User Account Management

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.5.1 User Account Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

In order to control unauthorized access to information systems, personal information, and important information, formal procedures for registering/changing/deleting/terminating user accounts and access rights shall be established and implemented with the following matters in mind.

• Issuing a unique user account for each user and personal information handler, and prohibiting sharing
• Reviewing appropriateness through an approval procedure, etc., when issuing accounts and granting/changing access rights for users and personal information handlers
• Changing or revoking access rights without delay (including account deletion or deactivation) when a personnel change such as a transfer or resignation occurs
• After installing an information system, removing default accounts and test accounts of the manufacturer or vendor, or changing them to accounts that are hard to guess
• Maintaining/managing records related to the registration/change/deletion/termination of user accounts and access rights, etc.

When creating/registering/changing user accounts and access rights that can access information systems, personal information, and important information, only the minimum rights necessary for work shall be granted in accordance with a job-based access-rights classification scheme.

• Access rights to information systems and personal information processing systems shall be granted differentially to work personnel within the minimum scope according to the purpose of performing the work
• Access rights to important information and personal information shall be granted only within the scope strictly necessary for work, in accordance with the principles of need-to-know and need-to-do
• Rights shall be subdivided so that unnecessary or excessive access to important information or personal information is not possible
• Appropriateness shall be reviewed through an approval procedure, etc., when granting or changing rights

When granting an account and access rights to a user, the user shall be clearly made aware that the security responsibility for the account belongs to them.

• Specifying the responsibilities and obligations for the account in the information security and personal information protection policy, pledges, etc. (prohibiting the sharing or lending of one's account and password to others, precautions when logging in in public places, etc.)
• Using various methods such as pledges, email, system notices, and training