Tell apart who reads each guiding document in this unit and what each one is meant to protect.
Explain the two core standards within the Information Security Management Standard and how it is used when organizations check their own efforts and in audits.
Distinguish whether a sector-specific document covers the whole supply chain, IoT devices, or card payments.
The Information Security Management Standard (情報セキュリティ管理基準) is a standard compiled by the Ministry of Economy, Trade and Industry (METI) as a yardstick for organizations that build and run an ISMS (information security management system).
Information Security Management Standard (two core parts)
Management-system standards: running the ISMS through PDCA
Control standards: the measures to implement
It follows the content of JIS Q 27001 and JIS Q 27002, and its core is the management-system standards (マネジメント基準), which set out how to run the ISMS through the PDCA cycle (repeating plan, do, check and act), and the control standards (管理策基準), which list the measures to implement (the 2025 revision also adds governance standards (ガバナンス基準) for establishing information security governance, making three parts in all). It is the reference point both when an organization checks its own efforts and when an information security audit (情報セキュリティ監査) judges whether things are adequate. Separately, under the ISMS conformity assessment scheme (ISMS 適合性評価制度), an external certification body examines whether an organization's ISMS meets the standard and certifies it.
AnalogyIt is like the list of items in a health checkup. Whether you review your own health or a doctor examines you, the same list serves as the yardstick.
How to rememberMETI also issues an Information Security Audit Standard (情報セキュリティ監査基準). The audit standard governs how auditors conduct themselves, while the Information Security Management Standard is the yardstick applied during the audit, so the two differ by role.
Exam points
ExamIn the ISMS PDCA cycle, acting on audit results with corrective actions (是正処置) and similar steps to make the system better belongs to the A (act, 改善) stage.
ExamUnder people-related controls (管理策), information security in line with the organization's policies and procedures is required of contractors as well as the company's own employees. In incident management (インシデント管理), the reporting point and the means of contact are fixed in advance so that anomalies can be reported at once.
ExamAn ISMS internal audit (内部監査) judges not only whether the ISMS conforms to the standard and to the requirements the organization set for itself, but also whether it is working effectively for the organization.
The Cybersecurity Management Guidelines (サイバーセキュリティ経営ガイドライン) are guidelines for executives, compiled by METI and IPA so that preparation against cyberattacks is pursued as a management issue.
3 principles
What executives are expected to do
Principle 1
Recognize risk as a management issue and lead the measures personally
Principle 2
Look beyond your own company to business partners and contractors
Principle 3
Share information with stakeholders starting in normal times
It consists of 3 principles that executives should keep in mind and 10 key items (重要 10 項目) they should instruct the people responsible for measures, such as the CISO (chief information security officer), to carry out. Spending on measures is treated as an investment in the future.
AnalogyIt is like a ship's sailing plan. The captain may hand steering and lookout to the crew, but decides where to head and which dangers to prepare for, and answers for those choices.
How to rememberThe word "management" (経営) in the middle of the name tells you who the reader is. Picture it as a document kept on the CEO's desk.
Exam points
ExamThe Cybersecurity Management Guidelines (サイバーセキュリティ経営ガイドライン) are guidelines, not a law, and are separate from the Basic Act on Cybersecurity (サイバーセキュリティ基本法), which is a law.
ExamUnder these guidelines, executives do not leave measures entirely to the CISO or the responsible department but drive them with their own leadership (リーダーシップ).
The Information Security Measures Guidelines for Small and Medium Enterprises (中小企業の情報セキュリティ対策ガイドライン) are guidelines compiled by IPA so that small and medium enterprises with limited staff and budget can start measures without strain and expand them step by step.
Start with what you can do
Start acting as an organization
Set up structure and rules, go full scale
Strengthen further
Repeat checks and reviews to move on to stronger measures.
4 / 4
It covers both what executives should do and the practical steps for advancing measures inside the company, moving in stages from measures you can take now through organization-wide efforts to a full-fledged structure. Relatedly, IPA runs SECURITY ACTION, a scheme in which SMEs declare on their own that they are working on security. There are two levels of declaration: one star for working on the five basics known as the "5 Information Security Rules" (情報セキュリティ5か条), and two stars for checking the current state with a self-assessment and setting and publishing a basic policy.
AnalogyIt is like strength training for beginners. You do not start with heavy equipment; you begin with light exercises you can do every day and add load once you are used to them.
Exam points
ExamSECURITY ACTION is a scheme in which SMEs declare on their own that they are working on measures; no outside body reviews and certifies them.
The Cyber/Physical Security Framework (サイバー・フィジカル・セキュリティ対策フレームワーク, CPSF) is a framework compiled by METI to secure the entire supply chain (the chain of companies from sourcing raw materials to delivering products) in an industrial society where online cyberspace and the real-world physical space are linked.
← Scroll the figure sideways →
It views industrial society in three layers: links between companies, links between physical space and cyberspace through things, and links of data within cyberspace. For each layer it sorts out what must be protected and the risks involved, and it presents an approach to measures that any industry can use.
AnalogyIt is like a safety plan for a railway network. Hazards are listed for each kind of link: through services between companies, the connection between tracks and the operating system, and the exchange of timetable data.
How to rememberCPSF stands for Cyber/Physical Security Framework. "Physical" means something you can touch, and refers to the real-world side such as factory machines and sensors.
The IoT Security Guidelines (IoTセキュリティガイドライン) are guidelines compiled by the Ministry of Internal Affairs and Communications (MIC), METI, and others for building, connecting, and using networked IoT devices and the systems that use them securely.
Policy
Analysis
Design
Build & connect
Operation & maintenance
Keep updating and monitoring after shipment to stay secure.
4 / 4
It sets out the measures to take at each of five stages along a device's lifecycle: policy, analysis, design, build and connect, and operation and maintenance. IoT devices carry particular risks (they stay in use for many years, users rarely keep an eye on them, and a hijacked device can harm real facilities and people), so measures must anticipate updates and management after shipment.
AnalogyIt is like an appliance maker's approach to product safety. Accidents are anticipated at the design stage, and the maker keeps looking after the product with inspections and repairs after it is sold.
How to rememberIoT stands for Internet of Things. Because things rather than people are connected, devices are easily left unattended without their owners noticing, and that is the starting point.
Exam points
Mix-upThe framework that views the whole supply chain (サプライチェーン) through three layers of links is the CPSF. The IoT Security Guidelines (IoTセキュリティガイドライン) focus specifically on IoT devices and their systems.
Cyber/Physical Security Framework (CPSF) vs. IoT Security Guidelines
PCI DSS is the card industry's security standard for protecting credit cardholder data, set by a body established by the international card brands.
It applies to merchants, payment service providers, and others that store, process, or transmit card information, with requirements such as network defense, protection of stored data, access restriction, and regular monitoring and testing. It is an industry standard rather than a law, but businesses are bound to comply through their contracts with card companies.
AnalogyIt is like vault rules agreed among banks. Every bank guards its vault with the same rules for door locks, entry logs, and regular inspections.
How to rememberPCI stands for Payment Card Industry and DSS for Data Security Standard. Spell out the abbreviation and the name itself tells you what it covers.
Exam points
ExamPCI DSS applies to businesses that hold card information, and its purpose is to protect cardholder data.
Mix-upPCI Express is spelled similarly, but it is an expansion interface standard for connecting devices inside a computer and has nothing to do with protecting card information.
The Information Security Management Standard is the yardstick for running and checking an ISMS, setting out how to work through PDCA and which controls to implement.
The Cybersecurity Management Guidelines set out the principles and instructions for executives to lead preparation against cyberattacks themselves.
The Information Security Measures Guidelines for Small and Medium Enterprises show how to expand step by step from the measures you can take now, and the related SECURITY ACTION is a scheme in which SMEs declare on their own that they are working on measures.
The CPSF is a framework that views industrial society through three layers of links to plan measures for the whole supply chain.
PCI DSS is an industry standard for protecting cardholder data, and businesses that handle card information comply with it.