Security Procedures, Records, and Registers

Procedures explain how to perform work; records show what was done and the outcome. Registers maintain assets, owners, and status over time. This layer connects rules and standards with daily operation and audit evidence.

What a procedure needs

Section	Content
Purpose, scope, authority	Activities/systems covered; related rules and standards
People	Operator, approver, verifier, deputies
Trigger and prerequisites	Approval, permissions, tools, target identification, backup
Steps	Sequence, actions, inputs, checks at each stage
Completion	Results required before closing the task
Failure and emergency handling	Stop conditions, impact limitation, contacts, recovery/rollback
Evidence	Fields, location, retention, authorized viewers

Include checks against operating on the wrong target and decisions after failure, rather than screen instructions alone. Do not embed passwords, API keys, or other secrets directly in procedures.

Example account creation procedure

1. Compare the request with formal onboarding information; verify person, start date, and department.
2. Check information-owner approval, systems, permissions, and expiry. Stop and return incomplete approvals.
3. Create an individual ID with only approved access. Use separate review for privileged access where required.
4. Communicate enrollment through the approved channel, verify identity, and enroll MFA. Do not store credentials in the request record.
5. Confirm sign-in with the person, required functions, and absence of unnecessary privileges.
6. Record the operator, verifier, time, and results; notify completion.

For departures, check sessions, tokens, external sharing, keys, devices, and data handover as well as accounts. Separate disablement from deletion so required business records are not immediately destroyed.

Example initial response to a lost device

Stage	Owner and action	Evidence
Reporting	User contacts the designated channel; provide an alternative when the usual device is unavailable	Discovery time, location, device ID, known circumstances
Assessment	Responder checks stored information, encryption, connectivity, accounts	Impact assessment and rationale
Impact limitation	Authorized operator revokes sessions, applies remote locking, or performs other approved actions	Approval, execution, result
Evidence and notification	Investigator preserves logs; relevant legal functions check notification duties and deadlines	Preservation location, access history, notification decision
Recovery and improvement	Owner approves replacement and resumption; reviews causes and prevention	Recovery results, corrective owners and deadlines

Remote wiping may destroy evidence or unsaved data. Define conditions and approval in advance, including emergency authority and subsequent reporting. Exercise scenarios involving absence, out-of-hours response, and unavailable contacts.

Registers to establish first

Register	Main fields	Update triggers
Information and IT assets	ID, information/device/service, owner, classification, storage, users, suppliers	Introduction, change, disposal
Risks	ID, asset, threat/weakness, impact/likelihood, existing controls, residual risk, owner, treatment/deadline, acceptance approval	Assessment, incidents, significant changes, treatment completion
Exceptions	ID, requirement, reason, risk, compensating controls, applicant, approver, expiry, resolution/reassessment	Request, approval, expiry
Documents	ID, title, version, owner, approver, effective date, next review, related documents	Issue, revision, withdrawal
Approved services and suppliers	Service/supplier, purpose, information, responsibility allocation, assessment, contract, next review	Introduction, contract/use change, termination

Describe concrete scenarios in risk registers: “account takeover” as the threat, “MFA missing” as the weakness, and “customer information exposure” as the impact. “Security risk exists” does not help select treatment.

Example operational record

Record ID: AR-2026-001
Activity: Customer management service access review
Authority: Access Standard AC-02; Access Review Procedure version 3
Scope: 35 active users and 2 administrators
Date and operator: YYYY-MM-DD; Operator A
Verifier: Information Owner B
Result: Two unnecessary permissions identified, removed, and rechecked
Evidence: Controlled access-list location and removal request numbers
Open issue: One business confirmation pending; owner and deadline assigned
Retention and access: Follow the records management standard

Record scope, results, deficiencies, corrections, and verification, not just a completed checkbox. Maintain evidence links, storage locations, and permissions.

Protect the records themselves

Records may contain personal information, permissions, and system details. Define retention and its basis, access, protection against alteration, backup, and disposal for each type. Provide a way to suspend normal deletion for investigations or preservation instructions.

After changing a procedure, have the intended operator execute it in a test environment or exercise. Spreadsheets, tickets, and document systems are all possible formats, provided changes, access, and ownership can be traced.

References and related pages

• Creating, Approving, and Reviewing Documents
• IPA: Information Security Guidelines for SMEs — Asset register samples and incident-response guidance, in Japanese.