than the above
Systems such as BOJ-NET, Densai.net, the Japan Securities Depository Center system, andstock exchange systems, which do not fit into the above categories, can be considered to beforms of systems that differ from types A and B and those described under Note 1 above, assystems managed as the business operations of the individual independent organizations
operating them.

89Life Insurance Network Center operated by the Life Insurance Association of Japan
Operated by the General Insurance Association of Japan11

II. IT governance and IT management
Summary◆ Top management must perform the following roles and responsibilities in IT governancenecessary for security measures:(1) Deciding on priorities related to security measures in medium- to long-term plans etc.
1) Deciding on policies related to security measures
a. System strategic policies
b. System risk-management policies
c. Goals of security measuresd. Management resources to be invested in security measures2) Deciding on business-execution and monitoring structures related to security
measures(2) Deciding on matters for improvement in approaches etc. to security measures◆ Management and other related parties must perform the following roles and responsibilities
in IT management necessary for security measures:(1) Management
1) Development and maintenance of internal rules, organizational structures, etc.
2) Deciding on security measures for individual information systems
3) Review of internal rules, organizational structures, etc.
4) Reporting to top management on information needed for security measures(2) Management planning
Supporting decision-making by top management as necessary, through means including
assessing priorities related to investment of management resources(3) Users
Planning business models with consideration for security measures, achieving results ofinvestment, identifying business requirements◆ Top management needs to note the following points in formulating personnel plans:(1) They must ascertain the state of IT human resources in specific terms including not only
the numbers of personnel needed but also their quality.
(2) They must formulate medium- to long-term human-resources development plansreflecting the current conditions of IT human resources.
◆ Depending on the content of priority matters, the extent of top management making thesedecisions may be interpreted broadly to include not only the board of directors but also
directors, executives, and others who have been delegated authority.

12

1.

IT governance necessary for security measures

Roles and responsibilities of top management in information-system security measures(1) Significance of IT governance necessary for security measures
Since the activities of Financial Institutions and other organizations are highly dependent on
information systems, securing the security and stability of information systems is an important
topic of management to such organizations. For this reason, IT governance needs to function
properly so that top management 10 can respond to such matters appropriately.
In general, IT governance refers to a system supporting decision-making by top managementwith regard to important IT-related matters within the corporate governance11 system. Since
they are related to the fundamentals of activities by Financial Institutions and otherorganizations, information-security measures and other security measures are matters thatshould be handled with a particularly high priority among the range of important matters related
to information systems. (See Fig. 12.)
Accordingly, all members of top management of Financial Institutions and other organizations,
not just the directors responsible for computer systems, bear identical levels of responsibility forensuring the functioning of IT governance necessary for security measures.
(Fig. 12) Hierarchy of IT governanceCorporate governance

Responsibilities of top
management

IT governance
Deciding on
management
plans

Approvingbudgets

Deciding onimportant IT-related
matters

Deciding on policies(IT promotion plans,
HR plans, etc.)

Goals of security measures Management resources Deciding on structures

Deciding on important matters necessary forsecurity measures
IT governance necessary for security measures

10

11

Directors (including directors responsible for systems) and officers who are members of the boards of directors and similar
bodies (including boards of executive officers, management conferences, risk-management committees, and other organizations
making management decisions) at Financial Institutions and other organizations. For cooperative Financial Institutions, theprovisions and terminology of the applicable laws or regulations apply in accordance with the type of financial institution. The
FISC Security Guidelines define top management as the board of directors (executive board) etc.
The Draft Code of Corporate Governance (March 5, 2015) by the expert meeting on formulation of the Code of Corporate
Governance in the Financial Services Agency defines this as “the structure by which a company makes decisions that aretransparent, fair, speedy, and decisive reflecting the standpoints of shareholders as well as customers, employees, local
communities, and others.”13(2) Roles and responsibilities of top management in IT governance necessary for security
measures
Top management of Financial Institutions and other organizations, who are responsible tocustomers, shareholders, and other stakeholders in light of such organizations’ missions insociety, need to understand fully the importance of security measures for information systems
and make decisions on key related matters, to ensure the security and stability of information
systems. (See Fig. 13.)
For this reason, top management needs to fulfill mainly the following roles and responsibilities
in IT governance necessary for security measures.
(Fig. 13) Important matters related to security measures to be decided by top management

Decisions on policies related tosecurity measures

Deciding on goals
Mutualcoordination

Deciding on
management
resources

1)

12

Deciding on
business-execution/
monitoring
structures

Deciding on matters for improvement inapproaches to security measures etc.

Medium-/long-term plans for information systems etc.

Making decisions on priority matters related to security measures in medium- andlong-term plans etc.
Top management needs to make the following decisions on priority matters related tosecurity measures in medium- and long-term plans and similar plans concerning
information systems, as priority topics.
a. Deciding on policies related to security measures
The board of directors needs to make decisions on the following policies as one
category of IT-related priority matters, including security measures.
i. Decisions on strategic policies for computer systems
Decisions need to be made on the following matters regarding strategic policies
for information systems, based on the perspective of security measures 12
include:･ IT promotion plans･ Plans for investment in computer systems
Examples include clearly indicating the goals of security measures and costs necessary to achieve those goals in policies on
outsourcing (e.g., use of the Cloud, standard outsourcing, etc.), basic update plans, etc., or clearly indicating in personnel plans
numbers of personnel needed in organizations involved in system risk management and countering cyber-attacks.

14

･ HR plans intended to secure IT human resources
ii.

b.

13

Decisions on system risk-management policies
Decisions need to be made on the following matters regarding systemrisk-management policies, based on the perspective of security measures
include:･ Development and maintenance of internal rules related to security measures,
including security policies･ Development and maintenance of the information-security management
posture (including the posture for responding to cyber-attacks)iii. Decisions on goals to be achieved by security measures
Top management shall make decisions on the goals of security measures to beachieved by Financial Institutions and other organizations. In deciding on goals toachieve, top management, in recognition of the fact that matters such as the extent
of the impact of a deficiency or other problem could be quite large depending on
the information system, shall set high goals to be achieved for information
systems on which a deficiency could have severe impacts on customers,
shareholders, or others while also setting suitable goals to be achieved for
information systems whose impacts would be limited to within specificdepartments of the institution. In this way, they need to consider setting goals
suited to the nature of risks. Even in these cases, it also is necessary to ensure thatno major security vulnerabilities remain.
iv. Decisions on management resources invested in security measures
At the same time it decides on goals to be achieved by security measures, top
management shall make decisions on investment of the management resources(costs, allocation policies, etc.) necessary to achieve those goals. Recognizing thefact that management resources have limits, it is important that top management
consider in advance goals reflecting the management resources that theorganization possesses and make decisions on allocation of resources inaccordance with the nature of risks.
In addition, in deciding on investment of resources it is necessary to pay attention
to the sources of raising resources based on matters such as changes in theenvironmental conditions related to information security and other security
measures. In particular, it must be noted that in outsourcing, one means of
securing resources from outside the organization, in some cases it might be moredifficult to apply internal controls due to the narrower scope and depth of
information that can be ascertained directly compared to a case of securingresources internally. 13
Decisions on business-execution and monitoring structures related to security
measures
As necessary, top management must make decisions on policies for development andmaintenance of business-execution structures for systems sections and other sections
and monitoring structures including system audits, based on the goals to be achievedby security measures and the content of management resources invested.
Among business-execution structures, management supervising business execution
related to information systems shall develop and maintain the internal rules andorganizational structures needed to implement the decisions of top management

It also must be noted that in some cases, such as when they are considered one of a number of group member companies under
the umbrella of a holding company, Financial Institutions and other organizations might formulate internal plans for groupmember companies as well.

15

concerning security measures, assign IT personnel, decide on security measures forindividual information systems, and verify their efficacy. Furthermore, management
shall occupy a position between top management and executing sections, fulfilling theroles of properly conveying the decisions of top management to the executing sections
and swiftly and accurately communicating to top management the state of information
systems related to security measures. In these ways, as what could be described as thecore of IT management members of management bear important roles andresponsibilities, and for this reason it is recommended that top management choose as
members of management officers and employees who possess sufficient knowledge
and experience concerning security measures and other aspects of information systems
as well as knowledge concerning all aspects of the businesses of the Financial
Institutions and other organizations (including risk management and auditing).
Top management also needs to develop and maintain structures for system audits and,based on its own decisions, have system auditing sections inspect and assess the IT
management (e.g., business-execution structures) necessary for security measures toconfirm that it is functioning appropriately and provide advice on improvements.
2)

Deciding on improvements to approaches etc. related to security measures
After verifying, through means such as reports from management and system audit reports,
whether IT management is functioning properly in accordance with its own decisions onpriority matters, top management must make decisions on improvements as needed andimprove approaches and other matters related to security measures on a continual basis.

16

2.

IT management necessary for security measures― Roles and responsibilities of other parties related to security measures for information
systems ―In security measures for information systems, multiple related parties perform their necessaryfunctions as illustrated below, under the IT governance of top management. (See Fig. 14.)IT management refers to matters such as the management by members of management ofbusiness execution related to IT by the executing sections for information systems (e.g., those
responsible for systems and for system risk management), based on IT governance by top
management.
To implement the decisions of top management concerning security measures, management
shall develop and maintain the necessary internal rules and organizational systems as well as
making decisions on security measures for individual information systems and verifying theirefficacy. Furthermore, management shall occupy a position between top management andexecuting sections, fulfilling the roles and responsibilities of properly conveying the decisionsof top management to the executing sections and swiftly and accurately communicating to top
management the state of information systems related to security measures.
The executing sections for information systems (e.g., those responsible for systems and forsystem risk management 14 ) are responsible for security measures under this management
structure. However, parties other than such executing sections, such as those responsible formanagement planning, whose tasks include assessing priorities for investment of management
resources, and users whose tasks include planning business models, also play important roles insecurity measures. 15

14

15

Although not shown in Fig. 14, the section handling general management of operational risk plays roles including assessment
and judgment of the status of system risk based on reports received from the system risk section. In addition, the roles of the
public relations section include swift disclosure of information in the event of severe system trouble or similar problems.
Under a model based on three lines of defense, management planning, systems, and users in the graph would be the first line ofdefense (administration of business lines), system risk management would be the second line of defense (as an independentfunction managing companywide operational risk), and system auditing would be the third line of defense (independent review).
Concerning parties related to operational risk in general, see Operational Risk – Supervisory Guidelines for the Advanced
Measurement Approaches (Basel Committee on Banking Supervision, June 2011).

17

(Fig. 14) Parties related to information-system security measures (ex.)
Top management
Reporting

IT governanceManagement
planning(section)

IT management

Coordination
Indication ofrequirements

User (section)

Systems(section)

Outsourcing
management

Checks andbalances,
support

Systems risk
management(section)

Auditing

Checking outsourcee
internal controls

Outsourcee

Systems auditing (section)

Management

Auditing(1) Roles and responsibilities of management 16
Based on IT governance by top management, members of management supervise parties such as
those responsible for systems and those responsible for system risk management and are
responsible themselves for the IT management necessary for security measures. They also
perform the role of swiftly and accurately providing top management with the information it
needs for IT governance.
1)

2)

3)

16

Development and maintenance of internal rules, organizational structures, etc.
Together with development and maintenance of the rules, manuals, and related materials,
including system risk management rules, necessary for security measures, system risk
management sections shall be established and security management, system management,
data management, network management, and other relevant management shall be
appointed, and the necessary organizations and structures shall be developed andmaintained. In addition, approaches to training and education shall be developed andmaintained for the purposes of the IT human-resources development necessary for
purposes such as system risk management and cyber security.
Decisions on security measures for individual information systems
Management measures for individual information systems shall be decided on based on thegoals for achievement and resource investment plans decided on by top management for
security measures.
Review of internal rules, organizational structures, etc.
Together with continual monitoring of the state of execution of the duties of those
responsible for system risk management, the efficacy of the posture toward system risk
management shall be verified and internal rules and organizational structures reviewed as
The description here focuses not on practical roles but on functions (roles and responsibilities) needed for security measures. In
fact, roles and responsibilities of officers and employees preforming management functions may be decided individually inaccordance with the actual conditions of each financial institution or other organization.

18

4)

necessary.
Reporting to top management on information needed for security measuresa. Occurrence of incidents with severe impacts on management or markedly detrimental
to the interests of customers
Examples of report content: As needed: Occurrence of severe system defects,
occurrence of cyber-attacks, delays in important development projects
b. Status of system risk management
Examples of report content: Periodic: Status of achievement of goals of security
measures, results of assessment of system risks, results of BCP drills, results ofinspection of security measuresc. Content of improprieties or scandals at other firms
Examples of report content: As needed: Results of assessment of the Company’s own
security measures in reference to cases such as information leakage at other firms
d. Control methods related to important system risks
Examples of report content: As needed: Development and maintenance of approach to
cyber security, revisions to contingency planse. Progress on individual development projects, reflecting system importance andproperties
Examples of report content: Periodic: Status reports on important development
projects (e.g., progress, quality, investment amounts, issues)
f. Results of checking the status of management by high-impact outsourcees, andproblems identified
Examples of report content: Periodic: Results of assessment of existing outsourcees(e.g., technological capabilities, response capabilities, quality, internal controls)
As needed: Results of assessment related to selection of outsourcees
g. Results of comprehensive auditing and assessment of systems by an independent
system auditor
Examples of report content: As needed: Results of auditing of system sections etc.,
results of auditing of important outsourceesetc.

(2) Roles and responsibilities of those responsible for management planningThis refers to the organizations or staff involved in management strategies and tasks such as
allocation of management resources. They are usually assigned to management planning
sections. They provide support for decision-making by top management on system development
projects including security measures, by assessing priorities related to investment ofmanagement resources as necessary, based on the results of adjustments made between sections.
(3) Roles and responsibilities of users 17
This refers to the organizations or staff involved in planning of matters such as business models(for products, services, and administration) to implement management strategies, in thehead-office sections responsible of Financial Institutions and other organizations. They do notinclude branches and other offices using systems. Users’ main roles and responsibilities insecurity measures are outlined below.

17

At Financial Institutions and other organizations that permit end-user computing (EUC), users and systems staff are assigned tothe same sections. In addition, depending on the type of business and other matters, in some cases some roles andresponsibilities of users will be handled by systems staff.

19

1)

Planning business models with consideration for security measures
In light of their positions on the front lines in deciding the shape of information systems,
users need to plan business models with consideration for security measures while working
together with other parties including those responsible for systems and those responsible
for system risk management, for example by ensuring that such business models do notinclude factors that would threaten the security and stability of information systems or
including in them controls for the secure and stable operation of information systems.

2)

Achievement of results of investment
To achieve management strategies, each user shall make requests to management andothers regarding system development projects needed in the operations for which it is
responsible, including security measures. In doing so, users shall be accountable tomanagement and others with regard to matters such as the usefulness of the system projectand its suitability to purpose with regard to management strategies. Users remain
accountable to management and others regarding the results to be achieved through thesystem development project in particular, including making clear projections of such
results at the time of planning the system and reviewing whether the projected results havebeen achieved after the system goes online.

3)

Identification of business requirements 18
When their requested system development project such as one involving security measures
has been approved by top management, management, or others, users are responsible for
identifying to those responsible for the system its business requirements, at the time systemdevelopment begins. If there has been a change in business requirements during the systemdevelopment process after initially providing such requirements, those responsible for thesystem shall be informed of the content of such changes in a timely and appropriate manner,and then those responsible for the system shall make the judgment of whether or not to
accept the changes based on assessment of the impact of a change taking place duringsystem development. Even after completion of system development, users remain
responsible for the content of business requirements that they had identified.

3.

Notes on staffing plans

In formulating staffing plans as a part of system strategic policies, top management must pay
attention to the following matters.
(1) Ascertaining numbers of staff, types of skills and their levels, and placement for purpose ofrealizing system strategies
Top management shall ascertain in specific terms the conditions of IT human resources,
including not only the number of staff needed but also their quality, for maintenance andutilization of IT as the infrastructure of management of Financial Institutions and otherorganizations.
Personnel make up one important element of IT-related management resources, and just as withamounts of investment in information systems top management needs to ascertain their status
and identify any gaps in the staffing necessary to implement system strategies.
18

At some Financial Institutions and other organizations, users not only indicate business requirements but manage the progressof system development as well.

20

Furthermore, they also need to ascertain in specific terms not only numbers of IT humanresources but their quality (e.g., IT-related skills they possess and their levels, placement, etc.)
as well. (See Materials Document 1.)
Depending on the type of Financial Institutions and other organizations, there also may be aneed to consider the comprehensive possession of multiple skills by specific personnel in lightof current conditions characterized by small numbers of personnel.
(2) Formulation of staff training plans in accordance with overall medium- and long-term plans
Top management shall formulate medium- and long-term human-resources development plansconsistent with medium- and long-term management plans, reflecting the current state of IT
human resources.
With regard to IT human resources, top management also needs to consider formulation of plansfrom the perspective of not just increasing numbers of personnel but human-resources
development as well in cases such as when there are insufficient staff for implementation ofsystem strategies.
In some cases the personnel subject to human-resources development as IT human resources
may include personnel of Group member companies in addition to leaders, and there also is aneed to give consideration to development and maintaining of an environment for suchhuman-resources development.
In addition, in formulating plans consideration must be given to methods of assessment,
treatment, and promotion of personnel as well.

4.

Decision-making by top management concerning important IT-related matters

At the same time the number of choices in design of institutions has broadened in recent years,
for example with the option of setting up a company with audit and supervisory committee,
increasing numbers of Financial Institutions are adopting the holding-company structure as well,and the subject defined as “top management” in the Security Guidelines is likely to beinterpreted broadly, to refer to more than just the board of directors.
In light of these circumstances, the form of decision-making by “top management” with regard
to important IT-related matters has been organized as outlined below, reflecting a fact-finding
survey.
(1) Deliberation and decision-making body on important IT-related matters
Since it is recommended that important IT-related matters reflect deliberation on subjects suchas maximizing the efficiency of investment in information systems based on an overview ofmanagement resources as a whole, it is recommended that they should be decided on throughdeliberation by a conference or other body in which top management as a whole takes part.
In addition, although the financial groups surveyed by the Center indicate that their boards of
directors were the decision-making bodies for such matters (see Fig. 15), since the majority ofimportant IT-related matters concern business execution it is possible that they could be decided

21

on by bodies consisting of membership including directors, executives, and others in accordancewith the actual circumstances of selection of institutions and delegation of authority, 19 not justby boards of directors alone.
However, regardless of which institution is chosen, authority for decisions on fundamental
matters should remain with the board of directors as a type of authority that may not bedelegated, and it is conceivable that among important IT-related matters as well the board of
directors should have authority for decisions on matters such as system integration policies andlarge-scale changes to systems. 20(2) Actual state of decisions on important IT-related matters in financial holding companies
and operating companies
Conceivable reasons why Financial Institutions establish holding companies may include theneed for coordination among interests. 21 The Center conducted a survey to see how decisions
on important IT-related matters are made between the holding companies and operatingcompanies in leading financial groups employing this financial holding-company structure (seeFig. 15). The survey’s findings identified the following two tendencies, and it is thought thatdecision-making between the financial holding company and operating companies reflects thestrategies and other characteristics of each group.
 Centralization of IT-related roles with the holding company
Information-systems personnel are centralized at the holding company and actual
development is outsourced jointly to information systems subsidiaries, shared system centers,
and others. In addition, IT-related decisions are made by an institution within the holding
company, while decisions by the operating companies are minimized, limited tocompany-specific matters such as internal controls.
 IT-related roles performed by individual operating companies
Each subsidiary has its own information-systems personnel and conducts outsourcing
individually. In addition, IT-related decisions are made by an institution within each
operating company, while decisions by the holding company are minimized, limited tomatters common across multiple group member companies.

19

20

21

In a company with a nominating committee, the board of directors is responsible chiefly for oversight, and in principle directors
may not exercise business operations. Operating officers are responsible for business execution. In a company with an audit andsupervisory board, decision-making authority on business operations may be delegated broadly from the board of directors toindividual directors.
Large-scale changes to systems refer to those that can be considered to involve degrees of risk roughly as high as those of
system integration, such as redevelopment of a backbone system.
Shinsaku Iwahara’s Kinyu mochikabugaisha ni okeru group governance: Ginkoho to Kaishaho no kosaku (3) (“Group
governance in a financial holding company: Intricacies of the Banking Act and the Companies Act [3]”) states, “Is it not thecase that the financial holding-company structure is adopted most commonly when it is thought that the holding-company
structure would be more appropriate than the direct-subsidiary structure for groupwide business administration? For example,
even within megabank groups the share of businesses other than banking is increasing, leading to increasing numbers of issues
that require coordination of interests with banking operations.”

22

Financial
group(Fig. 15) Study of actual state of IT governance corresponding to choice of institution

A

B

C

D

E

F

G

Deliberation and decision-making
on IT-related medium- andDeliberation/
Process of deliberation and
Systemlong-term plans etc.
decision-making led decision-making between holding
managementbycompany and operating companies
structure
Deliberating Decision-making
body
body
Deliberated and decided on by
operating companies based on
Management
Centralized
policies identified by the holding
conference, via Board of directors Holding company
management bycompany, and then deliberated andcommittee
holding company
decided on similarly by the holding
company
Deliberated and decided on by
operating companies after being
Management
Centralized
deliberated and decided on by theconference, via Board of directors Holding company holding company
management bycommittee(Operating companies restricted to holding company
company-specific matters such as
internal controls)
Deliberated and decided on by
operating companies individuallyManagement
Individually
Operating(Chief duties of holding company
conference, via Board of directors
operated by eachcompanies
are decisions on policies and rules
committee
operating company
and deliberation on some matterscommon to the entire group)
Joint management conferences heldby holding company and operatingcompanies
Split between(In the area of ICT, the holding
Centralized
holding company
Managementcompany plays the leading role,
Board of directors
management by
and operating
conferencewith matters deliberated onholding company
companies bysimultaneously in joint managementbusiness
conferences. The leading party for
non-ICT operations varies with thesubject.)
Management conferences of theCommittee orholding company and operating
Centralized
management Board of directors Holding company companies held simultaneously
management byconference(Operating companies play leading holding company
roles in decisions on some matters)
After deliberation and decision by
Centralized
the holding company, operating
Committee Board of directors Holding company
management bycompanies deliberate and decide on
holding company
the same content on another date
After deliberation and decision by
operating companies following
prior arrangements made between
Individually
the holding company and theManagement
Board of directors Holding company operating companies, the holding
operated by eachconferencecompany deliberates and decides on operating company
matters and then issues instructions
to the operating companies basedon its decisions

Examples of support for outside directors
 Assigning full-time staff to support outside directors
 Establishing a board of outside directors to share awareness of issues
 Having outside directors attend management conferences as observers
 Taking outside directors on site tours; etc.

23III. Risk-based approach
Principles of decisions by top management and others on matters such as security measures for
information systems
Summary◆ The basic principles of security measures based on a risk-based approach are listed below.
(1) The goals to be achieved by security measures for information systems shall be decided
on with sufficient content as necessary in accordance with the characteristics of therisks inherent to each information system.
(2) Allocation of management resources to security measures for information
systems should be decided on by taking into consideration not only adjustments withnew development and other efforts within the information systems budget, based oncomparison with countermeasures taken after a risk has manifested itself, but also
management resources as a whole, with the aim of maximizing corporate value.
(3) Security measures may be decided on independently only once appropriate
decision-making and other activities are conducted and management is conducted
properly in compliance with the above principles.
(4) For information systems owned by Financial Institutions and other organizations thatinvolve serious externalities and information systems that contain sensitive information,in addition to the above considerations the goals to be achieved by security measures
should be decided on by taking into consideration the externalities of such systems andthe sensitive nature of the information they contain, from the relevant social and public
perspectives.
 Based on the basic principles, it is recommended that Financial Institutions and otherorganizations aim to achieve “IT governance through a sufficiently risk-based approach.” In
the process toward this goal, IT governance through a simplified risk-based approach may be
employed, in which information systems are split into the two categories of “criticalinformation systems” and “other information systems” and security measures are
implemented individually for these two categories.
 Management responsibility in security measures based on the basic principles andother considerations is outlined below.
(1) The mission of top management is to maximize corporate value. This does notnecessarily mean the pursuit of security measures aiming to eliminate all risks.
(2) For residual risks that remain as a result of aiming to maximize corporate value, there isa need to recognize such risks accurately and then respond to them by formulating
contingency plans (“CPs” hereinafter) in accordance with their degrees and revisingthese in response to environmental changes.
(3) Top management should be considered to be fulfilling its legal responsibilities from an
objective point of view only when it prepares CPs etc. for security measures andresidual risks based on consideration of matters such as the Security Guidelines andother guidelines agreed upon in society (including the basic principles of security
measures mentioned above) and responds as the occasion may require, based on theCPs, in the event of an incident, in addition to complying with various laws andregulations.

24

The Report of the Council of Experts on the Usage of Cloud Computing by Financial
Institutions, issued by the Center in November 2014, recommends as the “recommended formof security measures” the “formulation of appropriate risk-management measures based on
management’s own judgment, applying a risk-based approach.” These are intended to“maximize potential while keeping risks to a minimum, by ascertaining accurately theproperties and risks of Cloud technologies.”
The term “risk-based approach” generally refers to the concept of putting to use the results ofanalysis of the properties of risks in rational decision making such as prioritizing ofcountermeasures. For this reason, the risk-based approach is an important concept in the pursuitof maximization of corporate value through maximizing the efficiency of decisions on
allocation of management resources by top management of Financial Institutions and otherorganizations, not just applying to use of the Cloud only.
For this reason, in studying IT governance necessary for security measures related tooutsourcing, this Council first will review the thinking behind existing security measures andthen will propose some basic principles of security measures from a risk-based approach,referring to examples from abroad. Next, it will make clear matters such as IT governance inaccordance with the basic principles of security measures. Furthermore, it also will propose theform that management responsibility should take in security measures.
In this way, this Council will identify clearly the form to be taken by new security
measures based on a risk-based approach, together with the form that management
responsibility should take. It is hoped that this will assist in balancing the sound growth ofFinancial Institutions and other organizations with the stability of the financial system, together
with securing Japan’s competitive advantages in the financial businesses of the future.

1.

The necessity of a new form for security measures

According to a survey by the Center, despite the fact that the environment in which
financial institutions operate has been undergoing massive changes for more than 10 years, nomajor changes are apparent in the proportions of security measures, maintenance operations,and new development. For example, the proportion of new investment is low relative to that inother developed countries. (See Reference Material 2.)
While it is thought that the reasons for this are complex, the Council of Experts will examine
first whether resources are allocated to security measures appropriately at present, from theperspective of the IT governance needed for security measures, starting from the underlying
concepts of security measures.
(1) The necessity of reviewing the concepts of security measure standards
In considering security measures for information systems, Financial Institutions andother organizations in Japan use both the Financial Inspection Manual by the regulatory agency
and the Center’s Security Guidelines, referring to the concepts of security measure standards atthe beginning of the Security Guidelines concerning the forms of security measures.
Initially, the Security Guidelines was developed 30 years ago: The Center was established withthe participation of related parties who possessed specialist and technical knowledge, including
Financial Institutions and IT solution providers, to complement the efforts of individual
Financial Institutions as their use of online technologies advanced, in light of the importance ofthe public nature and social responsibility of Financial Institutions while based on the principles

25

of self-responsibility and respect for their autonomy. It then formulated the first Security
Guidelines.
Over the three decades since then, the standards in the Security Guidelines have beenrevised repeatedly, and today they are used widely among Financial Institutions and otherorganizations as common industry guidelines and the importance of security measures is wellrecognized. As such, they have fulfilled their initially expected role adequately.
At the same time, the roles expected of information systems in Financial Institutions andother organizations have been undergoing massive transformations with rapid progress in
information technology, increasing diversity of computer configurations, and the need to securecompetitive advantage for Japan’s financial business in the future amid international
competition, and as such the time has come to review the concepts of security measure
standards, which have not undergone any massive changes in 30 years.
Under such conditions, it would be appropriate for the study of IT governance necessary
for security measures in the Council of Experts on Outsourcing first to review theexisting concepts of security measure standards and then to identify the form to be taken by new
security measures suitable for the present time, reflecting trends in other developed countries.
(2) Traditional thinking on security measures and related issues
Looking back more than 30 years to when the Security Guidelines first were prepared, atthat time Financial Institutions’ information systems referred to backbone computer systems.
There were almost no other information systems used in the industry, so that it was sufficient tofocus thinking on backbone computer systems alone. For this reason, in their first edition 30
years ago the Security Guidelines identified as subject systems the “online systems of Financial
Institutions and other organizations.”
After that, due to advances in information technology the information systems used byfinancial institutions and other organizations no longer were limited to backbone systems alone,
as other systems such as information-processing systems and section-specific systems increasedin number and these came to account for a considerable proportion of the information systems
as a whole. Their configurations also grew more diverse, ranging from host computers toclient-server systems and cloud services.
Amid such environmental changes, although in the current eight edition the scope of the
Security Guidelines still is identified as “online backbone computer systems,” for “information
systems other than online backbone computer systems,” whose numbers are increasing andforms are diversified, it states merely that the Security Guidelines may be “adopted as
appropriate” or based on “individual judgment in accordance with the importance of theservices provided or information handled by the systems.” As a result, the current environmentis one of uncertainty in which no concept is identified for minimum security measures for otherinformation systems, which make up a large proportion of all systems.
There are concerns that Financial Institutions and other organizations could face conditions
such as the following as a result:• In thinking about security measures for information systems other than online
backbone computer systems, staff of Financial Institutions and other organizations mightmake choices biased toward security by thinking that it would be safer to apply uniformly toother information systems the same Security Guidelines as those established for online

26

backbone computer systems, instead of thinking independently about standards ofapplication.
• Since the concepts of security measure standards do not identify the perspectives of upper
limits on allocation of management resources to security measures or adjustments ofallocation of management resources with new development, depending on factors such as thedecision-making processes of top management of Financial Institutions and otherorganizations regarding allocation of management resources the choice of excessive security
measures might ultimately be implemented without any changes.
• Under current conditions of uncertainty in which it could be held responsible directly forany severe system problems that could arise, top management might approve or pursue on its
own excessive security measures in order to eliminate such problems as much as possible.
In these ways, the content of the concepts of security measure standards could lead toexcessive security measures under current conditions, after more than 30 years have passed
since their first edition.
(3) Risk-based approach
In the United States, the United Kingdom, and other developed countries abroad, the concept
known generally as the “risk-based approach,” under which the results of analysis of theproperties of risks are used in rational decision-making on subjects such as prioritizing
countermeasures when Financial Institutions and other organizations make decisions on topics
such as security measures and allocation of management resources, is a shared understanding
among regulators and Financial Institutions and other organizations. (See Reference Material 3.)
Its main distinguishing features are outlined below.
• It would be unreasonable to invest unlimited funds in countermeasures to preventthe manifestation of risks in pursuit of total elimination of all risks. This can be considered to
be based on the idea that the closer an organization gets to a level of zero risks throughinvestment of funds the smaller the results of additional investment and the concept ofchoosing the most economic course from comparison of the costs of investment inpreventive measures and the costs of investment in countermeasures after the fact of
manifestation of a risk. Under circumstances that management resources are notinexhaustible, it is needless to say that these ideas have rationality.
• Regulators do not necessarily codify in detail risk categorization methods and risk
management measures, instead leaving these fundamentally to the discretion of Financial
Institutions. This is because they employ a principles-based approach out of the belief thatdetailed codification might lead to overlooking of possibly better methods and impede
innovation by financial institutions.
• Under such conditions, in guidelines on outsourcing and other matters regulators
define operations such as important banking functions, shared services, and operations thathave a strong impact on customers as priority operations and identify individual
management measures for them. This can be surmised to reflect the social and public
perspectives that since such operations making up part of the financial infrastructure involve
both externalities and high risks it would not necessarily be appropriate to entrust all aspectsof their management to Financial Institutions whose primary pursuit is that of maximal
internal efficiency.
In light of the above considerations, the following section begins the discussion of the form of
new security measures by explaining the basic principles of security measures as27

important preconditions.

2.

Basic principles of security measures

The basic principles of security measures for the information systems of Financial Institutions
and other organizations, based on the risk-based approach, are described below.
(1) The goals to be achieved by security measures for information systems shall be decided onwith sufficient content as necessary in accordance with the characteristics of the risks
inherent to each information system.
(2) Allocation of management resources to security measures for information systems should
be decided on by taking into consideration not only adjustments with new development andother efforts within the information systems budget, based on comparison withcountermeasures taken after a risk has manifested itself, but also management resources asa whole, with the aim of maximizing corporate value.
(3) Security measures may be decided on independently only once appropriate
decision-making and other activities are conducted and management is conducted properly
in compliance with the above principles.
(4) For information systems owned by Financial Institutions and other organizations thatinvolve serious externalities and contain sensitive information, in addition to the above
considerations the goals to be achieved by security measures should be decided onby taking into consideration the externalities of such systems and the sensitive nature of
the information they contain, from the relevant social and public perspectives.

(1)
The goals to be achieved by security measures should be decided on based on the results ofanalysis and assessment of the characteristics of the risks inherent to each information system.
They also should be decided on with sufficient content as necessary while making adjustments
for the state of management resources available. It is unreasonable to pursue total elimination of
all risks.
(2)
Allocation of management resources to security measures is intended to cover the costs ofachieving the goals of security measures; however, resources should not necessarily be allocatedwhile giving security measures top priority. First, the costs of security measures and the costs of
responding after manifestation of a risk without implementing security measures should becompared, with decisions made while also taking into consideration the option of taking risks.
Next, adjustments should be made with other targets of allocation within the information
systems budget, such as investment in new development. Lastly, consideration also should begiven to adjusting allocation of management resources as a whole above and beyond theinformation systems budget. These adjustments are necessary for purposes of maximizing theefficiency of allocation of resources—that is, maximizing corporate value.
(3)
Top management, management, and others should carry out appropriate decision-making or
proper management and supervision aiming to maximize corporate value while complying withprinciples (1) and (2) above. Security measures for information systems can be left to thediscretion and independent decision-making of Financial Institutions and other organizations
only if the organization as a whole is managed appropriately through these means.
(4)28

Financial Institutions and other organizations constitute a part of the financial infrastructure, andin some cases they own information systems in which the manifestation of a risk could have asevere impact on customers and other Financial Institutions and other organizations, not justwithin the relevant organizations themselves. For this reason, the goals for achievement by
security measures for such information systems involving serious externalities should be
decided on taking into consideration not just internal impacts but external ones as well.
However, since it is not easy for Financial Institutions and other organizations to assess external
impacts on their own, there is a need for rules agreed to in society reflecting consideration forsuch serious externalities.
In addition, in some cases Financial Institutions and other organizations own information
systems that contain sensitive information on subjects such as health and medicine. Sinceleakage of sensitive information could lead to wide-ranging losses through infringement ofbasic human rights and its handling has a social and public nature, there is a need for rules
agreed to in society reflecting consideration for the sensitive nature of such information. (See
Reference Material 4.)
The Center will play its necessary role in formulation of such rules agreed to in society.
The content of IT governance reflecting the above basic principles is described below.

3.

IT governance in accordance with the basic principles

In order to maximize corporate value by pursuing maximal efficiency in allocation ofmanagement resources related to information systems, it is recommended that top managementof Financial Institutions and other organizations fully understand risk-based approach inrelevant decision-making and comply with the basic principles in security measures.
(1) SignificanceThis refers to top management, in deciding on policies related to security measures,categorizing information systems in accordance with their risk properties, considering allocationof management resources in pursuit of maximal efficiency, including new investment, based on
the assessed results, and making comprehensive decisions on matters such as the goals to beachieved by the necessary security measures.
In consideration of allocation of management resources, under current conditions inwhich information systems are an important topic of management it is recommended that
discussion of maximization of the efficiency of investment in information systems take into
consideration all available management resources. For this reason, all members of top
management, not just the directors responsible for computer systems, need to be involved insuch decision-making and demonstrate appropriate IT governance. Furthermore, for thispurpose it is recommended that top management involved in decision-making possess at least aminimum degree of knowledge concerning the information systems possessed by the financial
institution or other organization and know about matters such as trends related information
systems in general.
When top management demonstrates such IT governance in accordance with basic
principles based on a risk-based approach, basically it is possible for Financial Institutions andother organizations to make choices on their own regarding matters such as the risk categories
of information systems and specific content of security measures.

29

(2) Rules for information systems involving serious externalities and related subjects
There is a need for rules agreed to in society for information systems involving
serious externalities and those containing sensitive information. As such, Security Guidelines
need to be applied in the following manner.
First, information systems that involve serious externalities and those that containsensitive information need to be assigned to high risk categories. Additionally, top management
needs to apply high-level security guidelines when setting the goals to be achieved by security
measures. As used here, “high-level security guidelines” refers to those standards indicated in
the existing Security Guidelines with the terms “must,” “should,” “need(s) to,” “necessary,” or“recommended,” or in the imperative. In addition, allocation of the management resources
needed to implement security measures needs to be conducted appropriately based on theperspective of maximizing the efficiency of resource allocation through comparison with newinvestment and other options.
(3) Necessity of a simplified method
Although basically it is possible for Financial Institutions and other organizations to choose on
their own matters such as the risk categories of information systems and specific details of
security measures if they adhere to a risk-based approach and comply with the basic principles
of security measures, when doing so it would not be easy to operate such matters fully andperform accountability requirements with regard to the appropriateness of decision-making andthe propriety of operations.
For example, in classification of risks, in light of the fact that system risk, as one type ofoperational risk, is by its nature connected to other risks, in allocation of management resources
there is a need for quantitative measurement, derivation of the point at which efficiency ismaximized for each of the components of the costs of necessary security measures, their results,
investment in new development, and its results, and deciding on the ultimate allocation ofmanagement resources based on the results.
Accordingly, even though such a complete risk-based approach would be ideal, it is thought that
not all Financial Institutions would be able to implement it.
In light of the fact that at most Financial Institutions and other organizations in Japanthe traditional way of thinking on security measures is in general use, there is a need for an
approach that would not result in dramatic changes to the details of implementing existing
security measures while adopting a risk-based approach and new forms of security measures.
The following section describes IT governance through a simplified risk-based approach inaccordance with the basic principles of security measures, as a means of achieving the desired
results through a simplified method similar to a complete risk-based approach.
While this simplified method is described here for convenience’ sake, it is recommended
that Financial Institutions and other organizations proceed with a more exhaustive approachaiming for a complete risk-based approach instead of sticking to this simplified approach alone.

4.

IT governance through a simplified risk-based approach(1) Significance30This refers to top management, in deciding on policies related to security measures,grouping information systems into the two main categories of critical information systems andother information systems based on their risk properties, considering allocation of management
resources in pursuit of maximization of efficiency, including new investment, based on theassessed results, and making comprehensive decisions on matters such as the goals to beachieved by the necessary security measures for each category.
(2) Significance of “critical information systems”
Which systems qualify as “critical information systems” can be determined by individual
Financial Institutions and other organizations in consideration of their impact on the settlement
system, customers, and other factors from perspectives such as their externalities and thesensitivity of the information they contain.
First of all, critical information systems include information systems involving serious
externalities and information systems containing sensitive information. In addition to these,
other information systems involving similar or higher degrees of risk may be chosen
independently as ones to which application of high-level security guidelines would beappropriate. 22
Today, when the business operations of Financial Institutions are highly dependent on
information systems, in principle decisions on critical information systems need to be made by
top management.
(3) Security measures and allocation of management resources for critical information
systems
Top management needs to apply high-level security guidelines in setting goals for achievementof security measures for critical information systems. As used here, “high-level security
guidelines” refers to those standards indicated in the existing Security Guidelines with the terms“must,” “should,” “need(s) to,” “necessary,” or “recommended,” or in the imperative. Allocationof the management resources needed to implement security measures needs to be
conducted appropriately based on the perspective of maximizing the efficiency of resource
allocation through comparison with new investment and other options.
(4) Security measures and allocation of management resources for other information
systems
While goals for achievement of security measures for other information systems traditionallycould be set independently, as noted above there is a concern that high-level security guidelines
could be applied uniformly since they are not specified clearly. The following measures are
specified in order to reduce such uncertainty regarding security measures.
First of all, in setting goals to achieve for security measures for other information systems,
top management needs to apply the minimum necessary security guidelines. Other goals toachieve may be chosen independently in accordance with the actual circumstances. Next, inallocation of the management resources needed for implementation of security measures there isa need to decide on more efficient allocation of management resources taking into consideration
new investment and other options.
22

Aside from the examples given here, it also is conceivable that critical information systems could be chosen from perspectives
such as those of availability and integrity.

31

Also, since information systems that lack externalities and customer information and have
only minor internal impact are very low-risk information systems, they could be considered not
to be subject to application of Security Guidelines from the start. Possible information systems
with only minor internal impact would be those that do not contain customer information that
includes sensitive information or those that do not interface with other information systems.
Such low-risk information systems for which it would be appropriate not to apply Security
Guidelines may be selected independently in accordance with the actual conditions of Financial
Institutions and other organizations when it would be appropriate to do so.
(5) Significance of minimum necessary security guidelines
These are similar in nature to the security measures for information systems with comparatively
low risks referred to as “simplified risk management measures” in the Report of the Council ofExperts on the Usage of Cloud Computing by Financial Institutions or those indicated with theterm “may” in the Security Guidelines.
The existing “simplified risk management measures” now are redefined as “minimum
necessary security guidelines” to be established as appropriate in future Security Guidelines.
However, as noted above these should be established within the scope of the objective of
reducing uncertainty regarding security measures when employing an expedient approach due toa high degree of difficulty of employing a completely risk-based approach.

32

(Fig. 16) Method of application of Security Guidelines in accordance with a risk-based
approach (RBA)

Simplified RBA

H

Sensitivity of
information(b)
Other information systems

Risk

Similar, simplified method

Seriousexternalities

Sensitivity of
information

Seriousexternalities(a)Critical information
systems

Complete RBA(c)

L[B] applies to information systems
with serious externalities and/or
sensitive information. For others,
the choice may be madeindependently.

[B] applies to (a)[C] applies to (b). (Apply [B] if
no [C].)(c) not subject to security
measures[A] (“recommended” > [B] (imperative, “necessary) > [C] (“may”)
Standards ending in [A] or [B]: high security standards
Standards ending in [C]: minimum necessary security standards
Notes:
1. [B] applies to systems judged by Financial Institutions and other organizations to involve
levels of risk equal to or greater than those of systems involving serious externalities orsensitive information. [A] (recommended), or rules established independently that are evenstricter than [A], apply when Financial Institutions and other organizations have judged
systems to involve even higher levels of risk.
2. While the simplified RBA uses the two categories of “critical” and “other” for convenience’sake, intermediate forms also are conceivable, such as dividing “other” into more detailed
subcategories and applying standards to each as appropriate.

33

5.

Management responsibility for security measures

The form of new security measures was described above. However, there are concerns thatthe shared understanding among top management described above that it should not demand
excessive security measures just because it could be held responsible directly for any severe
system problems that could arise could prove an impediment to complying with the basic
principles of security measures mentioned above.
This strong tendency toward risk avoidance could be deeply rooted in societal norms specific toJapan. While opinions are likely to vary widely concerning the appropriateness of these social
norms, as noted above it is not rational for top management, whose mission is to maximize
corporate value, to exhibit a strong tendency toward risk avoidance by completely refusing totolerate risk and pursuing the total elimination of all risks.
On the other hand, in the United States, the United Kingdom, and other developed countries
abroad risk preference tends in general to be higher than in Japan. For example, in the case of
FinTech American and British Financial Institutions can be seen to be taking risks to enter new
fields early through means including alliances and partnerships with IT startups and othernonbank players. This can be considered to reflect the fact that in the background there is ashared understanding among regulators and Financial Institutions and other organizations that it
is not rational to pursue total elimination of all risks, as noted above.
Under such conditions, it is thought that in order to secure competitive advantage for Japan
in financial businesses in the future both regulators and Financial Institutions and otherorganizations should have a shared recognition of the risk-based approach of not pursuing thetotal elimination of all risks. Such shared recognition also should include the understanding thatwhen residual risks remain after taking the risk-based approach and such risks manifest
themselves it would not be compatible with the concept of the risk-based approach if regulatorsthen merely held Financial Institutions and other organizations responsible for the results ofsuch manifestation of risks.
Based on the above concept, the form that should be taken by management responsibility
for security measures is outlined below.
(1) The mission of top management is to maximize corporate value. This does not necessarilymean the pursuit of security measures aiming to eliminate all risks.
(2) For residual risks that remain as a result of aiming to maximize corporate value, there is aneed to recognize such risks accurately and then respond to them by formulating
contingency plans (“CPs” hereinafter) in accordance with their degrees and revising thesein response to environmental changes.
(3) Top management should be considered to be fulfilling its legal responsibilities from an
objective point of view only when it prepares CPs etc. for security measures and residual
risks based on consideration of matters such as the Security Guidelines and otherguidelines agreed upon in society (including the basic principles of security measures
mentioned above) and responds as the occasion may require, based on the CPs, in the eventof an incident, in addition to complying with various laws and regulations.

34

IV. Risk Management in Outsourcing
Summary◆ In light of the various issues related to subcontracting, in IT governance in outsourcing top
management and others need to perform the following roles and responsibilities:(1) Deciding on policies related to outsourcing of information systems (top management)(2) Deciding on outsourcing of individual information systems(3) Deciding on frameworks for risk management in outsourcing of individual information
systems
Deciding on goals of security measures, allocation of management resources,
and management structures corresponding to the outsourcing management phase(4) Implementing security measures in each management phase (related parties)(5) Deciding on improvements related to risk management in outsourcing
Note: Based on a risk-based approach, the decisions under (2), (3), and (5) above shall bemade by top management for critical information systems but may be made by otherparties for other information systems. Even for critical information systems, when therisk of the outsourced operations is low, for example as a result of breaking theoperations down into their detailed components, the decision may be made by anotherparty.
◆ Risk management measures for outsourcing of operations that should be addedwith reference to existing security guidelines for outsourcing and security guidelines
for cloud services are listed below:(1) Deciding on requirements for selection of subcontractors(2) Conducting advance screening of subcontractors to verify the appropriateness of
selection of subcontractors by outsourcees(3) Clear specification by the financial institution of the right to audit subcontractors whenconcluding contracts with outsourcees(4) Auditing on the financial institution’s own responsibility when conducting auditsof subcontractors(5) When outsourcing critical information systems, formulating CPs with outsourcees andothers during normal times, and conducting joint drills with outsourcees and others.
When a CP is implemented in an incident, monitoring the status of CP implementation
by outsourcees and others.
Note: Based on a risk-based approach, for information systems other than criticalinformation systems, verification in advance that the content of advance screening ofoutsourcees’ subcontractors is at least of the same level as that of the financial
institution or other organization may replace the step under (2) above. The right to audit
under (3) need not be specified clearly in such a case. These measures may substitutefor those under (2) and (3) even in the case of critical information systems if as a resultof detailed subdivision of the operations the risk of subcontracted operations can beconsidered sufficiently low.
In outsourcing of development, similar substitute measures may be employed to those for
information systems other than critical information systems.

35

General characteristics of outsourcing are the limited nature of the scope and depth of
information that can be ascertained directly, the limited points of contact for controls, and the
difficulty of applying controls. These characteristics are even more pronounced for
subcontracting. 23
Amid such conditions, in recent years cases of misconduct at multiple shared system centerssuch as subcontractor employees counterfeiting ATM cards have served as reminders of therisks related to subcontracting. In addition, rather than being limited to shared system centerssuch risks are common to outsourcing as a whole, and the Banking Act and other applicablelaws and regulations have been amended to call explicitly on Financial Institutions and otherorganizations to ensure management responsibility and accountability. This Council was formedin light of the way outsourcing thus has become an important issue to Financial Institutions andother organizations.
At the same time, this Council first examined the topics of IT governance and IT
management and a risk-based approach, based on its understanding that responding to such
issues involved in outsourcing is an issue faced by all Financial Institutions and the perspectiveof IT governance is essential to addressing this issue appropriately. In addition, through theprocess of the previous study by the Council of Experts on the Security Guidelines and otherdocuments have been revised and new rules already have been developed for cloud services, as
one form of outsourcing.
In proceeding with study of outsourcing as a while, the various issues related to subcontracting
and the thinking on responding to them will be made clear first, and then the ideal form ofrisk management in outsourcing will be reviewed based on the content that has been consideredthrough now in the Council of Experts and elsewhere. Following that, risk management
measures for subcontractor management will be proposed.

1.

Various issues related to subcontracting

Subcontractor management has become recognized anew as an issue since cases of misconduct
arose involving counterfeiting of cards by subcontractor staff responsible who possessed thenecessary skills and authorization at multiple shared system centers of regional banks. Some
Financial Institutions using joint centers have implemented their own independent
countermeasures.
In addition, responses to such cases of misconduct including amendment of the Banking Act
have made subcontractors subject to regulators’ inspection authority not just at shared systemcenters but across outsourcing as a whole, so that Financial Institutions face demands for
management responsibility and accountability regarding subcontracting, and clarification of
responsibilities for subcontracting has become a subject of concern.
Although these cases of misconduct have been concentrated on shared system centers, since thefundamental cause stems from the distinguishing features of outsourcing such as the difficultyof applying controls to it, there is a need to consider the various issues related to subcontracting
as issues common to outsourcing as a whole.

2.

Thinking on responses to various issues

Today, as Financial Institutions and other organizations in Japan have aimed to maximize
corporate value through means including cost savings and use of advanced technologies, amid
23

Including subcontracting spanning two or more levels.

36

developments including advances in IT and growth in such organizations’ lines of business, thedegree of reliance on outsourcing in information systems is rising from year to year.
At their root, Financial Institutions and other organizations are companies doing business withthe aim of maximizing corporate value. At the same time, however, due to their public natureincluding the fact that their businesses make up part of the financial infrastructure, ensuring
their soundness is considered necessary by society, as seen for example in the fact that theirbusinesses require licensing.
Accordingly, today when the information systems of Financial Institutions and otherorganizations are handled by outsourcees to a considerable degree and dependency on suchoutsourcees is increasing, demands for management responsibility and accountability are
increasing with regard to securing the soundness of information systems.
At the same time, as mentioned above one characteristic of outsourcing is the difficulty ofapplying controls to it, and it is thought that this characteristic becomes even more pronounced
in subcontracting. That is, subcontractors normally offer only indirect points of contact
through outsourcees, and if the outsourced operations are subdivided and subcontracting tomultiple subcontractors, then the number of such contact points increases horizontally.
Furthermore, if subcontractors carry out further subcontracting themselves then the levels of thestructure deepen vertically as well. Accordingly, there are concerns that as subcontracting
advances the structure of controls through outsourcees grows more complex, and controls will
become extremely difficult as a result.
While of course it is clear from social and public perspectives that it would be inappropriate
if Financial Institutions and other organizations did not employ any controls on outsourcees andothers, there also are concerns that if they were to employ complete controls to the same degree
as those demanded for operations handled in house then the result could be the loss of theessential objectives of outsourcing intended to maximize corporate value, such as cost savings
and use of advanced technologies. For this reason, it is important to decide on the optimal
controls at the points of contact with outsourcees and subcontractors as a result ofcomprehensive consideration of matters such as the social and public perspectives of Financial
Institutions and other organizations and the objectives of outsourcing. This is the responsibilityof top management of Financial Institutions and other organizations.
On the subject of responding to various issues related to subcontracting as described above,with regard to countermeasures against cases of misconduct the Center has revised technicalstandards such as those on restricting access authorization as a “(tentative) response to cases ofimproper withdrawals” in the Security Guidelines revised last year (Revise Supplement to theEighth Edition). However, it is conceivable that one reason behind the occurrence of such casesof misconduct is the fact that the approach to management of outsourcing, including
subcontracting, in the existing Security Guidelines has not reflected adequately thedistinguishing features of critical information systems at Financial Institutions and otherorganizations, such as their public nature and the sensitive nature of the information handed byoutsourcees. In recognition of the need for thorough countermeasures in the form of identifying
an ideal form of risk management in outsourcing, instead of merely revising technical standards,
based on reflection on this point, the goal now is to study related matters and reflect the findingsin the Security Guidelines. 24
24

The “Summary of Revisions” in FISC’s “Security Guidelines on Computer Systems for Banking and Related Financial
Institutions (Revised Supplement to the Eighth Edition)” (June 2015) states concerning the “(tentative) response to cases ofimproper withdrawals by outsourcees,” “These revisions are tentative measures. Plans call for separate consideration ofrevisions through means including deliberation in the Council of Experts on External Outsource Management in General37

On the other hand, with regard to making clear the ideal form of responsibility forsubcontracting, there is no change from the argument described under III. Risk-BasedApproach: 5. Management Responsibility for Security Measures. That is, once the fundamental
countermeasures in subcontracting as described above have been reflected in the Security
Guidelines, Financial Institutions and other organizations will be considered to have fulfilled
their responsibilities if they have decided on allocation of management resources and optimalsecurity measures aiming to maximize corporate value based on those and are responding toresidual risks appropriately.
In light of the above, the following section will study the ideal form of risk managementin outsourcing with a focus on subcontracting, with the aim of setting up optimal controls, or
optimal goals for security measures, for outsourcees and other parties at the points of contact
with such parties—that is, in each management phase. In addition to reflecting IT governanceand IT management as well as a risk-based approach, such study also needs to take into
consideration the need to be understood in a way consistent with the content of measuresalready being developed in the Security Guidelines and other documents through the Council ofExperts with regard to cloud services, a form of outsourcing. 25

25

concerning basic content such as approaches to external outsourcee management.”
In 2014 FISC held the Council of Experts on the Usage of Cloud Computing by Financial Institutions, in June 2015 it issued
the “Security Guidelines on Computer Systems for Banking and Related Financial Institutions (Revised Supplement to theEighth Edition,” based on the results etc., each export committee was held, and in May 2016 it issued the “Information System
Audit Guidelines for Banking and Related Financial Institutions” (Revised Supplement to the Third Edition).

38

3.

Risk management in outsourcing

In considering the form that risk management should take in outsourcing, to begin withthe management process in outsourcing will be identified and its content and other matters madeclear from the perspective of IT governance with regard to management responsibility and othertopics. Then, thinking on risk management measures at the point of contact with outsourcing, or
the management phase, will be reviewed.
(1) Management processes in outsourcing
Management processes in outsourcing, based on the content of studies through now in theCouncil and elsewhere, can be thought to include the following: Deciding on policies related to outsourcing of information systems
 Deciding on outsourcing of individual information systems
 Deciding on frameworks for risk management in outsourcing of individual
information systems
Deciding on the goals of security measures and the management resources andstructure, including outsourcee management, necessary to achieve them based on thefollowing management phases 26 :a. When considering use
b. When concluding the contractc. During development (including adoption of packages, system modifications, etc.)
d. During use (e.g., monitoring 27)
e. At end of use
f. When an incident arises
 Implementing security measures in each management phase Deciding on improvements related to risk management in outsourcing
 Deciding on policies related to outsourcing of information systems
First, make clear the thinking (e.g., purposes of use) in selection of outsourcing basedon maximizing corporate value and ensuring soundness for outsourcing of information
systems, as policies. Examples include the operations for which outsourcing may be used
and risk management frameworks. In particular, since it is even more difficult to apply
controls to subcontracting, conceivable examples of what to include in policies for such acase include the operations for which subcontracting may be used and restrictions on thelevels and numbers of cases of subcontracting for each type of operation.
Since these policies should apply comprehensively to all information systems, they must
be decided on by top management.

26

27

FISC’s “Report of the Council of Experts on the Usage of Cloud Computing by Financial Institutions” (November 2014) states,“It is important to formulate basic policies on use and policies related to risk management, with the engagement of top
management.” It also identifies five phases of such management: “when considering use,” “when concluding the contract,”“during operation,” “upon termination of the contract,” and “when an incident arises.” While cloud services are focused mainlyon use, since “external outsourcee management” in the current Security Guidelines covers “development” as well as “use” thenew phase “during development” has been added.
FISC’s “Information System Audit Guidelines for Banking and Related Financial Institutions” says concerning monitoring:“Monitoring is a process to confirm whether internal controls are appropriate and effective. This includes day-to-day monitoringat each level through everyday business activities, regular and irregular self-inspections by management of individual sections,and internal auditing by internal audit sections independent from the organizations audited. System audits conducted by internal
audit sections are included in monitoring as independent evaluation.”39

 Deciding on outsourcing of individual information systems
In accordance with the above policies, the purposes of outsourcing must be made clear andits appropriateness should be judged for each individual information system.
For critical information systems, this decision must be made by top management due tothe need to take into consideration comprehensively matters such as the social andpublic perspectives of Financial Institutions and other organizations and the purpose ofoutsourcing, and to the particular stress on management responsibility and accountability.
For other information systems, the decision may be made by parties other than top
management.
In addition, even when outsourcing critical information systems the decision may be madeby parties other than top management when the risk of the outsourced operations can beconsidered to be sufficiently low, for example as a result of breaking the operations down
into their detailed components. 28
 Deciding on frameworks for risk management in outsourcing of individual
information systems
Next, proceed with steps including selection of outsourcees in accordance with theabove decision. Since in outsourcing it is important to decide on optimal controls at points ofcontact with outsourcees and others, appropriate consideration should be given to the
management framework, including the goals of security measures and management
resources allocated to them and structures for management of outsourcees and othermeasures, in accordance with each phase.
In accordance with the basic principles of security measures, the goals of security
measures should be decided on with sufficient content as necessary in accordance with thecharacteristics of the risks inherent to each information system and divisions on management
resources allocated should be decided on by taking into consideration not only adjustmentswith new development and other efforts within the information systems budget, based oncomparison with countermeasures taken after a risk has manifested itself, but also
management resources as a whole, with the aim of maximizing corporate value.
For reasons similar to those described under  above, this decision must be made by
top management for critical information systems. For other information systems, the decision
may be made by parties other than top management.
Also, as described under  above even when outsourcing critical information systems
this decision may be made by parties other than top management when the risk of theoutsourced operations can be considered to be sufficiently low.
 Implementing security measures in each management phase
Actual security measures based on the above decisions shall be implemented in eachmanagement phase by the parties related to the security measures as shown in “ITManagement Necessary for Security Measures.” Deciding on improvements related to risk management in outsourcing
As described in “IT Governance Necessary for Security Measures,” the state of
implementation of security measures shall be checked and verified by related parties throughmeans such as monitoring during operation, and continual improvements shall be made asnecessary to matters such as postures toward security measures.
For reasons similar to those described under  above, this decision must be made by
top management for critical information systems. For other information systems, the decision
may be made by parties other than top management.
28

The risk of the outsourced operations can be considered by quantity (e.g. outsourcing amount) in addition to the nature ofoutsourcing.

40

Also, as described under  above even when outsourcing critical information systems
this decision may be made by parties other than top management when the risk of theoutsourced operations can be considered to be sufficiently low.
(Fig. 17)

IT governance in the outsourcing management process
Criticalinformation
systems

Decision on
policyOther information
systemsTopmanagement
Decision on
improvements

Decision on
outsourcing

経営層

Other than
top
management
Related parties(managers etc.)

When outsourced
operations are low
risk: other than top
management

Implementation of
security
measures

Decision on
risk
management
framework41

(2) Thinking on risk-management measures in each management phase
First of all, even as the structure of controls through outsourcees grows more complex,
Financial Institutions and other organizations need to ascertain the state of contracting ofbusiness operations, including subcontracting. After doing so, since primary responsibility forcontrol of subcontractors lies with the outsourcees, the main responsibility of Financial
Institutions and other organizations regarding subcontracting is that of checking whether
outsourcees are managing subcontractors appropriately. In addition, even during themanagement phase the two points of checking the appropriateness of selection of subcontractors
and checking whether subcontractors’ business operations are managed and supervised
appropriately by outsourcees are particularly important. It also is necessary to take care toensure that such management does not infringe on laws or regulations. 29
In light of this thinking, the thinking on risk-management measures in each management phaseis summarized below, with a focus on subcontracting.
a.

When studying use
The current Security Guidelines do not mention subcontracting under “external outsourcee
management.”
On the other hand, under “use of cloud services” the Security Guidelines do include theperspective of subcontracting as one item under evaluation of Cloud businesses during
study of use (Operations 108), 30 presenting standards that reflect consideration forsubcontracting. However, since these standards include content specific to the Cloud, suchas “locations of data,” with the exception of portions such as these the standards forsecurity measures on “use of cloud services” could be referred to as standards foroutsourcing as a whole in consideration of consistency with them. 31b.

When concluding a contract
The current Security Guidelines discuss subcontracting only as one matter forconsideration in connection with conclusion of contracts. 32
On the other hand, under “use of cloud services” the Security Guidelines do identify indetail “subcontractor management” as one matter recommended to be stated clearly in thecontract when concluding one (Operations 109), so that, as with the case of when studying
use, they can be used for reference.
Financial Institutions and other organizations need to verify, from independent perspectives
as such organizations, the appropriateness of outsourcees’ judgment on the requirements

29

30

31

32

Laws that should be noted include the Act for Securing the Proper Operation of Worker Dispatching Undertakings andImproved Working Conditions for Dispatched Workers, the Employment Security Act, and the Act against Delay in Payment of
Subcontract Proceeds, Etc. to Subcontractors.
Under Operations 108, the FISC Security Guidelines on Computer Systems for Banking and Related Financial Institutions
identify “state of internal controls, risk management, etc. (including subcontractor management)” as one item for use inassessment of Cloud businesses.
Since cloud services are one form of outsourcing, standards applying to outsourcing in general need to be consistent with thosealready established for cloud services. However, it is necessary to employ an approach of referring to cloud service standards
that could be applicable to outsourcing as a whole while not using those considered specific to the Cloud as standards foroutsourcing in general.
FISC’s Security Guidelines on Computer Systems for Banking and Related Financial Institutions state in the section on
outsourcing in general (Operations 88), “The following are examples of matters that should be considered when concluding
contracts,” listing only “subcontracting (e.g., clarification of responsibilities related to outsourcing, necessity of prior approval
by Financial Institutions and other organizations)” along with confidentiality protection and report on incident.

42and procedures for selection of subcontractors. In particular, in subcontracting of operationof critical information systems this verification needs to be conducted before
subcontractors begin working on the operations, since risks could materialize soon after
they begin such work. From this point of view, there is a need to study individual risk
management measures.
c.

During development
The current Security Guidelines do cover development in standards for external outsourcee
management.
On the other hand, since under “use of cloud services” the Security Guidelines focus
mainly on cloud services and assume other information systems have been developed
already, those standards are centered on operation and do not mention development.
To begin with it is thought that since a system is not yet live during development even if arisk were to be manifested in outsourcing of development, the extent of its impact would
limited to within the financial institution or other organization, and furthermore as long as
customer information including sensitive information is not provided to outsourcees or
subcontractors, systems under development are not thought to involve the risk
characteristics of “critical information systems.”33
Accordingly, in light of the risk-based approach the development standards under “external
outsourcee management” in the current Security Guidelines should be revised based on thisway of thinking. In addition, even outsourcing of development of “critical information
systems” (including the times of not only development but also study of use, conclusion ofcontracts, and ending of outsourcing) may be included in the scope subject to the“minimum necessary security guidelines” established to reduce uncertainty regarding
security measures.

d.

During operation (monitoring etc.)
The current Security Guidelines do not mention subcontracting under either “external
outsourcee management” or “use of cloud service.” For this reason, there is a need toconsider new risk management measures as optimal controls for subcontractors.
When verifying whether outsourcees manage and supervise the operations management of
subcontractors appropriately, Financial Institutions and other organizations also need tolook at the appropriateness of checking (e.g., everyday monitoring and supervision) by
outsourcees. In addition, these need to be conducted independently, from the points of viewof Financial Institutions and other organizations, which are not necessarily the same as thepoints of view of the outsourcees.
It is conceivable that Financial Institutions and other organizations might entrust
verification to third parties instead of doing it themselves. In such cases as well, it needs tobe conducted from the perspectives of Financial Institutions and other organizations.
Individual risk management measures need to be considered in light of the above

33

Another important risk related to outsourcing is that of defects being introduced by outsourcees. This is a risk that concerns
information systems as a whole, not just outsourcing, and consideration of the current Security Guidelines and other documentsshows that sufficient quality control is demanded.

43perspectives.
e.

Ending
The current Security Guidelines do not mention subcontracting under either “external
outsourcee management” or “use of cloud service.”
Since at the time of ending subcontracting there are no differences in the factors involved
between subcontractors and outsourcees and the same risk management measures used foroutsourcees would be sufficient for subcontractors, the current Security Guidelines’
standards on “external outsourcee management” and “use of cloud services” could bereferred to as standards for outsourcing as a whole. 34

f.

Upon an incident
While the Security Guidelines require Financial Institutions and other organizations to
prepare CPs in advance for responding to incidents, 35 they do not mention outsourcing,including subcontracting. Although the Manual on Preparation of Contingency Plans at
Financial Institutions and Other Organizations (“CP Manual” hereinafter) does mention
outsourcees, 36 it does not mention subcontracting. Also, the Security Guidelines do notmention outsourcing, including subcontracting, upon an incident under “external
outsourcee management” or “use of cloud services.”
Responding to an incident, particularly one involving critical information systems, isidentified in “Management Responsibility for Security Measures” under the risk-based
approach as an important element in top management’s performance of its legal
responsibility. For this reason, it is important to consider risk management measures related
to responding to incidents in outsourcing, including subcontracting, in Security Guidelines,
not just the CP Manual.

The above summary concerns critical information systems important in terms of their social andpublic natures. For other information systems, it can be considered sufficient to check whether
outsourcees are controlling subcontractors appropriately. That is, if the controls implemented byoutsourcees with regard to subcontractors function at least as appropriately as those
implemented by Financial Institutions and other organizations, then it would be beneficial, fromthe perspective of management resources, to rely on those controls.

34

35

36

Under Operations 109, the FISC Security Guidelines on Computer Systems for Banking and Related Financial Institutions
recommend with regard to termination that security standards envisioning “the difficulty of coordination due to a change inpolicy by the Cloud operator” as one item that should be described clearly in contracts.
Under Operations 65, the FISC Security Guidelines on Computer Systems for Banking and Related Financial Institutions state,“A contingency plan must be formulated in advance for purposes including keeping to a minimum the effect on business
operations of severe damage caused by unexpected disasters, accidents, failures, etc. or damage resulting from difficulty incarrying out business operations, as well as prompt recovery.”
FISC’s Manual for Formulating Contingency Plans at Financial Institutions and Other Organizations calls for measures
including consideration of outsourcing when identifying risks, considering the posture toward communication with key
outsourcees in emergencies, and including outsourcees in drills.

44

4.

Risk management measures for subcontracting

In light of the above thinking, risk management measures for subcontracting in outsourcing ofoperations are proposed below.
(1) Formulating requirements for selection of subcontractors and implementing advancescreening
Financial Institutions and other organizations must establish requirements for selection of
subcontractors in advance in order to select appropriate subcontractors when concluding
subcontracting agreements with outsourcees.
Together with factors such as specialization (e.g., qualifications held) and reliability (e.g.,whether or not any problems have arisen in the past), requirements for selection need to include
whether or not the subcontractor has the ability to maintain an internal risk control posture suchas mutual checks and balances as needed in light of the content of the subcontracting operations.
It also is conceivable that when forced, for reasons such as specialization, to subcontract to a
subcontractor for which the maintenance of such a control posture would be difficult, conditions
could be added such as limiting work locations to those that could be controlled by theoutsourcees.
Next, when critical information systems are subcontracted, Financial Institutions and otherorganizations need to conduct advance screening of subcontractors assuming that outsourcees
will select subcontractors, in order to verify the appropriateness of such selection in light of theabove requirements for selection.
In addition, in subcontracting of information systems other than critical information systems,
when outsourcees’ process of screening and control of subcontractors is deemed to be at least as
effective as that of the financial institution or other organization, then that organization could
verify in advance the appropriateness of outsourcees’ maintenance and operation of thescreening and control process 37 and confirm the results of such verification instead of
conducting advance screening of individual subcontractors.
Furthermore, even when outsourcing critical information systems, if as a result of detailed
subdivision of the operations subcontracted to subcontractors the risk of such subcontracted
operations can be considered sufficiently low, then the above simplified procedures may be
employed in such a situation as well.
(2) Clear description of the right to audit subcontractors 38
When concluding subcontracting agreements with outsourcees on outsourcing of criticalinformation systems, the agreements must state clearly that Financial Institutions and otherorganizations have the right to audit subcontractors, to ensure that a system is in place forchecking on subcontractors.
When Financial Institutions and other organizations implement auditing of subcontractors, theyneed to do so under their own responsibility, in the same way as when auditing outsourcees. As
37

38

Specific verification methods are described in FISC’s Information System Audit Guidelines for Banking and Related Financial
Institutions (Revised Supplement to the Third Edition), under Part 1: Chapter 3: 5. Key Points of Auditing Cloud Services, as
follows:“(2) Verification items to confirm the efficiency of subcontractor screening and management processes by Cloud operators.”
Authority to audit needs to be specified in contract whether for subcontracting or sub-subcontracting.

45

used here “under their own responsibility” refers to the Financial Institutions and otherorganizations setting audit items in accordance with their own verification needs, reflecting thenature of risks to subcontractors, and to Financial Institutions and other organizations
conducting such auditing at timing that they consider appropriate, without excessive
consideration for outsourcees and others. They may conduct the auditing themselves 39 or
entrust it to appropriate auditors.
Selection of auditors needs to conform to the requirements for selection of auditors establishedin FISC’s Guidelines for Auditing of Systems of Financial Institutions and Other Organizations(Third Edition, Revised and Expanded) 40.
In addition, when outsourcing information systems other than critical information systems, it isacceptable to omit from the subcontracting agreement concluded with the outsourcees a clear
statement of Financial Institutions and other organizations’ right to audit subcontractors.
Furthermore, even when outsourcing critical information systems, if as a result of detailed
subdivision of the operations subcontracted to subcontractors the risk of such subcontracted
operations can be considered sufficiently low, then the above simplified procedures may be
employed in such a situation as well.
(3) Responding to incidents
When outsourcing critical information systems (not including subcontractors for which risks canbe considered sufficiently low as a result of detailed subdivision of the subcontracted tooperations), CPs need to be formulated to include parties such as outsourcees andsubcontractors as well. In addition, when outsourcees and others prepare their own individual
CPs, their content must be consistent and mutually complementary with the CPs of the Financial
Institutions and other organizations.41 Also, in normal times Financial Institutions and otherorganizations must implement periodic drills jointly with outsourcees and subcontractors, basedon the CPs concerning those outsourcees and others.
When parties such as outsourcees and subcontractors have identified the possibility of system
failures or other problems in critical information systems that could have a severe impact on thefinancial infrastructure as a whole, they shall report such discovery to the Financial Institutions
and other organizations immediately and support the decision-making by the Financial
Institutions and other organizations regarding implementation of the CP. In addition, if adecision is made to implement a CP, Financial Institutions and other organizations must notify
parties such as outsourcees and subcontractors of such fact and supervise the state of CP
39

40

41

When the audit method employed of asking outsourcees to provide information and verifying the appropriateness of
subcontracted operations based solely on checking the content of such information is not enough, other methods include on-site
audits of outsourcees or, when outsourcees have submitted the results of auditing already verified (e.g., SOC2, IT7), verifying
their content and conducting on-site auditing of outsourcees centered mainly on items of concern of inadequacies in suchauditing.
FISC’s Information System Audit Guidelines for Banking and Related Financial Institutions (Revised Supplement to the Third
Edition), under Part 1: Chapter 3: 5. Key Points of Auditing Cloud Services, as follows: “(1) Consideration of Joint Auditing
Using Independent Auditing of Cloud Operators,” states with regard to selection of auditors, “As a financial institution
responsible to its customers, it is necessary to select an auditor for which there would be no concerns about a possible conflictof interest with the Cloud operator. To do so, a client financial institution needs to select as an auditor an audit firm that does notcarry out account auditing of the Cloud operator. Also, when selecting an audit firm employed in guaranteeing the Cloud
operator’s SOC2 or IT7, there is a need to select an audit officer not employed in guaranteeing the Cloud operator’s SOC2 or
IT7.”
As issues related to ensuring the efficiency of contingency plans (CPs) 57.1% of regional banks, 67.7% of second-tier regionalbanks, 44.2% of credit unions, and 60% of credit cooperatives identified “consistency between our plans and those of relatedparties needed for business continuity,” indicating the need for consistency between the CPs of shared system centers and thoseof user Financial Institutions (FISC, Results of FY2015 Survey of Financial Institutions).

46

implementation by outsourcees and others.
In outsourcing of development, requirements for selection of subcontractors need to be
formulated. In such a case, for advance screening of subcontractors and clear description of theright to audit subcontractors, the simplified procedures above may be used for both criticalinformation systems and information systems other than critical information systems.
(Fig. 18) New risk management measures that should be added in subcontracting

Type of system

FormulationofAdvancerequirements screening
for selection

Critical information systems
Outsourcingof operation

Resulting level of risk is low
Other information systems

Outsourcing
Critical information systems andofother information systems
development

Clear
descriptionof the rightto audit

Responding
to incidents






1
1


2
2


‒
‒



1

2

‒

 Application of risk management measures required1 Individual advance screening of subcontractors may be replaced with verification of outsourcees’
processes of screening and control of subcontractors
2 Right to audit subcontractors is acceptable to omit from being stated clearly in agreements withoutsourcees

47

V.

Risk management at shared system centers

Summary◆ Since a shared system center is entrusted with information systems for multiple Financial
Institutions, it is not necessarily the case that it can be expected to involve smooth consensus
among the Financial Institutions to the same degree as in contracting by an individual financial
institution alone.
◆ Particularly under current conditions in which cyber-attacks are becoming more active,
information can spread throughout society quickly thanks to IT advances, and settlement is being
conducted 24 ours/day, 365 days/year, a delay in implementing countermeasures could lead toproblems having the severe result of spreading distrust. As such, the issue of the speed of
responding to an incident should be considered to be even more important than in the past.
◆ In responding to such issues, the roles and responsibilities of top management, such as allocationof management resources to be prepared for incidents, are extremely important.
◆ For this reason, it is essential first of all that top management of user Financial Institutions
understand the severity of the issue of speed in responding to an incident. Based on this, top
management of user Financial Institutions need to proceed swiftly with joint consideration of risk
management measures to resolve such issues.
◆ In such study, it is recommended that user Financial Institutions alone or with outsourcees jointly
formulate staffing plans to make it possible to continually assign the IT human resources needed
to be ready for incidents etc.
◆ While risk management measures should be studied in light of factors such as the degree of joint
use of systems and mutual relations between user Financial Institutions, another example of afeasible step would be the assignment to the shared system center of managers selected from user
Financial Institutions.
◆ In auditing shared system centers, it would be beneficial to refer to the joint auditing schemes
considered for cloud services.

48

In recent years, many Financial Institutions have increasingly been employing joint use of
systems, chiefly critical information systems such as accounting systems. In fact, among
Financial Institutions such as deposit-taking institutions in particular about 90% use sharedsystem centers for their accounting systems. 42
Since a shared system center is entrusted jointly by multiple Financial Institutions with criticalinformation systems such as accounting systems, as one form of outsourcing, it is a practice inwhich risks that could have severe impacts on financial infrastructure as a whole areconcentrated on outsourcees.
Under such conditions, at multiple shared system centers cases of misconduct have arisen suchas counterfeiting of ATM cards by subcontractor employees. This has led to a renewed
awareness of such risks, and as the progress of use of shared system centers has led toreductions in staffing of Financial Institutions’ IT sections 43 Financial Institutions face thedanger of lacking human resources who have the skills and expertise needed for the new risk
management measures that they need to implement for shared system centers. For this reason,
there is a need for additional study of risk management measures suited to the unique propertiesof shared system centers, based on the forms that should be taken by risk management inoutsourcing after clearly identifying the significance of shared system center and related issues.

1.

The significance of shared system centers and their distinguishing features(1) The significance of shared system centers
A shared system center is a form of outsourcing in which multiple specific Financial Institutions
jointly subcontract activities such as operation of critical information systems to a specificoutsourcee.
As used here, “joint” refers not only to cases in which user Financial Institutions have jointly
concluded subcontracting agreements with outsourcees. Rather, it also includes cases in whicheven though user Financial Institutions have concluded subcontracting agreement withoutsourcees on an individual basis the individual Financial Institutions’ information systems
effectively are operated together to an extent in which the impact of a system failure or otherproblem in an individual financial institution’s system could immediately spread to other user
Financial Institutions. 44(2) Profiles of shared system centers
Use of shared system centers began as long as 45 years ago among Shinkin banks, as a measureintended to achieve goals including making investments in computer systems more efficient.
Today, it is a common and important means by which Financial Institutions operate information
systems. (See References 6-8.)

42

43

44

Among regional banks, 78.3% use shared system centers for accounting systems, while the figure is 75.0% among second-tierregional banks, 97.2% among Shinkin banks, and 97.4% among credit unions (according to a survey by FISC).
While the number of staff needed by institutions managing accounting systems themselves averaged 53.4 persons, among those
not managing accounting systems themselves it averaged 12.8 persons (FISC, Results of FY2015 Survey of Financial
Institutions).
In the first meeting of this Council, use of mutual systems and networks among Financial Institutions, including the Zengin
System, ATM integration, and the domestic-exchange relay system among cooperative Financial Institutions, were identified as
separate from the scope of outsourcing.

49 Cooperative Financial Institutions
The full-fledged start of use of shared system centers took place about 30 years ago during
deployment of third-generation online systems (“3G online systems” hereinafter) 45 at
deposit-taking institutions and other Financial Institutions, when member Financial Institutions
began joint development and joint operation with IT solution providers by Financial Institutions
from the same sectors, in contrast to the individual development employed by city banks andmany regional banks. Since then, use of shared system centers has continued through alliances
within sectors intended for purposes such as system costs reduction and concentration of corecapacity on priority operations.
Cooperative Financial Institutions set up management organizations to centralize development
and operation, through investment by Financial Institutions in individual sectors. The roles ofthese management organizations are to support consensus-building among the Financial
Institutions and to manage outsourcee IT solution providers. This structure can be considered tohave continued for 45 years as a structure needed for the effective and efficient implementationof new development to enhance system functions as needed and implement security measures
such as securing backup centers amid limitations on management resources.
 Regional banks
While some second-tier regional banks (known at the time as mutual banks) began joint use of
systems at a relatively early stage, in general regional banks steadily began use of shared systemcenters since around 1998, for reasons including the needs to control system costs, to increasesystem staff as the domains covered by systems expanded, and to respond to technologicaladvances.
In general, rather than establishing a management organization to handle contracting with IT
solution providers as in the case of cooperative Financial Institutions, in this case individual
Financial Institutions contract with IT solution providers directly46 and organize meetings inwhich managers from all user Financial Institutions take part, to build consensus.

2.

Challenges involved in shared system centers

Cases of misconduct have arisen at multiple shared system centers used by regional banks suchas those in which subcontractor staff with the necessary skills and authority counterfeited ATM
cards. At the same time, as joint use advances the numbers of staff in IT sections have decreased
as a result of pursuit of efficiency, and Financial Institutions face the danger of lacking themanagement resources needed to fulfill management responsibility and implement risk
management measures actively.
Countermeasures have been proposed for the former of these issues under “IV. Risk
Management in Outsourcing” and for the latter under “II. IT Governance and IT Management: 3.
45

46

A 3G online system is intended to:  promote further streamlining of operational processing,  develop IT infrastructure thatcan be expanded with flexibility to make it possible to introduce swiftly new financial instruments and services and response toexpansion of business areas,  enhance the customer service network,  and enhance information functions for revenue
management, risk management, and strategic business deployment, among other objectives, and at the time they requiredlarge-scale IT investment (FISC, 2016 Financial Information Systems White Paper).
In selection of IT solution providers, while it may be based on the scale and IT strategies of participating Financial Institutions,in some cases institutions first choose to participate in shared system centers offered by IT solution providers with whom they
are familiar and who have demonstrated good track records when the institutions operated the systems themselves. (FISC, FY
2010 Regional Financial Institutions IT Research Report, “Consideration of IT Sourcing Strategies at Regional Financial
Institutions).

50

Notes on Staffing Plans.”

51

Based on the results of such previous study, additional risk management measures will beconsidered below after first describing the unique nature of shared system centers, as
supplemental rules to secure even greater effectiveness.

3.

Distinguishing features of shared system centers

While a shared system center requires procedures to achieve consensus among multiple
contracts in their relationships with outsourcees, it is hard to imagine that the degree of suchprocedures, such as the time they take, would be the same as in the case of contracting by anindividual financial institution. To begin with, it remains uncertain whether swift and smoothdecision-making to the same degree as in the case of an individual financial institution would bepossible at all times. 47
In particular, in the event of an incident, which involves a battle against time, there is apossibility that the severe result of spreading distrust due to delays in implementing
countermeasures as a result of the above uncertainty could arise. At present, such issues of timein responding to an incident are growing increasingly severe. For example, in recent years
cyber-attacks have been growing more active, and in particular the ranks of Financial
Institutions targeted by such attacks are spreading to include Financial Institutions mainly using
shared system centers. 48 In addition, with the spread of social media the speed at which
information spreads through society has increased, so that reputation risk can grow more quickly.
Furthermore, increasingly settlement is conducted 24 hours/day, 365 days/year, so that distrust
could intensify instantly both day and night. This fact too probably should be considered very
seriously.
Another distinguishing feature of shared system centers is the way the impact of a problem insystem operation at an individual financial institution could spread immediately to multiple
other user Financial Institutions.
It is conceivable that when cooperative Financial Institutions establish management
organizations through joint investment they either already are responding to matters such asthese through those organizations or will do so increasingly in the future. However, at othercooperative Financial Institutions and regional banks such responses might not be feasible, due
to the small number of participating banks, changes in participating banks, or other reasons, sothat consideration of individual risk management measures is needed.

4.

Ways of thinking on risk management measures specific to shared systemcenters

Ways of thinking on risk management measures reflecting the above distinctive properties ofshared system centers are summarized below.

47

48

Some shared system centers keep numbers of users small in order to shorten the time needed to achieve such consensus. Others
specify a leader bank (core bank) and use its leadership to shorten the time needed to achieve consensus. Even in such cases, it
has been noted, “In decisions on development projects to realize independent functions, such as new services or functional
enhancement, we need to wait for the results of consultation among the joint group, and in not a few cases it takes a long time”(FISC, FY 2010 Regional Financial Institutions IT Research Report, “Consideration of IT Sourcing Strategies at Regional
Financial Institutions).
The amount of damages due to the 2015 Internet banking fraudulent remittance incident reached approximately JPY3,073
million yen, even higher than the 2014 figure, and a look at the details of the victims shows that the number of victimized
Financial Institutions doubled, with growth in particular among the numbers of Shinkin banks and credit unions victimized, as
well as the presence of agricultural cooperatives and Labour banks among the victims (National Police Agency, Public Report,“Cyberspace Threats in 2015”).

52

First of all, although the existing Security Guidelines do touch lightly on shared system centers
under “external outsourcee management,” at the start of their discussion of external outsourcee
management and in their discussion of system auditing, 49 they cannot necessarily be said toreflect the above distinctive properties of shared system centers.
While it is unlikely that differences in the degree of completeness of the decision-making
procedures of user Financial Institutions could have decisive effects when information systems
are managed with stability in normal times, in the event of an incident, particularly one arisingin critical information systems, as noted above there is a possibility that a delay indecision-making could have severe effects.
The Financial Institutions should bear primary responsibility for responding to such incidents,
deriving from the nature of the financial industry. It should not be borne by outsourcees
responsible for technical aspects related to development and operation of information systems.
If critical information systems involve serious externalities, then their impact could affect thestable operation of the financial infrastructure and the economy as a whole, instead of being
restricted to internal effects such as those on customers. Thus there is a need to consider suchaspects fully, not just technical recovery of the system. In addition, if the system includes
sensitive personal information, then its leakage could spark a run on deposits, leading to credit
uncertainty and a situation that could shake the standing of Financial Institutions. As such,
responding to incidents requires considerable care.
In responding to issues such as these, the initial response to an incident is vital, and thoroughcountermeasures need to be implemented even in normal times to ensure that these are the best
possible responses. 50 For this reason, already rules are established to some degree in Security
Guidelines and elsewhere. Even so, in light of the matter of time discussed above it would be
hard to say that these were enough, and there is a need to take into consideration the possible
occurrence of situations not foreseen in CPs and the possibility of delays in the timing ofdecision-making necessitated by circumstances such as unforeseen situations.
In addition, since the roles and responsibilities of top management are extremely important inallocation of management resources to areas such as maintenance of response structures forincidents or establishing key decision-making authority and processes for responding toincidents, there is a need to consider these from the perspective of IT governance.
Under “Use of Cloud Services,” the Security Guidelines could mention reference standards on
joint auditing during operation as a form similar to a shared system center in that it involves
subcontracting by multiple parties.
With regard to other management phases, since they are only slightly related to the distinctive
properties of shared system centers these are not matters that should be given additional
consideration.
49

50

At the start of the section on external outsourcee management, the FISC Standards and Descriptions of Security Measures for
Computer Systems of Financial Institutions and Other Organizations describe the understanding that “use of ‘shared systemcenters,’ where multiple Financial Institutions and other organizations jointly use host computers and other systems, isbecoming common.” However, with regard to security measures its only statements include “in a case such as a shared systemcenter where operations are contracted by multiple clients, joint auditing by multiple clients may substitute for individual
auditing,” and “switching to backup systems (including those installed at backup sites; including enforced switching, decisions
and operation procedures for switching based on restrictions during system operation etc., and decisions on switching at sharedsystem centers).”
Conceivable examples, although these repeat initiatives already implemented, include  developing decision-making
procedures so that they can be completed in reasonable time as much as possible,  formulating CPs that include allforeseeable situations, and  repeating sufficient training in normal times and not neglecting efforts to improve mastery.

53

5.

IT governance specific to shared system centers (forms of formulating risk
management measures)First, top management of user Financial Institutions need to understand the severity of issues oftime with regard to responding to incidents. Then, top management of user Financial Institutions
need to proceed jointly with prompt study of risk management to resolve such issues.
In such study, it is recommended to formulate staffing plans jointly with user Financial
Institutions or outsourcees so that the IT human resources needed to be prepared for incidents
can be assigned on a continual basis.
While risk management measures should be studied in light of matters such as the degree of
joint use of systems and mutual relations between user Financial Institutions, some examples ofconceivable management measures are provided below.

Ex.: Assignment of persons responsible for responding to incidents etc.
Persons responsible for responding to incidents etc. shall be appointed and assigned to carry out
operations such as instructing outsourcees in the field under the CP until decision-making is
conducted by user Financial Institutions and responding to incidents not foreseen in the CP that
require immediate responses.
Persons responsible for responding to incidents etc. shall be granted by user Financial
Institutions the authority needed to carry out the above responses, in contracts. 51
In addition, since persons responsible for responding to incidents etc. need to make judgments
based on the distinguishing features of the financial industry in response to incidents, staff
capable of responding to incidents and carrying out other tasks 52 need to be chosen from user
Financial Institutions.
• Roles of persons responsible for responding to incidents etc. in normal times
Since persons responsible for responding to incidents etc. need to pay attention to the state ofoperation of systems, for example by never overlooking even minor irregularities in normal
times, to be able to respond to incidents, their roles also shall include heading the monitoringorganization at the shared system center.
Persons responsible for responding to incidents etc. shall assign staff from user Financial
Institutions to take part in continual monitoring activities at all times and consider
organizational management based on reports from such staff, including replacement of suchactivities, bringing together staff from user Financial Institutions, outsourcees, and others inaccordance with the circumstances. 53
51

52

53

As used here, “contract” refers in general to contracts needed in use of shared system centers, including not only thoseconcluded with outsourcees but also those concluded among user Financial Institutions.
Conceivable requirements for ensuring that persons responsible for responding to incidents etc. have the aptitude needed tofulfill their roles include whether they are able to rush to the location of the shared system center or management location in theevent of an incident such as a natural disaster, large-scale system failure, or cyber-attack so that operations can be carried out. In
addition, since important judgments might need to be made quickly in an emergency in which, for example, it is not possible tocontact user Financial Institutions, it is conceivable that they should be officers of user Financial Institutions at or above acertain rank.
It also is conceivable that the monitoring organization may be made up largely of staff of outsourcees in light of technicalconsiderations. At the same time, in light of the nature of monitoring as a method of management by the client of outsourcees,54• Roles of persons responsible for responding to incidents etc. when an incident arises
When an incident arises in critical information systems, persons responsible for responding
to incidents etc. shall carry out operations such as carrying out the CP in the field until
decision-making is conducted by user Financial Institutions and responding to incidents notforeseen in the CP that require immediate responses. Even after decision-making is
conducted by user Financial Institutions, persons responsible for responding to incidents etc.
shall collect information related to the properties of the financial industry in the field andprovide such information to Financial Institutions in a timely and appropriate manner, as
well as being responsible for providing appropriate advice in light of the situation in the field
regarding measures to take in response to the situation.54

In addition to the above, while in auditing there is a wide choice of different auditing methods
available including individual auditing by Financial Institutions using the shared system center,in order to ensure the efficacy and efficiency of auditing it would be beneficial to employ as one
means of auditing at the shared system center the joint auditing scheme considered for cloudservices. 55

54

55

clearly it would be appropriate for the manager of the monitoring organization to be selected from the Financial Institutions.
Necessary cyber security measures include having persons responsible for responding to incidents etc. handle the relevant
operations when setting up a CSIRT at the shared system center to conduct not merely technical operations (such as inspection
and analysis) but also financial operations (such as decision-making on dealing with Financial Institutions based on thecircumstances that have arisen, dealing with customers, and explaining matters to authorities).
A joint auditing scheme is proposed in FISC’s System Audit Guidelines for Financial Institutions and Other Organizations(Third Edition, Expanded), under Part 1: Chapter 3: 5. Key Points of Auditing Cloud Services, identifying related processes andconsiderations. While it includes the Cloud-specific factor of “establishment of a joint auditing structure,” considerations such
as “joint auditing processes,” “selection of auditors,” and “auditor accountability” also would be useful for shared systemcenters. It is conceivable that in future revisions to the auditing guidelines integrated revisions could be made withconsideration for cloud services and shared system centers, as methods of joint auditing when contracted by multiple clients.

55

VI. Thinking on future revisions to Security Guidelines etc.
The Security Guidelines and other guidelines for the Center will be revised in the future basedon proposals from this Council. In doing so, the following points will need to be considered.
(1) The necessity of measures to mitigate dramatic changes
These revisions are expected to differ from previous ones in that they will involve
thoroughgoing revisions starting from the way of thinking on application of the Security
Guidelines, and their impact on Financial Institutions and other organizations referring to
the Security Guidelines is expected to be quite large as well.
For this reason, in consideration of matters such as the possibility that such changes to the
Security Guidelines could themselves become risk factors, it will be possible to migrate inorder to the revised Security Guidelines and other guidelines at times such as whenmodifying systems or adopting new systems, while continuing the current handling for
information systems currently operating with stability.
However, early migration will be required when problems already have arisen and there isa need to apply the higher-level risk management measures following these changes (e.g.,assignment of persons responsible for responding to incidents etc. to shared systemcenters).
(2) Relationship to the Council of Experts on FinTech (tentative name)
The Center plans to establish a Council of Experts on FinTech (tentative name; “FinTech
Council” hereinafter) during this fiscal year as a continuation of the Council of Experts on
Outsourcing. Since it is conceivable that the advanced financial services using IT that arereferred to collectively as FinTech might often be used in the form of outsourcing, there isa possibility that some revisions or additions to the results of the Council of Experts on
Outsourcing might be necessary.
Accordingly, revisions to the Security Guidelines etc. will take place after the completionof the FinTech Council, reflecting the results of both Councils on outsourcing and FinTech.
Policies on revision of the Security Guidelines as envisioned at this time are outlined below.
(1) Addition of basic principles etc. to security measures
New forms of security measures, reflecting the risk-based approach, will be described
clearly as ways of thinking on Security Guidelines.
(2) Review of subject systems and ways of thinking on application
Reflecting the basic principles and other considerations, the systems subject to the Security
Guidelines and ways of thinking on their application will be revised.
(3) Reorganization of individual standards
In light of the above revisions, standards on outsourcing will be reorganized individually
first. Reorganization of other standards will be considered after that.

56

List of Members and Observers of the Council of Experts on Outsourcing in Financial
Institutions(Honorifics omitted)
Chair
Shinsaku Iwahara
Professor, Waseda University, Graduate School of
Law
Assistant Chair Masahiro Fuchizaki
Representative Director,President&CEO, the Japan
Research Institute, Ltd.
Members
Jiro Kokuryo
Vice President, Keio University; Professor, Keio
University Faculty of Policy Management
Masayuki Horie
Professor, Nihon University College of Commerce
Hiroshi Kamiyama
Partner, Hibiya Park Law Offices
Hiroki Kameda
Executive Officer&General Manager, Systems Div.,The Bank of Tokyo-Mitsubishi UFJ,Ltd.
(through fourth meeting)Kouji Yonei
Executive Officer/General Manager of IT&Systems
Planning Department., Mizuho Financial Group, Inc.
(starting with fifth meeting)Hisashi Sakaue
General Manager, Administration Div., The Senshu
Ikeda Bank, Ltd.
Eiko Morita
Director/Chief Operating Officer, BNP Paribas
Securities(Japan),Ltd
Masami Suzuki
General Manager, Administration Div., The Sugamo
Shinkin Bank
Hironori Sanada
General Manager In Charge of Information Systems
Dept., Sumitomo Life Insurance Co.
Kousei Asanuma
General Manager, Systems Risk Management Group,
IT Div., Aioi Nissay Dowa Insurance Co., Ltd.
Takashi Hishida
CIO Office(Executive Director), Nomura Holdings,
Inc.
(through first meeting)Motohiro Uemura
Deputy Managing Director,CIO Office (Executive
Director), Nomura Holdings, Inc.
(starting with second meeting)
Naoto Watabe
Associate Partner,Financial Third Industry
Consulting, IBM Japan, Ltd.
Teruhisa Ishikawa
Toru Hayashi
Masand Fujita
Fujio Tanaka

Koutaro Narita
Motohiko Nakamura

General Manager, OSS Solutions Center, ICTBusiness Div., Hitachi, Ltd.
Executive Manager, Planning Section, Second
Financial Sector, NTT DATA Corp.
Senior Director, Financial&Social Infrastructure Sales
Group, Fujitsu Ltd.
General Manager, Shinkin BankingSystem
Outsourcing Center, Financial Systems First Dept,
Financial Systems Second Sector, Nihon Unisys, Ltd.
Lead Systems Manager, Public Business Unit, NEC
Corp.
Certified Public Accountant Executive Board

57

Member Information Technology (IT), The JapaneseInstitute of Certified Public Accountants

58

Observers

Nobuo Tabe

Sayuri Katayose

Takuya Okada

Kazuaki Omori

Kazuhisa Uryu

Head of Chief Financial Inspectors/Head of Information Technology Monitoring,
Inspection Coordination Division,Inspection Bureau,
Financial Services Agency(through fifth meeting)
Head of Chief Financial Inspectors/Head of Information Technology Monitoring,
Inspection Coordination Division,Inspection Bureau,
Financial Services Agency(sixth meeting)Director, Head of Computer System Risk andBusiness Continuity Group Examination PlanningDiv., Financial System and Bank Examination
Department, Bank of Japan
Director, ICT Security Office,Information Security Management Office,Promotion for Content Distribution Divisor,
Information and Communications Bureau, Ministry ofInternal Affairs and Communications (MIC), JAPAN
Former Director, Office for IT Security Policy ,Commerce and Information Policy Bureau(Secretariat of the Center for Financial Industry Information Systems)
President
Tatsuo Watanabe
Executive Director

Norikazu Takahashi (sixth
meeting)

Planning Div.

General Manager

Toshihiro Horiuchi (through fourth
meeting)

Planning Div.

General Manager

Jutaro Kobayashi (starting with
fifth meeting)

Planning Div.

Deputy General Manager

Akira Fujinaga

Research Div.

General Manager

Yasushi Nakayama

Security&Audit/Research Div.

General Manager
NishimuraToshinobu

General Affairs Div. General Manager

Akinobu Saka (through fourth
meeting)

General Affairs Div. General Manager

Kouichiro Mizuno (starting with
fifth meeting)General Affairs Div. Special Managing Researcher Makoto Koriyama◆ Secretariat staff
Akihiro Shibata, Takeya Miyahara (through fourth meeting), Fuminori Nakahodo(starting with fifth meeting), Kazuma Okamoto, Satoshi Miura (starting with fifth
meeting)
Reference: Council schedule
First meeting: October 26, 2015; second meeting: December 1, 2015; third meeting:59

February 3, 2016; fourth meeting: March 23, 2016; fifth meeting: May 12, 2016; sixth
meeting: June 27, 201660

VII. References

61

Reference 1: Sample IT skills map

Skills related to systems planning
Projectmanagement

Estimating
scale

Project
assessment

TechnologicaltrendsSkills related to support for system operations

Budgetmanagement

Contractmanagement

HR/training

Purchasing

Systemauditing

Legal

Accounting
standards

Skills related to system development

Skills related to system operation

Individual technologies
Databases

Networks

OS

HardwaredesignOperations management
Operation
control

Business design skills
Domesticexchange
Deposits
Lending
Preparing
designs

Failurecontrol

Outsourcing
management

Information security

Markets
Cybersecurity

UnauthorizedaccessAccesscontrol

Testing

Project management
Progress
control

Devicemanagement

Programming

Qualitycontrol

Emergency responses
Outsourcing
management

Skills secured
in house

RecoveryPartiallyoutsourced skills

Source: Prepared by FISC

62

Information
coordination

Outsourcingdependent skills

PRReference 2: Breakdown of system-related expenses by purpose
Breakdown of IT expenses at Japanese banks by purpose
100%
8.1

9.3

7.9

7.7

8.6

8.9

9.1

8.3

8.3

9.1

67.7

65.0

66.5

66.9

67.4

68.5

69.6

70.6

68.8

67.4

24.2

25.6

25.6

25.4

24.0

22.6

21.3

21.2

22.9

23.6

1

2

3

4

5

6

7

8

9

90%
80%
70%
60%
50%
40%
30%
20%
10%
0%

(FY)

10

(Planned)New
系列4development

Maintenance/

系列1
operation

Security
系列2

Source: FISC, FY2015 Survey of Financial Institutions (March 2015)

Priority IT investment fields of US banks (2014)
 Multichannel banking, data
management, etc.
 Investment in service
advancements, improvements inconvenience, etc.

 Maintenance and managementof legacy systems, databasebackup, etc.
 Investment centered on
maintenance

Investment
in maintenance:
USD31.2 billion

Investment
in changes:
USD42.6 billion

Source: Technology Business Research
Note: Subjects: 200 members of core management of major North American
financial institutions with total assets of USD1 billion or more and IT vendors

Source: Financial System Council, Second Study Group on Advancement of Settlement Operations etc. (Oct. 2014)63

Reference 3: Trends among overseas regulators and others regarding therisk-based approach1.

Background of the risk-based approach

In Britain, after the passage of the Financial Services and Markets Act in 2000, that year thethen-Financial Services Agency (FSA) announced the adoption of the “risk-based approach” asa new regulatory approach. After that, even though a new financial supervisory system wasadopted in 2013 after the financial crisis spurred by the collapse of Lehman Brothers and otherdevelopments, 56 there have been no major changes in the existing concept of the “risk-based
approach.”
The thinking behind the “risk-based approach” identified by regulators involves tasks such as
setting priorities and distributing resources from a regulatory perspective with regard to externalrisk factors, based on risks for which the policy objectives of regulators are not achieved.
According to the official document Risk-based regulation in the UK (2005), Risk Appetite isdetermined from the perspectives of Impact and Probability, and priority is given to responding
to risks for which there is a high probability of a problem arising and the impact would be large,
rather than all risks for which there is any possibility of a problem arising.
The same document describes the significance of the risk-based approach as follows:“Management resources are not unlimited. It would be infeasible to try to implement anapproach that aims to eliminate all risks. This is why there is a need for a system to prioritizetasks. There is a need for optimal distribution of management resources and decision-making.”
As described above, Britain’s risk-based approach is based on thinking about how high is thelikelihood of a risk being manifested and how strong of an impact it would have. Enacting thisapproach is left to the discretion of individual Financial Institutions. This stems from the factthat traditionally British financial regulators have adopted a principles-based approach that
respects the autonomy of Financial Institutions. Basically, under this concept each financial
institution is expected to decide on and implement appropriate risk-control methods, andregulators will take action if an institution has been confirmed not to be implementing
appropriate and sufficient risk controls.
In the U.S., the risk-based approach is considered important, and according to the results ofinterviews with regulators at the end of the last fiscal year, “It is particularly important for small
and medium-sized Financial Institutions to apply the risk-based approach to IT. Trying to get aperfect score in IT leads to massive costs. This approach involves thinking about the extent of
measures to take by balancing costs and the damage that would result from a problem. Since
small and medium-sized Financial Institutions in particular have limitations on management
resources, in some cases in specific IT fields instead of trying to get a perfect score it would bebetter to divert those costs to other areas.” This confirmed that the risk-based approach isconsidered important in Financial Institutions’ IT governance.
2.

Risk-management measures based on the risk-based approach Risk-management measures according to importance56

The FSA, which had been the central regulatory authority, was broken up to form the three agencies of the Financial Policy
Committee (FPC), the Prudential Regulation Authority (PRA), and the Financial Conduct Authority (FCA) .

64

The U.S. and British regulatory systems are based on principles, and guidance and otherdocuments do not necessarily codify matters such as methods of classifying risks and risk
management measures in detail. In the interviews with U.S. regulators conducted at the endof the last fiscal year as well, the reason for not codifying such matters was stated clearly:“Codification involves the problem that even better methods might be overlooked andinnovation stifled because the codified content becomes absolute.”
At the same time, it was learned that U.S. regulators require the following three points as
the minimum level of measures to be taken by Financial Institutions:A) Compliance with the Gramm–Leach–Bliley Act (information security measures forpurposes such as preventing leakage of information)B) Implementing a high level of security measures for high-risk transactions (such as
funds transfers)
C) Formulation of a BCP
Efforts of U.S. and British Financial Institutions include cases of determining importancethrough rating based on confidentiality, integrity, and availability (CIA) as well as those ofdetermining importance based on the factors of monetary losses and external impact.
Normally the system owner reports the results of this determination of importance to therisk management committee where they are subject to deliberation.
In both the U.S. and Britain, regulators require individual banks to decide on andimplement management methods corresponding to the importance of transactions inaccordance with each bank’s own situation.
 Definition of important operations
Even under such conditions, guidelines on overseas outsourcing both provide particulardefinitions of “important operations,” for example as “Operations that could have a severe
impact on important banking functions or shared services or on customers,” and identify
individual management measures.
In Britain, the section on outsourcing (“SYSC8”) of the handbook established by the
Financial Conduct Authority (FCA) on outsourcing demands compliance with external
outsourcee management measures for critical or important functions identified as those forwhich “a defect or failure in its performance would materially impair the continuing
compliance” of the financial institution. (notification system)
In the U.S., the Office of the Comptroller of the Currency (OCC) guidelines on managing
risks associated with third-party relationships require enhanced supervision by top
management, through means such as requiring approval by the board of directors as aprerequisite, when outsourcing critical activities, identified as including those withsignificant impacts on “significant bank functions (e.g., payments, clearing, settlements,
custody) or significant shared services (e.g., information technology), or other activities
that . . . could have significant customer impacts.”
In Singapore, the Monetary Authority of Singapore (MAS) Technology Risk Management
Guidelines, which establish principles and best practices for IT risk management, require
the realization of a high degree of availability for critical systems, defining a criticalsystem as “a system, the failure which will cause significant disruption to the operations ofthe (financial institution) or materially impact the (financial institution’s) service to its
customers.”

65

3.

Guidelines on IT governance
The “Management” booklet of the Information Technology Examination Handbook issued
in November 2015 by the U.S. regulator the Federal Financial Institutions Examination
Council (FFIEC) identifies the positioning of IT governance and IT risk management in
Financial Institutions. The following three points can be identified as particular features ofthat booklet:
 Gives concrete form to the roles of the board of directors regarding ITA) Reviews and approves an IT strategic plan that aligns with the overall businessstrategy (including an information security strategy and cybersecurity threats)B) Oversees the institution’s adoption of effective IT governance processesC) Oversees processes for approving outsourceesD) Oversees IT performance, including projects, budgets, and priorities
E) Reviews the adequacy and allocation of IT resources
F) Approves a policy to escalate and report significant security incidents to top
management, committees, government agencies, and othersG) Holds management accountable for the identification of, policies for, andmitigation of IT risksH) Provides for effective audit coverage of IT controls
 Explicitly identifies roles of user sections in IT
While it explicitly identifies the roles and responsibilities of the IT committee, 57 it alsoprescribes that the membership of this committee include staff of user sections inaddition to top management and members from IT and risk management sections. In
addition, it also states with regard to the IT risk management posture that managers
belonging to user sections also bear responsibility for IT-related operations, 58 making it
clear that it considered coordination with user sections to be important for IT sections.
 Stresses the importance of external outsourcee management (clearly defines the roles ofthe board of directors)
It clearly identifies external outsourcee management as one of the board of directors’
oversight responsibilities. It also calls explicitly for management of risks of outsourcees
in each risk management process (risk identification, assessment, elimination,
monitoring, and reporting), showing that in the U.S. external outsourcee management is
considered very important and is a high priority in oversight and management.

57

58

Drafting of IT strategies and supervising IT performance in response to the needs of the business side, reporting to management
on matters related to IT operations, collection of appropriate information regarding IT and monitoring internal IT resources,
supervising the propriety of employee training, etc.
Examples include operations such as establishing IT support and processes for reporting to business line managers with regard
to the needs of the business side, new product development plans, etc.

66

Reference 4: Thinking on externalities and sensitivity of information
Financial Institutions and other organizations that have the capability to adopt a full risk-based
approach (“RBA” hereinafter) should be able, through their own ability, to ascertain accurately
matters such as the amounts of economic losses that would arise from the manifestation of a risk.
Thus, they should be able to handle matters such as making judgments on risk mitigation andtolerance and efficiently deciding on security measures and allocation of management resources
based on these, and as such ideally there should be no need for the provision of rules on these bysociety.
Notwithstanding the above, the reasons why socially agreed-upon rules can be considered necessary
with regard to serious externalities are described below under “Thinking on Externalities.”
In addition, even if no serious externalities are involved, there is a need for special consideration inadvance regarding the handling of personal information. The reasons why socially agreed-upon rules
can be considered necessary with regard to sensitive information are described below under“Thinking on Sensitivity of Information.”
 Thinking on Externalities• As used here, “externalities 59” refers, for example, to the possibility that a system failure or otherproblem in the settlement system of an individual financial institution could cause economic
losses in society as a whole, including other Financial Institutions and other organizations. For
example, due to the nature of settlement systems a severe failure in an individual financial
institution’s system could lead to the spread of economic losses by causing distrust in other
Financial Institutions and other organizations.
• As used here, “externalities” does not include the customers of individual Financial Institutions.
This is because for customers it is possible to identify and respond to individual counterparties
and calculate amounts of losses internally.
• On the other hand, even Financial Institutions and other organizations that have the capability toadopt a full RBA are unable to ascertain accurately matters such as amounts of losses related to
information systems that involve externalities. That is, it would be difficult for individual
Financial Institutions and other organizations to ascertain accurately the amounts of losses
sustained by society as a whole as a result of a system failure or other problem, calculate andinternalize the costs needed to prevent such failure, and reflect these properly in drafting security
measures.
• While it would be possible to return part of the amount of losses sustained by society throughcompensation for damages after the fact, in that case too it would be difficult to identify the
portion for which the relevant financial institution was responsible amid the complex chain of
cause and effect if it involved distant links in the chain of settlement. (When also taking into
consideration matters such as legal jurisdiction and enforcement across international borders andthe hurdles of the costs of litigation, only a small portion of such losses would be likely to be
returned.)• Under such conditions, Financial Institutions and other organizations also might make decisions
on security measures by leaving all or part of the societal impact of failure of their systems out of
the scope of consideration for the above reasons and due to other factors such as incentives(moral hazards).
• In order to address such issues appropriately, rules such as those specified as “necessary” (i.e.,
those corresponding to high-level security guidelines) are needed for systems involving serious
externalities with particularly high levels of risk, as rules common to Financial Institutions andother organizations.

59

The term “externality” does not mean “outsourcing” or “third party.”67 Thinking on sensitivity of information• Personal information is subject to a legal and regulatory framework including the Personal
Information Protection Act, and Financial Institutions and other organizations need to comply
with this framework when implementing security measures for their computer systems.
• However, the personal information handled by Financial Institutions and other organizations isvaried and diverse, ranging from information such as names and addresses to highly sensitive
information such as records of people’s lives, including their medical histories. It would not beappropriate to handle such sensitive information without differentiating it from general personal
information.
• If both these types of information were handled in the same ways, then personal information,
which is present in nearly all computer systems of Financial Institutions and other organizations,would need to be subject to excessive security measures as a result of such sensitive information,and this could result in excess allocation of resources.
Reference: Guidelines on Protection of Personal Information in the Financial Sector
Article 6. Sensitive information
1. Businesses that handle personal information in the finance sector must not obtain, use, or provide to third
parties information concerning political views, creed (i.e., religion, thought, or beliefs), labor-union
membership, ethnicity or race, family status and legal domicile, health, medicine, or sexual lifestyle, or
criminal record (“sensitive information” hereinafter), except in the following cases.
 . . . (omitted)
 When using biometric information corresponding to sensitive information for purposes of personal
identification, with the consent of the individual concerned• In order to avoid such circumstances, it would be appropriate to separate personal information
into sensitive information whose protection should be subject to the highest level of security
measures from other personal information, and to apply rules such as those specified as“necessary” (i.e., those corresponding to high-level security guidelines) for sensitive informationin the same way as for systems involving serious externalities.
• Since leakage of sensitive information without the consent of the individuals concerned could
lead to wide-ranging damages not limited to just economic losses but also including infringementof fundamental rights, its handling can be considered to be of a social and public nature. For thisreason, it would be reasonable to handle it in the same way as systems involving serious
externalities.

Naturally, Financial Institutions and other organizations may determine on their own that some of
their information systems may, for various reasons, involve a degree of risk similar to or exceeding
those of information systems involving serious externalities or those containing sensitive
information (information systems included under (a) in the simplified RBA on p. 33 [Fig. 16]). It
would be reasonable in a sense for individual Financial Institutions and other organizations to apply
to such information systems rules such as those specified as “necessary” (i.e., those corresponding tohigh-level security guidelines), and of course it is conceivable that they might implement evenhigher-level measures in light of the risks involved.

68Reference 5: FFIEC IT Examination Handbook: Management: Third-Party
Management
Action Summary
As part of a financial institution’s third-party management program, management should ensurethat third-party providers effectively provide support by doing the following:• Negotiating clear and comprehensive contracts with appropriate terms that meet theinstitution’s requirements.
• Ensuring receipt of audited financial statements from third-party providers at least annually.
• Reviewing results of independent audits of IT controls at third-party providers.
• Monitoring the responsiveness of third-party provider’s customer service, including client
user group support
Financial Institutions increasingly rely on third-party providers and software IT solution
providers. Larger or more complex institutions are more likely to have institution-wide
third-party management programs that encompass all of these relationships. IT departments cancontract with third-party providers for several services, including data processing, softwaredevelopment, equipment maintenance, business continuity, data storage, Internet access, andsecurity management. In smaller or less complex institutions with less formal third-party
management programs, the procurement of third-party services should be reviewed byinstitution staff familiar with the operational, financial, security, and compliance requirements
for such relationships. The oversight of the relationship should be performed by staff withknowledge of the services provided.
The board of directors should hold senior management responsible for ensuring appropriate
oversight of third-party relationships. Technology needed to support business objectives is often
a critical factor in deciding to outsource. Managing such relationships is not just a technology
issue; it is an enterprise-wide governance issue. An effective third-party management program
should provide the framework for management to identify, measure, mitigate, monitor, andreport risks associated with the use of third-party providers. Management should develop andimplement enterprise-wide policies and procedures to govern the third-party management
program, including establishing objectives and strategies, selecting a provider, negotiating thecontract, and monitoring the outsourced relationship.
Management should evaluate the quality of service, control environment, and financial
condition of the third parties providing the institution with critical IT services.60 Third parties
can include financial institution affiliates, other Financial Institutions, and third-party service
providers. As appropriate, these third parties should support the responsibilities of their financial
institution clients to adhere to all applicable laws, regulations, and supervisory guidance.
Financial institution management should expect third-party support at a level consistent with thecriticality of the services provided to the institution.
When financial institution management contracts with third-party providers for some or all IT
services, it should ensure that controls over outsourced activities provide the institution with thesame level of assurance as controls over those activities performed in-house. Management
60

With regard to outsourcing of critical operations, Britain requires Financial Institutions to submit notice to regulators whenplanning to outsource critical operations while Singapore requires Financial Institutions to submit notice to regulators before
outsourcing critical operations or making adjustments to existing outsourcing of critical operations.

69

should also consider additional oversight or controls over third-party providers that operate inforeign locations. Management should have mitigation strategies that address risks related toforeign-based third-party providers, if applicable. In the event that the financial institution
locates any of its own operations offshore and develops third-party relationships at thoselocations, specific risk mitigation plans should be considered to address related foreign-based
third-party risks.
Management should address exposures from third-party risks through an effective third-party
management program. Some factors that management should consider or address include thefollowing:• Assessing whether each third-party relationship supports the institution’s overall objectives
and strategic plans.
• Evaluating prospective third-party providers based on the scope and importance of theservices they provide.
• Tailoring the institution’s third-party management program based on an initial and ongoingrisk assessment of the institution’s third parties and the services they provide.
The time and resources devoted to managing third-party relationships effectively depend on
several factors, such as the critical nature of outsourced processes, staff knowledge, andcomplexity of systems.
(Emphasis in original, underlined by FISC.)

70

Reference 6: History of shared system centers
1.

Cooperative Financial Institutions

Use of shared system centers by Shinkin banks began with the steady establishment, starting in 1971,
of joint administrative centers in seven districts across Japan. In 1985, Shinkin Information Systems
Center K.K. 61 was established, and in 1987 the joint administrative centers migrated to 3G online
systems. Following that, the district shared system centers were consolidated into two centers (eastand west), and today they are operated by Shinkin Kyodo Center established in April 2013. At
present, more than 90% of the Shinkin banks in Japan (244 as of March 2015) use Shinkin Kyodo
Center.
Among credit unions, in 1985 Shinkumi Information Service Co., Ltd. 62 established a national
shared system center for credit unions, 63 and it began operating 3G online systems in 1991. It
maintains the same structure today, and more than 90% of the credit unions in Japan (146 as ofMarch 2015) use its services.
Among Labour banks, a joint administrative center for the greater Tokyo area was organized in 1971,
and it began online operation in 1978. After that, a general administrative center for Labour banks
was established in 1989, and in 1990 an online system used jointly by all 13 Labour banks in Japan(Unity) began operation. In 2014, the All One System began operation as the successor to thatsystem.
Among agricultural cooperatives, Nochu Information Processing Co., Ltd. 64 was established in 1981,
and today a system (JASTEM) that began operation in 1999, operated by the Norinchukin Bank, 65 isused by all agricultural cooperatives.
2.

Regional banks

Use of shared system centers by some Second-tier regional banks (at the time called mutual banks)
began in 1975 when SBK was established to serve eight banks located in the Kyushu region. It
began offering joint online services in 1977, and since then its services have included joint use ofaccounting systems and joint purchase of ATMs and computer terminals for business use.
Since around 1998 regional banks have steadily begun using shared system centers aiming to keep
down IT costs, increase IT staff through expanding the domains covered by computer systems, andadapt to technological advances. At present, six IT solution providers operate 13 types of sharedsystem centers, and more than 70% of regional banks use shared system centers. Mainly, regionalbanks that do not compete with each other for business will use a single shared system center
together, striving to cut IT costs and IT staffing requirements and enhance system functions andservices through use of the expertise of early adopters, among other aims.

61
62
63

64

65

Financed with investment from each Shinkin bank (100% of total investment).
Financed with 90% investment from the Shinkumi Federation Bank and the remaining 10% from credit unions.
Consisting of the following two organizations: the SKC Center (national shared system center for credit unions), handlingaccounting and information systems, and the Zenshinkumi Center, serving as a central facility mainly handling settlement
operations.
Financed with 90% investment from the Norin Chukin Bank and 10% from NTT Data. Renamed Nochu Information System
Co., Ltd. (NIC) in 1984.
Development and operation subcontracted to Nochu Information System Co., Ltd. (NIC).

71

Reference 7: Timeline of use of shared system centers
Regional banks 66

Cooperative Financial Institutions
Business

Shinkin banks

Credit unions

April 1971: Steadyestablishment district of
joint administrative centers

Labour banks

May 1978: Online
use of joint
administrative
centers begins

2008present

66

Second-tierregional banks
1975: SBK
established toserve eight banks
located in the
Kyushu region

May 1981:
Nochu Information
Processing Co.,
Ltd. (NIC)
establishedOct. 1977: Joint
online services
begins operation

Feb. 1985: Shinkin
May 1985:
Dec. 1989:
Information Systems
Shinkumi
GeneralCenter Co., Ltd. established Information
administrative
Service Co., Ltd. center for Labour
Nov. 1987: Joint
established;banks establishedadministrative centers
national sharedmigrated to 3G online
system center forsystems
credit cooperatives
establishedMay 1991: 3G
online systems
begin operation

19982007

Regional banks

Nov. 1971: Joint
administrative
center for thegreater Tokyo area
established(established forother regions later)

19651984

19851997

Agricultural
cooperatives

May 1990: New
online system(Unity) begins
operation

Jan. 2003: Hokkaido
Shinkin Outsourcing
Center begins operation
Jan. 2005: SBOC Tokyo
begins operation
April 2006: Shinkin joint
system operation structure
establishedSept. 2006: Shinkin
Nishi-Nippon Solutions
Center begins operation

Sept. 2011: Consolidation May 2015: 6Gof hardware on two
system begins
east/west centers completed operation
April 2013: Reorganized to
Shinkin Kyodo Center

Jan. 2014: New
online system (ROne System)
begins operation

May 1997:
STAR-ACE
begins operation(Nagano Bank)(discontinued
2013)
Oct. 1999:
JASTEM system
begins operation

May 2011: Bank computer
services begin operation (former
Senshu Bank, Tottori Bank)(discontinued in 2015)
March 2002: Judankai begins
operation (Hachijuni Bank)

Jan. 2000:
STAR-21 begins
operation (SendaiBank)(discontinued
2013)
Jan. 2001:
Second-tierregional bankoutsourcing center
begins operation(former
Shokusan Bank,
Fukushima Bank)(May 2006:
Deployment of
JASTEM systemcompleted)

Jan. 2003: Flight21 begins
operation (Bank of Fukuoka)
Jan. 2003: Banks'ware begins
operation (Higo Bank)
Sept. 2003: PROBANK begins
operation (Toho Bank)
Jan. 2004: Regional bank sharedsystem center begins operation(Bank of Kyoto)Jan. 2007: Chance begins
operation (Joyo Bank)May 2007: BankVision begins
operation (Hyakugo Bank)May 2003:
BankingWeb21
begins operation(Yachiyo Bank)May 2005:
Nextbase begins
operation(Tokushima Bank)May 2011:
March 2008: TSUBASA Project
Migration to
beginsnext-generation
Jan. 2010: MEJAR begins
JASTEM system operation (Bank of Yokohama)completed
Oct. 2010: STELLA CUBE
(consolidation on begins operation (Tokyo Tomin
two centers: Kanto Bank)and Kyushu)
March 2013: BeSTAcloud begins
operation (Shonai Bank)
Source: Prepared by FISC

Financial Institutions in parentheses are the first to adopt the systems. When user Financial Institutions include both regionalbanks and second-tier regional banks, systems are shown in the column for the first user financial institution’s business type.

72

Reference 8: Deposits of Financial Institutions using shared system centers
The numbers of Financial Institutions using shared system centers for accounting systems as ofMarch 2016 and their total deposits are shown below.

Business

Shinkin banks

Credit unions(Shinkumi banks)
Labour banks

Name of system
Shinkin Kyodo System
Shinkin Nishi-Nippon
Solutions Center
SBOC Tokyo
Hokkaido Outsourcing Center
SKC Center (nationwide sharedsystem center for credit
associations)
Maple Hiroshima
R-One System
JASTEM system

Japanese Agricultural
Cooperatives banks
Regional bank shared systemcenterChanceMEJARBankVision
Judankai
Regional banks,
Flight21
Second-tier regionalbanks, etc.
Nextbase
TSUBASA
Banks'ware
STELLA CUBE
PROBANK-R2
BeSTAcloud(City banks, for reference)
The Bank ofTokyo-Mitsubishi
UFJ,Ltd.
Sumitomo Mitsui
Banking Corporation.
Mizuho Bank,Ltd
ResonaBank,Limited.

Number of
Financial
Institutions
244

Deposits (JPY100
million)*1,002,298

3

35,9243
5

33,061
23,045

145

176,2014
14(47 membersof federationof agriculturaland credit
cooperatives)
14

6,012
178,509936,872

7
4
9
7
4
11
1
3
8
3
2

300,017
295,038
264,585
208,524
187,813
142,386
107,333
95,62280,101
76,10523,663-

1,245,909-

942,600-

935,283-

320,882459,500*1 Balances shown are current as of March 2015, not including those of Financial Institutions
planning to migrate to shared system centers. Figures for regional banks, second-tier regionalbanks, shinkin banks, and credit unions are based on deposit figures from Nikkin Kinyu
Techo, while those for agricultural cooperatives are from the JA Bank website.
Source: Prepared by FISC

73

74

Reference 9: Issues addressed by this Council and related measures
IssuesNecessity of HR
development

Advancement of use of shared systemcenters

Impropriates
occurring at
outsourcees
in recentyears

Amendmentsof Banking
Act etc.
Time issues upon an
incident

Measu

Risk management in outsourcing(IV. 3, p39)
Notes on staffing
plans(II. 3, p21)

Management
processes in
outsourcing(IV. 3 (1), p39)

Risk management
measures for
sub-subcontracting(IV. 4, p44)

IT governance(II, p12)

Risk-based approach(III, p24)

75

Risk management
measures specific toshared systemcenters(V, p47)