Learn in the textbookGuidelines and Standards
DefinitionThe Information Security Management Standard (情報セキュリティ管理基準) is a standard compiled by the Ministry of Economy, Trade and Industry (METI) as a yardstick for organizations that build and run an ISMS (information security management system).
ExplanationIt follows the content of JIS Q 27001 and JIS Q 27002, and its core is the management-system standards (マネジメント基準), which set out how to run the ISMS through the PDCA cycle (repeating plan, do, check and act), and the control standards (管理策基準), which list the measures to implement (the 2025 revision also adds governance standards (ガバナンス基準) for establishing information security governance, making three parts in all). It is the reference point both when an organization checks its own efforts and when an information security audit (情報セキュリティ監査) judges whether things are adequate. Separately, under the ISMS conformity assessment scheme (ISMS 適合性評価制度), an external certification body examines whether an organization's ISMS meets the standard and certifies it.
AnalogyIt is like the list of items in a health checkup. Whether you review your own health or a doctor examines you, the same list serves as the yardstick.
Memory hookMETI also issues an Information Security Audit Standard (情報セキュリティ監査基準). The audit standard governs how auditors conduct themselves, while the Information Security Management Standard is the yardstick applied during the audit, so the two differ by role.