(3) Responding to audit results .............................................................................. 17
2.4
Review ..................................................................................................................... 18
2.4.1 Review of information Security measures ............................................................... 18
(1) Review of information security related provisions .......................................... 18
(2) Review of promotion plan of measures ........................................................... 18
Chapter 3 Information Handling ............................................................................................ 19
3.1
Information Handling............................................................................................... 19
3.1.1 Information handling ............................................................................................... 19
(1) Maintenance of provisions related to information handling ............................ 19
(2) Prohibition of use or handling of information for non-job related purposes .... 19
(3) Determination and labeling, etc. of classifications and handling restrictions
of information .................................................................................................. 19
(4) Use and storage of information ........................................................................ 20
(5) Provision and disclosure of information .......................................................... 20
(6) Transportation and transmission of information .............................................. 21
(7) Deletion of information .................................................................................... 21
(8) Backup of information ..................................................................................... 21
3.2
Information Handling Areas..................................................................................... 22
3.2.1 Information handling areas ...................................................................................... 22
(1) Determine the standards for measures for the areas requiring control
measures ........................................................................................................... 22
(2) Determine the measures to be implemented in each area ................................ 22
(3) Implementation of measures for the areas requiring control measures ............ 22
Chapter 4 Outsourcing ............................................................................................................ 23
4.1
Outsourcing .............................................................................................................. 23
4.1.1 Outsourcing .............................................................................................................. 23
(1) Maintenance/establishment of provisions related to outsourcing .................... 24
(2) Contracts related to outsourcing....................................................................... 24
(3) Implementation of measures by outsourcing parties ........................................ 25
(4) Information handling when outsourcing tasks ................................................. 25
4.1.2 Use of external services on general terms and conditions ....................................... 26
(1) Maintenance/establishment of provisions related to use of external services
on general terms and conditions....................................................................... 26
(2) Implementation of measures for use of external services on general terms
and conditions .................................................................................................. 26
4.1.3 Dissemination of information via social media services .......................................... 26
(1) Measures for dissemination of information via social media services ............. 27
4.1.4 Using cloud services ................................................................................................ 27
(1) Measures for using cloud services ................................................................... 28
Chapter 5 Lifecycle of Information Systems ......................................................................... 29
5.1
Maintenance of Documents and Inventories of Information Systems ..................... 29
5.1.1 Maintenance of documents and inventories of information systems ....................... 29
(1) Maintenance of information system inventories .............................................. 29
(2) Maintenance of documents related to information systems ............................. 29
5.1.2 Establishment/maintenance of provisions related to procurement of equipment,
etc. ............................................................................................................................ 29
(1) Maintenance of provisions related to procurement of equipment, etc. ............ 30
5.2
Measures at Each Phase of Information System Lifecycle ...................................... 30
5.2.1 Planning and definition of requirements for information systems ........................... 30
(1) Ensuring the implementation of frameworks ................................................... 30
(2) Formulation of security requirements for information systems ....................... 31
(3) Measures when outsourcing construction of information systems .................. 31
Table of Contents - 2