Safety Measures for Disaster/Emergency Preparedness

IT disaster types that may threaten the continuity of the organization's core services (business) shall be identified, and by analyzing the scale of damage and impact on business by type, core IT services (business) and systems shall be identified.

• Identify IT disaster types that may threaten the continuity of the organization's core services (business), such as natural disasters, hacking, and communication failures

  ※ IT disaster types that may cause IT service interruption (examples)

  • Natural disasters : fire, flood, earthquake, typhoon, etc.
  • External factors : hacking, communication failure, power outage, etc.
  • Internal factors : system defects, mechanical errors, user mistakes, intentional/malicious operation, departure of key operators (death, sick leave, vacation, job change, etc.), configuration errors, etc.

• Identify core IT services and systems by analyzing the scale of damage and impact when the organization's core services (business) are interrupted for each disaster type, considering the following

  • Financial aspects such as reduced sales and payment of contract penalties
  • Legal aspects such as damage compensation lawsuits
  • Qualitative aspects such as decline in external image and damage to competitiveness

Recovery time objectives and recovery point objectives shall be defined according to the importance and characteristics of core IT services and systems.

• Define the recovery time objective (RTO : Recovery Time Objective), which is the time from the point of IT service and system interruption until recovery and return to normal operation, and the recovery point objective (RPO : Recovery Point Objective), which is the point in time to which data must be recovered

Disaster recovery plans, including recovery strategies and measures, an emergency recovery organization, an emergency contact system, and recovery procedures, shall be established and implemented so that the continuity of core services and systems can be ensured even when a disaster/emergency occurs.

• Establish cost-effective recovery strategies and measures so that the recovery time objectives and recovery point objectives of services and systems defined in advance can be achieved when an IT disaster occurs

• Establish an IT disaster recovery framework including the following so that rapid recovery is possible when an IT disaster occurs

  • Define the recovery organization and roles in the event of a disaster : assign roles and responsibilities to relevant departments and personnel for recovery when an IT disaster occurs
  • Emergency contact system : establish a contact system within the recovery organization, including personnel of relevant departments within the organization and maintenance vendors
  • Methodology for establishing recovery strategies and measures : business impact analysis, definition of recovery time objectives and recovery point objectives, identification of core IT services and systems, etc.
  • Define recovery sequence : define the recovery sequence of information systems by recovery time objective
  • Recovery procedures : include the stages of disaster occurrence, recovery completion, and follow-up management

• In the case of a personal information controller, when a disaster/emergency such as fire, flood, or power outage occurs, response procedures such as a crisis response manual to protect the personal information processing system shall be prepared and inspected regularly (Article 11 of the Standards for Measures to Ensure the Safety of Personal Information)

  ※ Crisis response manual and backup/recovery plan for the personal information processing system (examples)

  • Components of the personal information processing system (amount of personal information held, type/importance, system-linked equipment/facilities, etc.)
  • Ripple effects (personal information leakage, loss, damage, etc.) due to disaster/emergency and initial response measures
  • Backup and recovery priorities, recovery point objectives, and recovery time objectives of the personal information processing system
  • Backup and recovery measures for the personal information processing system (establishment of a recovery center, conclusion of a backup contract, emergency operation, etc.)
  • Division of work, responsibilities, and roles
  • Regular inspection, post-incident handling, and continuous management for incidents that may actually occur, etc.