User Authentication

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.5.3 User Authentication], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

When accessing information systems and personal information processing systems, access shall be controlled through secure user authentication procedures, such as user authentication, limits on the number of login attempts, and warnings for illegal login attempts.

• Examples of user authentication means

  Field	Authentication means	Remarks
  Knowledge based	Password	Apply secure password composition rules and consider change cycles Response needed against password theft, brute force attacks, etc. Upon system installation, the default accounts and passwords provided by products, etc. must be disabled or changed
  Possession based	Certificate (PKI)	Secure storage of the private key needed (storage on a secure security medium recommended)
  Possession based	OTP (One Time Password)	Various methods exist, such as OTP tokens and mobile OTP
  Possession based	Other	Smart card method Physical security token method, etc.
  Biometric based	Fingerprint, iris, face, etc.	Secure management of biometric recognition information needed ※ Reference: FIDO (Fast Identity Online)
  Other methods (can be applied as compensating controls for user authentication)	IP address	Method that restricts access with the relevant ID only from specific IP addresses
  Other methods (can be applied as compensating controls for user authentication)	MAC address	Method that, based on the terminal's MAC address, restricts access only from registered terminals
  Other methods (can be applied as compensating controls for user authentication)	Device serial number	Method that restricts access only from a specific PC or specific device (smartphone, etc.)
  Other methods (can be applied as compensating controls for user authentication)	Other	Method that restricts access based on location information, etc.

• Examples of controls against account theft and illegal authentication attempts

  Field	Description
  Limit on number of authentication failures	Restrict access when authentication fails more than a certain number of times ※ Standards for Measures to Ensure the Safety of Personal Information Article 5(6)
  Limit on connection duration	Automatically block the connection when no work is processed for more than a certain period after connecting (Session Timeout or Idle Timeout, etc.) ※ Standards for Measures to Ensure the Safety of Personal Information Article 6(4)
  Limit on concurrent connections	Connection blocking measures or notification functions when the same account connects concurrently, etc.
  Warning for illegal login attempts	Blocking and notification upon connection from unregistered IP addresses such as overseas IP addresses Text notification upon connection during weekends or nighttime Notification upon login with special privileges such as administrators, etc.

• When using Single Sign-On to provide work convenience, there is a possibility that damage may spread in the event of account theft, so additional protection measures such as applying reinforced authentication based on risk assessment and requiring re-authentication when accessing important systems shall be prepared.

When attempting to connect to a personal information processing system from outside via an information and communications network such as the internet, secure authentication means shall be applied in accordance with legal requirements. However, for a personal information processing system that processes the personal information of data subjects who are not users, secure connection means such as a virtual private network, or secure authentication means, may be applied.

• Applying secure authentication means refers to applying an additional authentication means beyond the procedure of identifying/authenticating whether one is a legitimate personal information handler by entering a user account and password into the personal information processing system.

• Examples of secure authentication means: certificate, security token, one time password (OTP), etc.

• When a personal information handler connects to a personal information processing system from outside via an information and communications network, compliance with the legal requirements regarding the application of authentication means is necessary.

  Target personal information processing system	Personal information processing system that processes the personal information of data subjects who are not users	Personal information processing system that processes the personal information of users
  Matters requiring application	Apply secure connection means or secure authentication means ※ Secure connection means: virtual private network (VPN), etc.	Apply secure authentication means

  [Reference] Application of secure authentication means upon external connection (Standards for Measures to Ensure the Safety of Personal Information Article 6(2))

  ② When a personal information handler attempts to connect to a personal information processing system from outside via an information and communications network, the personal information controller shall apply secure authentication means such as a certificate, security token, or one time password. However, for a personal information processing system that processes the personal information of data subjects who are not users, secure connection means such as a virtual private network, or secure authentication means, may be applied.