Employees are informed of what
constitutes a security incident, and
contacts for incidents are documented
(e.g., in a manual or emergency contact list)

Contact information is regularly
reviewed for changes

◯ Established and regularly reviewed

Written agreements are obtained
when employees join and leave

The company has a template
based on its work rules or
similar regulations

◯ Operational rules and templates prepared,
consent obtained

1. Websites of public institutions (e.g., IPA) are checked regularly, such as at least once a week
2. And the information is shared with all employees regularly, such as at least once a week, via morning meetings, email, chat, etc.

1. Websites of public institutions (e.g., IPA) are checked irregularly, without a set frequency
2. Or information is shared with all employees irregularly, without a set frequency, via morning meetings, email, chat, etc.
    

✕ Not collected or shared

1. Actual infection cases are shared with employees as a warning
2. And employees are warned about specific ways to identify suspicious emails, such as checking the sender's address

◯ Warning others

External subcontractors are used

1. Reporting rules are documented in the service contracts or similar agreements with all vendors
2. And emergency contacts for all vendors are documented and easily accessible

1. Reporting rules are documented in the service contracts or similar agreements with some vendors
2. Or emergency contacts for some vendors are documented and easily accessible

✕ Not required

Entries and exits are always recorded,
and the office is always locked
when unattended

Both entry/exit recording and locking
when unattended are defined as rules

◯ Rules established and implemented

Your company's important information
and the media where it is stored
(e.g., USB drives) have been identified

A clear desk practice is followed
when leaving the office

A clear desk practice when leaving
the office is defined as a rule

◯ Rules established and implemented

Both paper and electronic media
are disposed of or erased using
unrecoverable methods (e.g., shredding,
dissolution, physical destruction)

Disposal/erasure procedures for both
paper and electronic media (e.g., shredding,
dissolution, physical destruction)
are documented as rules

◯ Disposal method defined,
disposed unrecoverably

You hold information entrusted
to you by your client

1. Multiple generations of backups are taken regularly and retained
2. And backed-up data is regularly checked to confirm it opens without errors

1. Backups are taken, but irregularly, or only one generation is retained
2. Or backed-up data is checked irregularly to confirm it opens without errors

✕ No backups

1. Antivirus software is installed on all devices managed by your company
2. And automatic updates are enabled on all devices

◯ Installed

1. Automatic OS updates are enabled on all devices
2. And browsers and business software are regularly updated to the latest versions using check tools, etc.
3. And it is regularly confirmed that no unsupported OS or software remains

1. The OS and software are updated, but manually or irregularly rather than automatically
2. Or the update status of browsers and business software is tracked by some means
3. Or unsupported OS and software are checked for, but some still remain

✕ Not updated

1. Specific rules on password length and character types are documented
2. And the use of biometric or multi-factor authentication is defined as an organizational rule and communicated
3. And the above has been communicated to all employees or covered in their training

1. General warnings such as "avoid easy-to-guess passwords" are given, but no specific criteria such as length are defined
2. Or the use of biometric or other non-password authentication is left to individual discretion

✕ Not implemented

1. Access permission management based on the importance of information is defined as a rule, and permissions are configured accordingly
2. And access permissions are reviewed upon transfers or departures and on a regular basis

1. Access to information and folders is restricted, but there are no unified organizational rules for access permissions
2. Or access permissions are not reviewed upon transfers or departures or on a regular basis
    

✕ Not configured

Access to suspicious or non-business
sites is restricted by technical
measures such as filtering

Rules such as prohibiting access to
suspicious sites, restricting social media
posts, and prohibiting uploads are
documented and communicated

◯ Restricted by rules or technical measures
(e.g., filtering, use of proxy services)