2. Formulation of the Common Standards Group
The Common Standards Group is the collective term of the Common Model, the Common
Standards, this Guidance, and the Guidelines for Establishing Standards. The draft plans of
the Common Model, the Common Standards, and this Guidance were formulated by the NISC
and were decided by the Cybersecurity Strategic Headquarters after deliberating at the
Cybersecurity Measures Promotion Committee (decided by the Chief of the Cybersecurity
Strategic on February 10, 2015). The Guideline for Establishing Standards were decided by
the NISC after consulting with national administrative organs.
The NISC establishes the draft by paying attention to the following points considering the
occurrence of new threats and the result brought by regular inspection of the application status
at Agencies.
(1) The Common Model and the Common Standards contain information security measures
commonly necessary for all Agencies. The Common Model and the Common Standards
are formulated by considering the consistency with the international standards as well as
the actual situation of their role and responsibility, implementation organization, and
contents of measures so that Agencies are able to comply. The Common Standards
regulate matters that Agencies must observe for each item of the information security
measures (hereinafter referred to as “requirements”).
(2) The Guideline for Establishing Standards is to be established for the purpose of
illustrating the basic measures to be taken to satisfy the requirements of the Common
Standards (hereinafter referred to as “basic measures”) and explaining the ideas for the
formulation and implementation of measures by Agencies. The basic measures are
designed to observe the requirements. As such, Agencies must satisfy the corresponding
requirements by referring to the Guideline for Establishing Standards and take the
measures enumerated in the basic measures or measures that are equal to or greater than
these.
3.
Duties of the Competent Ministers and Others Regarding the Information Security Measures
of Incorporated Administrative Agencies and Designated Corporations
(1) Introduction and plan
The competent minister in charge of Incorporated Administrative Agencies includes an aim
of taking information security measures in mid-term objective of the item indicated by the