Selection of Protection Measures

Treatment strategies (risk reduction, risk avoidance, risk transfer, risk acceptance, etc.) shall be established for identified risks, and accordingly appropriate information security and personal information protection measures for risk treatment shall be selected for each risk.

• It is common to establish a risk treatment strategy aiming to reduce the risk level, and depending on the situation, strategies of risk avoidance, risk transfer, and risk acceptance are considered.

  ※ Risk treatment strategies (examples)

  • Risk reduction : To reduce the risk of password theft, a password setting module is developed and applied so that the login password of the personal information processing system is forcibly set with a complexity of a combination of 3 types of characters and a length of 8 characters or more.
  • Risk avoidance : Because the risk associated with member management is high on the company's promotional internet homepage, it is changed so that member sign-up is not accepted, and all existing member information is destroyed.
  • Risk transfer : To reduce cost losses arising from damage compensation lawsuits, etc., in the event of leakage of important information and personal information, relevant insurance is taken out.
  • Risk acceptance : For large trustees such as PG (payment gateway) companies and identity verification agencies that the company cannot directly manage/supervise among partners such as those for maintenance and personal information processing trustees, if the trustee is subject to government supervision under the law or has obtained security certification from the government, separate management/supervision other than concluding documents under the Personal Information Protection Act may be omitted.

• When selecting protection measures, information security and personal information protection measures should consider linkage with the information security and personal information protection management system certification criteria.

• Where there are unavoidable reasons, a risk acceptance strategy may be chosen, but unconditional risk acceptance shall be avoided; a risk acceptance strategy should be chosen based on clear and objective grounds after sufficiently reviewing the appropriateness of the unavoidable reasons and the applicability of supplementary measures.

• Care shall be taken so that risks constituting legal violations are not included in acceptable risks.

• Among risks that do not exceed the acceptable risk level, protection measures should be considered for those where the risk level is highly likely to rise due to changes in the internal/external environment or for parts the organization judges to be important.

An implementation plan for protection measures, including items such as schedule, responsible department and personnel, and budget, shall be established in consideration of the priorities of the information security and personal information protection measures, and reported to management such as the Chief Information Security Officer and the Chief Privacy Officer.

• Priorities are determined in consideration of the severity and urgency of the risk, ease of implementation, budget allocation, availability of resources, and precedence/succession relationships.
• An information security and personal information protection measure implementation plan including items such as schedule, responsible department and personnel, and budget is established and reported to and approved by management.