6
A.6.1.2
A.6.1.2. Has isolation of conflicting duties and areas of responsibilities been implemented?
Conflicting duties and areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization 's assets.
--
isolation of duties has not been implemented.
Some departments have segregated conflicting duties and areas of responsibility related to sensitive information assets.
The organization has consistently segregated conflicting duties and areas of responsibility related to sensitive information assets but allocation of responsibilities to organizational roles have not been documented.
The organization has documented and implemented a RACI matrix to allocate responsibilities for information assets to organizational roles to segregate conflicting duties and areas of responsibility.
Audit trails for access to information assets are maintained and reviewed by management to reduce opportunity for unauthorized or unintentional modification or misuse of assets.
Access to the organizations information assets is monitored with automated tools for unauthorized or unintentional modification or misuse of assets and corrective action taken.
7
A.6.1.3
A.6.1.3. Does the organization maintain appropriate contacts with relevant authorities (Ex. police, government, social infrastructure company) when a trouble or incident occurs?
Appropriate contacts with relevant authorities should be maintained.
--
The organization does not maintain contacts with relevant authorities.
Some departments have identified responsible personnel and authorities to be contacted for reporting of information security incidents.
Departments across the organization have consistently identified responsible personnel and authorities to be contacted for reporting of information security incidents though procedures for contacting authorities has not been defined.
A.6.1.3 その機関が関係当局（警察、政府、社会基盤を支える会社）と適切に連絡を取り合っていたとしたら、いつ問題や事件が起こりうるのか。
適切に関連当局と連絡を取っていくことは肝要である。
--
その機関は関連当局に連絡を取り合うことをしていない。
いくつかの部門では安全に関わる出来事の内容についてはその責任を持つ個人及び当局に報告しなければならないことが定められている。
機関全体にまたがったそれぞれの部門間において、安全に関わる事件の内容を、責任のある個人及び当局に報告するように定められているにもかかわらず、当局に連絡する手順については明確になっていない。
Procedures are available that specify when and by whom authorities should be contacted and how identified information security incidents should be reported in a timely manner.
Maintenance of contacts with authorities for reporting of information security incidents is linked to business continuity and contingency planning processes and reviewed kept up to date.
Contacts with authorities are used to anticipate and prepare for upcoming changes in laws or regulations and policies of authorities which have to be implemented by the organization.
8
A.6.1.4
A.6.1.4. Does the organization maintain appropriate contacts with special interest groups or organization of specialists of information security for advice or information about security?
Appropriate contacts with special interest groups or other specialist security forums and professional associations should be maintained.
--
The organization does not maintain contacts with special interest groups.
Some departments have established contacts with special interest groups to improve knowledge about security best practices.
Departments across the organization have established contacts with relevant specialist security forums and professional associations though there is no recommended list of special interest groups in place.
The organization has established a recommended list of specialist security forums and professional associations that should be consulted for best practices early warnings of advisories information about new technologies etc.
Awareness for requirement for contacts with special interest groups is maintained and refreshed and the list of recommended special interest groups is reviewed and kept up to date.
Information sharing agreements are established with special interest groups to improve cooperation and coordination of security issues and identify requirements for the protection of confidential information.
9
A.6.1.5
A.6.1.5. Is information security integrated into the organization's project management methods?
Information security should be addressed in project management regardless of the type of the project.
--
Information security is not addressed in the organizations project management methods.
Some departments adopt information security best practices while delivering projects.
The organization consistently integrates specific information security measures based on perceived risks into project delivery methods though security requirements have not been standardized and documented.
An information security risk assessment is conducted at the early stage of the project to identify required security controls and information security responsibilities are defined and allocated to specified roles defined in the project management methods.
Information security implications are prioritized addressed and reviewed regularly in all projects.
Implementation of information security objectives is monitored in all projects. Automated tools are used where feasible.
情報セキュリティリスクアセスメントを定義し、プロジェクト管理方法で定義された指定したロールに割り当てられている必要なセキュリティコントロールや情報セキュリティに対する責任を識別するために、プロジェクトの初期段階で行われます。
情報セキュリティへの影響に対処し、すべてのプロジェクトで定期的に見直し優先順位付けされます。
情報セキュリティ対策方針の実装は、すべてのプロジェクトで監視されています。自動化ツールは、可能な場合に使用されています。
情報セキュリティリスク査定は、必要とされるセキュリティコントロールを特定するためにプロジェクトの早い段階で行われており、情報セキュリティ責務は決定され、プロジェクト管理方法で決定された特定の役割に分配されている。
情報セキュリティ予測に優先的に対応し、すべてのプロジェクトで定期的に見直されている。
情報セキュリティ対象物の遂行はすべてのプロジェクトで監視されている。自動ツールが実行可能な範囲で使用されている。
