Learn in the textbookGuidelines and Standards
DefinitionThe Information Security Measures Guidelines for Small and Medium Enterprises (中小企業の情報セキュリティ対策ガイドライン) are guidelines compiled by IPA so that small and medium enterprises with limited staff and budget can start measures without strain and expand them step by step.
ExplanationIt covers both what executives should do and the practical steps for advancing measures inside the company, moving in stages from measures you can take now through organization-wide efforts to a full-fledged structure. Relatedly, IPA runs SECURITY ACTION, a scheme in which SMEs declare on their own that they are working on security. There are two levels of declaration: one star for working on the five basics known as the "5 Information Security Rules" (情報セキュリティ5か条), and two stars for checking the current state with a self-assessment and setting and publishing a basic policy.
AnalogyIt is like strength training for beginners. You do not start with heavy equipment; you begin with light exercises you can do every day and add load once you are used to them.