Information Security Guidelines

Security guidelines help people understand rules and make safe decisions in daily work. This category emphasizes recommendations and examples. When mandatory rules appear, label them and identify their authority.

External guidance or contractually specified guidelines may be binding. The document owner should determine applicability rather than assuming that the name means optional.

Suggested structure

Security Guideline for [Activity]
1. Purpose, audience, and activities covered
2. Related rules/standards and mandatory rules
3. Questions that support decisions
4. Recommended actions and actions to avoid
5. Cases and reasons for the decisions
6. Advice and incident-reporting contacts
7. Owner, version, review date, revision history

Link to approved services, classification rules, request channels, and reporting contacts in the actual document. Check that screen names and links remain current.

Email, chat, and file sharing

Type	Example	Authority or reason
Mandatory	Share confidential information only with recipients and through methods approved by the handling standard	External-sharing requirement
Recommended	Enter recipients after checking text and attachments; verify the address, not just the display name	Reduce misdirected messages
Recommended	Set an expiry for external sharing links where appropriate	Reduce lingering access
Mandatory	Report mistaken sending or publication to the designated contact, rather than only asking for deletion	Incident-reporting obligation

Case: a partner asks you to change a link to “anyone with the link.” Check classification and recipient identity. For confidential information, stay within the standard’s approved scope and discuss individual invitations or another approved method. Convenience alone is not sufficient reason to widen access.

Cloud services

Before use, check information types, account ownership, sharing, logs, backups, and data migration at exit. Personal free accounts and contracted organizational accounts may have different controls and conditions.

• Mandatory example: Obtain assessment and use approved services and accounts, as required by the external-service clause.
• Recommendation: Set permissions by purpose when creating folders to make reviews easier.
• Seek advice when: External collaborators increase, confidential data is added, or service regions or contractual conditions change.

Case: you want to add customer lists to an approved cloud service. Service approval does not necessarily approve every type of information or use. Check the approved scope and obtain additional assessment if needed.

Generative AI

Assess the contractual plan, input retention and use conditions, management settings, input data, and the business use of outputs, rather than relying on a service name alone.

Situation	Example decision or action
Summarizing public product information	Use an approved purpose and verify names and numbers against the original
Entering customer support histories	Check personal and confidential information conditions; do not input unapproved data and seek advice
Entering internal material after removing names	Check whether context, identifiers, or contract details reveal sensitive information or allow reidentification
Incorporating generated code into a product	Review it, test behavior and security, and assess relevant usage conditions

Avoid assuming that removing names makes input safe or that paying for a service permits all data. Put mandatory input restrictions in data or AI standards, and explain their rationale and application in guidelines.

Remote work and travel

• Mandatory example: Use approved devices and connection methods, and immediately report loss or suspected misuse, under endpoint and reporting rules.
• Recommendation: Consider sightlines and overheard conversation when choosing a location, lock the screen when stepping away, and minimize paper materials.
• Decision example: Move a confidential meeting away from a public area where others could hear it, or reschedule. Protecting the connection does not prevent overheard conversation.

Drafting checks

1. Label mandatory rules, recommendations, and examples; identify mandatory authority.
2. Specify what to check rather than merely saying “be careful.”
3. Explain when advice is necessary, alongside allowed and discouraged actions.
4. Use common workplace situations and explain the reasoning.
5. Do not silently introduce prohibitions absent from rules or standards.

References and related pages

• Comparing Document Types
• IPA: Information Security Guidelines for SMEs — Handbook and cloud/incident guidance, in Japanese.