JIS X 5080:2002

Foreword0 Introduction 0.1 General 0.2 Basic items and positioning of this Standard1 Scope2 Terms and definitions3 Security policy 3.1 Information security policy4 Organizational security 4.1 Information security infrastructure 4.2 Security of third party access 4.3 Outsourcing5 Asset classification and control 5.1 Accountability for assets 5.2 Information classification6 Personnel security 6.1 Security in job definition and resourcing 6.2 User training 6.3 Responding to security incidents and malfunctions7 Physical and environmental security 7.1 Secure areas 7.2 Equipment security 7.3 General controls8 Communications and operations management 8.1 Operating procedures and responsibilities 8.2 System planning and acceptance 8.3 Protection against malicious software 8.4 Housekeeping 8.5 Network management 8.6 Media handling and security 8.7 Exchanges of information and software9 Access control 9.1 Business requirement for access control 9.2 User access management 9.3 User responsibilities 9.4 Network access control 9.5 Operating system access control 9.6 Application access control 9.7 Monitoring system access and use 9.8 Mobile computing and teleworking10 Systems development and maintenance 10.1 Security requirements of systems 10.2 Security in application systems 10.3 Cryptographic controls 10.4 Security of system files 10.5 Security in development and support processes11 Business continuity management 11.1 Aspects of business continuity management12 Compliance 12.1 Compliance with legal requirements 12.2 Reviews of security policy and technical compliance 12.3 System audit controls

This Standard gives recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization, It is intended to provide a common basis for developing organizational security standards and effective security management practice and to provide confidence in inter-organizational dealings. Recommendations from this standard should be selected and used in accordance with applicable laws and regulations.

2002 [20/02/2002]