Information Asset Identification

Information asset classification criteria shall be established, and all assets within the scope of the information security and personal information protection management system shall be identified and managed as an inventory.

• Establish information asset classification criteria suited to the organization's characteristics, and identify all information assets without omission according to the classification criteria

  ※ Information asset classification (example)

  • Classification by asset type: servers, data (DBMS), information systems (application programs), software, network equipment, security systems, PCs, information, facilities, physical premises, etc.
  • Items by asset type (examples)
    • Server: host name, asset serial number, model name, purpose, IP address, managing department name, operational manager, responsible manager, security grade, etc.
    • Data: database name, table name, (personal) information item names (e.g., name, gender, date of birth, mobile phone number, email, etc.), managing department name, operational manager, responsible manager, storage system (host name), storage location (IP address), security grade, etc.
    • Information system: hardware and software necessary for the collection, processing, storage, retrieval, and transmission/reception of information, such as servers, terminals (e.g., PCs), auxiliary storage media, network equipment, and application programs
    • Security system: systems built to prevent the damage, alteration, or leakage of information, including firewalls, intrusion detection systems, intrusion prevention systems, and personal information leakage prevention systems
    • Information: includes both documentary information and electronic information (important information, personal information, etc.)

• Verify asset information such as asset name, purpose, location, responsible manager and operator, and managing department, and prepare an inventory

• For efficient management of information assets, use an asset management system or manage the assets in various forms such as documents (spreadsheets)

• When using cloud services, prepare classification criteria that reflect the characteristics of cloud services (for example, virtual servers, object storage, etc.), and identify/manage cloud assets accordingly

For the identified information assets, importance shall be determined and a security grade assigned by considering legal requirements and the impact on business operations, among other factors.

• Determine security grade evaluation criteria suited to each asset's characteristics, such as legal requirements and the impact on business operations

  ※ Security grade assessment criteria (example)

  • Evaluate importance according to confidentiality, integrity, availability, legal compliance, etc.
  • Also consider service impact, loss of profit, loss of customers, damage to external image, etc.

• Assess the security grade for each information asset according to the security grade evaluation criteria and manage it as an inventory

The status of information assets shall be surveyed periodically to keep the information asset inventory up to date.

• Establish procedures so that the status of newly introduced, changed, and disposed assets can be verified

• Perform periodic surveys of the information asset status and keep the information asset inventory up to date