1. Basic Policy for Information Security
To fulfill our mission to advance humankind by conducting research and educational activities appropriate for the highly information-orientated society of the 21st century, the University of Tokyo (´ºÓêÖ±²¥app) must not only maintain our information infrastructure but also ensure the security of our information assets. The Policy for Information Security stipulates the arrangements necessary to ensure information security, and consists of Basic Guidelines and Standards for Countermeasures. Furthermore, specific procedures are defined in order to ensure reliable implementation of the Policy for Information Security. These measures are intended to raise awareness of the importance of information security among all users affiliated with ´ºÓêÖ±²¥app, and ensure the security of all information assets owned by the University.
2. Objectives of the Basic Policy for Information Security
Users
Executives, full-time and part-time faculty and administrative members, students and research students (including those auditing classes), and persons with approval to access information assets owned by ´ºÓêÖ±²¥app (joint use users, visitors, outside contractors, etc.).
Assets
All information assets owned by ´ºÓêÖ±²¥app, including “information” and “information systems”. All media (magnetic, optical, paper, etc.) containing information are subject to this policy. This includes magnetic discs, flash drives, and handwritten notes. For the time being, test samples such as DNA samples are excluded. Information systems refer to any system that handles information. Examples include electronic systems as well as systems that handle printed materials, such as the internal mailing system. This policy is applicable to all university-owned information assets even if they are stored outside ´ºÓêÖ±²¥app.
´ºÓêÖ±²¥app’s Policy for Information Security has four main objectives:
- Thorough categorization and corresponding management of information assets owned by ´ºÓêÖ±²¥app based on their level of importance.
- Defense to prevent violations of information assets owned by ´ºÓêÖ±²¥app
- Prevention of damage to the information assets owned by ´ºÓêÖ±²¥app
- Implementation of early detection and prompt handling of security breaches at ´ºÓêÖ±²¥app
3. Basic Policy for Information Security
3.1. Organization and system
The Chief Information Security Officer (CISO) oversees the entire University. The CISO makes comprehensive decisions related to information security and is responsible for information security both within and outside ´ºÓêÖ±²¥app. The CISO not only determines information security measures but also has the authority to take steps necessary to enforce measures across the University, and can organize committees for this purpose at their discretion.
3.2. Formulation of Basic Policy for Information Security and enforcement procedures
Information security reviews are periodically conducted to assess the current state of information asset management. Risk analysis is then performed to create standards for countermeasures and implementation procedures. Finally, the Basic Policy for Information Security and implementation procedures are reassessed periodically.
3.3. Categorization and management of information
Information is categorized to determine the appropriate information management method.
3.4. Information security of information systems
Management methods are employed to maintain information security.
3.5. Clarification of information security requirements
Information security requirements are defined to prevent destruction of, damage to, tampering with, and use of information assets through unauthorized access, and to prevent interruptions and suspensions of services through unauthorized access from within or without the University.
3.6. Human factors in information security
In addition to establishing regulations, education and training are implemented to increase awareness of and compliance with the Basic Policy for Information Security.
3.7. Response to information security incidents
Protocols are established to handle information security incidents (incidents and malfunctions related to information security).
3.8. Measures for breaches in the Basic Policy for Information Security
Measures are established to process suspected or actual breaches in information security.
3.9. Public relations and information desk for inquiries and complaints
A system for public relations and an information desk for inquiries and complaints is created.
3.10. Self-checks and information security auditing
The processes for self-checks and information security auditing are determined.
3.11. Preventive security reviews
Measures are implemented for preventive security reviews.
3.12. Information security budget
A method for drawing up budget proposals for university-wide information security is established.
3.13. Exceptional cases
Measures to handle exceptional cases are established.
