Information System Protection
Certification criterion
Information systems shall be placed in consideration of their importance and characteristics so as to reduce environmental threats, hazards, and the possibility of unauthorized access, and communication and power cables shall be protected from damage.
Key checkpoints
- Are placement locations separated in consideration of the importance, purpose, and characteristics of information systems?
- Is a means in place to readily verify the actual physical location of information systems?
- Are power and communication cables safely protected from external physical damage and electrical influence?
Detailed explanation
※ This item is a relaxed certification criterion (Annex 7-2) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.4.3 Information System Protection], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).
Placement locations shall be separated in consideration of the importance, purpose, and characteristics of information systems.
- Depending on the characteristics of information systems, such as information systems, personal information processing systems, network equipment, security systems, and backup equipment, protect the systems from the outside by using server racks
- For cases of high importance, such as personal information processing systems, install locking devices on server racks so that only a minimal number of personnel can access them, and manage them in a cage or similar with separate physical safeguards
A means to readily verify the actual physical location of information systems (layout diagrams, asset inventories, etc.) shall be prepared.
- Manage physical layout diagrams (facility cross-sections, layout diagrams, etc.) and asset inventories for prompt action in the event of a security incident or failure
- Include a physical location field in asset inventories and keep them current so that the latest version is maintained
Power and communication cables shall be safely protected from physical damage and electrical influence.
- Take measures such as physical separation/wiring, identification marking, maintaining distance to avoid mutual interference, and burying cables
- Apply access control so that only a minimal number of authorized personnel can access distribution boards, high-voltage rooms, low-voltage rooms, etc.
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Information processing facility drawings
- Information system layout diagram
- Asset inventory
Nonconformity examples
- A case where the system layout diagram is not updated to reflect the latest changes, so an information system where a failure has occurred cannot be identified promptly
- A case where many cables on the server room floor or in racks are not organized and are tangled together, raising concern about failures due to electrical interference, damage, water leakage, carelessness, etc