An information security policy (情報セキュリティポリシー) is a set of documents that brings together an organization's approach to protecting its information assets and the rules it must follow.
It is usually built in three layers: the basic policy (the information security basic policy) at the top, the control standards that turn it into concrete rules, and the implementation procedures that describe how work is done on the ground. Higher documents are more abstract, and each lower document is based on the one above it. Some definitions count only the basic policy and the control standards as the policy and leave the procedures out.
AnalogyIt resembles a country's legal system: the basic policy plays the role of the constitution, the control standards act as the laws beneath it, and the implementation procedures are the detailed regulations below those.
Exam points
ExamOrdered by level of detail, the layers run from the basic policy (基本方針) at the top, through the control standards (対策基準), to the most concrete implementation procedures (実施手順). Each lower document is drawn up on the basis of the one above.
ExamThe policy applies to everyone who works in the organization, including part-time and agency staff. Even when departments take different measures, there is a single basic policy for the whole organization.
The information security basic policy (情報セキュリティ方針) is the top document of the policy, in which top management sets out the organization's stance on information security and the direction it aims for.
In Japanese it is also called 情報セキュリティ基本方針, and under an ISMS (a system for managing information security continuously as an organization) it is established by top management. It is written to fit the company's own business and the information it handles, so copying another company's wording will not do.
AnalogyIt is like a school motto: it declares what the school values but says nothing about the timetable or the cleaning rota.
How to rememberThe 針 in 方針 is a compass needle. It points the way to go but does not tell you how to steer.
Exam points
ExamThe basic policy is a document that top management (トップマネジメント) establishes itself.
ExamThe basic policy is communicated to all employees and relevant outside parties, and it is also made public. It includes a commitment to review it as the business and technology change and to pursue continual improvement (継続的改善).
ExamThe basic policy states the broad direction: how the organization approaches information security and where it is heading. Specific procedures and settings are left to the lower documents.
Continual improvement (継続的改善) means not treating a management system as finished once it is built, but repeating the PDCA cycle of plan, do, check and act to make it a little better each time.
P Plan
D Do
C Check
A Act
A: Decide corrective actions for the problems found and carry them into the next P.
4 / 4
PDCA stands for Plan, Do, Check and Act, and the fixes decided in Act feed into the next Plan so the cycle keeps turning. An ISMS is built on this idea, with management at the top and the whole organization taking part. Each turn updates the measures to match new threats and changes in the business.
AnalogyIt is like a school sports team's practice matches: plan the tactics, play the game, review the video, adjust the training, and repeat every time.
Exam points
ExamRoutine operational work repeated according to the procedures set in the plan belongs to D.
ExamReviews and audits that measure and evaluate the results of operation are C, while deciding corrective actions from that evaluation and changing the way things are done is A.
ExamThe current ISMS standard expresses the PDCA-style flow as four stages, namely planning, operation, performance evaluation (パフォーマンス評価) and improvement, and internal audits (内部監査) take place under performance evaluation.
An information security incident (情報セキュリティインシデント) is an event that threatens information security (an information security event, 情報セキュリティ事象) and has been assessed as likely to harm the business or the security of information.
Detect and report
Assess and classify
Investigate and recover
Apply the lessons
Measures and procedures are revised based on the records of the cause and the response.
4 / 4
Typical examples include information leaks, malware infections, unauthorized access and service outages caused by failures. What is learned from the response goes into stronger measures so the same damage does not happen again.
AnalogyIt is like triage in an emergency room: each arriving patient is examined to judge how urgent the case is.
Exam points
ExamIf a device is suspected of a malware infection, first disconnect it from the network to stop the spread, then report to the administrator instead of removing the malware or reinstalling on your own.
ExamAn information security event (情報セキュリティ事象) does not automatically become an incident (インシデント) when it is reported; it is classified only after assessment.
ExamThe team that responds when a security breach occurs, so that the damage does not spread, is called a CSIRT.
Safety management measures (安全管理措置) are the steps a business takes under Japan's Act on the Protection of Personal Information to prevent leaks, loss and similar harm to personal data.
Category
Example measures
Organizational
Appoint a person in charge, set up the structure and draw up handling rules
Human
Train employees and have them sign confidentiality pledges
Physical
Control entry to rooms and keep papers and storage media locked away
Technical
Set access rights and encrypt communications and stored data
The guidelines typically sort them into four categories: organizational measures that set up structures and rules, human measures that train and supervise employees, physical measures that protect premises and media, and technical measures that protect data through system mechanisms. When the handling of personal data is outsourced, the outsourcing company must also supervise the contractor to make sure it is following the rules properly.
AnalogyThink of a bank's safe-deposit boxes: the contents are protected from four directions, namely the usage rules, staff training, the vault door and the PIN.
How to rememberRemember the four as who decides, who handles, where it is kept and what protects it: organizational, human, physical, technical.
Exam points
ExamTraining employees and making sure they know their roles and responsibilities in safety management are human safety management measures (人的安全管理措置).
Cyber insurance (サイバー保険) is insurance that pays out to cover the losses and response costs arising from cyberattacks or data leaks.
It is a way of sharing the financial burden with an insurer when a risk that remains after other measures actually materializes. If risk treatment is divided into avoidance, reduction, sharing and retention, it counts as risk sharing (also called risk transfer).
AnalogyIt works like car insurance: after an accident, the insurer's payout covers the repair bills and any compensation owed.
How to rememberInsurance moves the bill, not the hazard. The danger itself stays with you, and only the financial weight goes outside.
Exam points
ExamTaking out cyber insurance is an example of risk sharing (リスク共有), or transfer, in which the burden of losses is shared with an insurer.
Mix-upMeasures that reduce the likelihood or size of the damage itself are risk reduction (リスク低減), which is different from insurance, where an outside party bears the loss after the fact.
A privacy policy (プライバシーポリシー) is a document in which an organization sets out and publishes how it collects, uses and protects personal information.
In Japanese it is also called a personal information protection policy (個人情報保護方針), and it is posted on websites and elsewhere for users to read. It covers the purposes of use, how data is provided to third parties, and where to send inquiries and disclosure requests.
AnalogyIt is like the fine print on the back of a membership card application, explaining what the shop will use your details for and what it promises.
How to rememberPrivacy is the noun form of private. The policy is about what belongs to each individual, not about the company's own secrets.
Exam points
ExamA privacy policy (プライバシーポリシー) publicly states the organization's commitments on handling personal information, and it sits at a different level from the internal rules and manuals that employees follow.
Risk communication (リスクコミュニケーション) is the two-way exchange of information and perceptions about risk with stakeholders inside and outside the organization.
Executives, employees, customers and business partners each see risk differently, so views are exchanged to close the gaps in understanding. It takes place at every stage of risk management, from identifying risks to treating them.
AnalogyIt is like a neighborhood disaster-preparedness meeting: residents do not just listen to officials but also raise the dangerous spots and worries they know about.
How to rememberCommunication comes from the Latin communis, meaning common. Think of it as making risk something the stakeholders hold in common.
Exam points
Mix-upCommunicating a policy is the organization informing its stakeholders, whereas risk communication (リスクコミュニケーション) is two-way and takes in their views as well.
Key points
An information security policy has the basic policy at the top, made concrete in the control standards below it and then in the implementation procedures, with each lower document based on the one above.
The information security basic policy is established by top management, communicated to all employees and related parties, and revised as circumstances change.
In continual improvement, the corrections decided in A feed into the next P, keeping the PDCA cycle turning.
After an information security event is reported, it is assessed to decide whether it is handled as an information security incident.
Cyber insurance is a way of sharing the burden of losses with an outside party, that is, risk sharing (transfer).