Information Security Management Rules

Information security management rules define internal duties, accountability, and approval and reporting arrangements that implement the policy. Here, “rules” means formally approved requirements within the organization.

An effective provision identifies who does what, when, with whose approval, and with what evidence. Keep configuration details in standards and operating steps in procedures.

Example chapter structure

Chapter	Coverage	Supporting documents and records
1. General provisions	Purpose, scope, terms, higher-level authority, related rules	Policy, applicable requirements register
2. Accountability	Leadership, security lead, information owners, implementers, reviewers, reporting lines	Appointments, delegated authority, minutes
3. Assets and risks	Owners, classification, assessments, residual-risk approval	Asset/risk registers, treatment plan
4. Data and physical security	Storage, sharing, removal, retention, disposal, physical access	Handling standards, disposal records
5. Identity and access	Requests, approvals, least privilege, privileged access, transfers/leavers, reviews	Access standard, requests, review records
6. Endpoints and networks	Inventory, configuration, updates, remote work, personal devices	Endpoint standard, configuration register
7. Development, changes, vulnerabilities	Security by design, review, assessments, remediation, change approval	Development/change procedures, assessment and remediation records
8. Logging and monitoring	Events, protection, monitoring ownership, escalation	Logging standard, monitoring/investigation records
9. Suppliers and cloud	Selection, assessment, contracts, ongoing review, termination	Supplier assessments, approved services
10. Incidents and continuity	Reporting, command, containment, external communications, recovery, exercises	Response plan, continuity plan, restoration/exercise records
11. Education, review, audit	Scope, plans, correction, leadership reporting	Training, reviews, audits
12. Exceptions, violations, revisions	Exceptions, violation handling, review and approval	Exception register, revision and approval history

Reference existing privacy or continuity rules where appropriate, while defining responsibility boundaries.

Sample provisions

These illustrate selected clauses, not a complete rulebook covering every chapter. Adapt them to actual authority and activities.

Article 1 — Purpose and scope
These rules establish responsibilities and mandatory rules for managing
information assets under the Information Security Policy. They apply to directors
and employees. Supplier obligations are established through contracts or agreements.

Article 2 — Accountability
Leadership appoints a security lead and defines authority and reporting lines.
Department heads assign information owners and register them in the asset inventory.
The security lead promptly escalates significant risks and incidents to leadership.

Article 3 — Asset and risk management
Information owners establish classification and handling conditions under the
classification standard. Assess risks before introducing services or making
significant changes and determine treatments. Residual risk requires approval
by the authority designated in the organization's decision-making rules.

Article 4 — Access management
Information owners approve access grants and changes. IT implements approved access
and records requests, configuration, and verification. Information owners review
access at the interval in the access standard. HR notifies IT of transfers and
departures in time to meet implementation deadlines.

Article 5 — External services
Users obtain the required assessment before introducing external services for work.
The responsible department checks data handling, responsibility allocation,
incident communications, and data handling at termination.

Article 6 — Incident reporting
People report incidents or suspicions immediately to the designated contact,
even before the cause is confirmed, and do not delete or alter evidence.
The response owner assesses impact and urgency and follows the command arrangements.
External notification requirements, content, and deadlines are checked with legal
and other relevant functions; the designated authority makes the decision.

Article 7 — Exceptions
Requests identify the requirement, reason, risk, compensating controls, expiry,
and owner. A designated approver other than the applicant decides the request.
Resolve or reassess exceptions by expiry. Internal approval alone cannot waive
legal or contractual obligations.

Article 8 — Review and revision
Responsible functions review implementation and assign owners and deadlines for gaps.
The security lead reviews these rules periodically and after significant
changes, obtains the required approval, and communicates revisions.

Operating exception approval

If a legacy system cannot support MFA, identify the system, users, information, and potential harm. Assess restrictions on access sources, privileged access, and additional monitoring, and submit a migration plan with a deadline.

Exception approval manages temporary nonconformity with a standard. It is related to, but distinct from, accepting residual risk. Define when significant risk requires a separate leadership decision, even where an exception falls within a delegated approver’s authority.

Violations and reporting

For violations, establish facts, limit impact, analyze causes, and correct deficiencies. Any disciplinary action must align with existing employment rules, contracts, and applicable processes, rather than introducing automatic penalties through this document alone.

Separate incident reporting from judgments about responsibility so good-faith early reports are not discouraged. Procedures should specify contacts, out-of-hours routes, and deputies.

Drafting checks

Replace vague instructions with identifiable owners, approvals, and evidence.
Cover information from collection to disposal and services from introduction to termination.
Identify authoritative standards for numbers and deadlines, and procedures for execution.
Define exceptions, emergency authority, subsequent review, and leadership escalation.

IPA: Information Security Guidelines for SMEs — Appendix 5 provides related rules samples, in Japanese.
Creating, Approving, and Reviewing Documents