IPA’s Six Essential Information Security Practices — A Starting Point for SMEs

Introduction

Even if you believe your company has “nothing worth stealing,” it almost certainly holds valuable information: customer and business-partner contact details, employee personal data, payroll records, contracts, quotations, product designs, transaction histories, email, and credentials for online services.

Cyberattacks and data breaches are not problems only for large corporations. Small and medium-sized enterprises (SMEs), which often have limited security staff and resources, may be targeted directly or used as a stepping stone into a larger business partner. Serious incidents can also result from equipment failure, human error, loss, or theft—not only from deliberate attacks.

Japan’s Innovation Platform Agency (IPA) therefore identifies the following “Six Essential Information Security Practices” as the basic measures SMEs and small businesses should take first:

1. Keep operating systems and software up to date.
2. Install and use anti-malware protection.
3. Strengthen passwords and authentication.
4. Review sharing and access settings.
5. Back up important data.
6. Learn about current threats and attack methods.

These practices are a starting point before more advanced security measures are introduced. They cannot prevent every incident, but they substantially reduce the risk of common compromises, data breaches, ransomware attacks, and data loss.

The English title and headings used in this article are explanatory translations. The official “情報セキュリティ6か条” source is published in Japanese.

What are these six practices for?

The goal is not simply to protect IT equipment. It is to protect information and systems so the business can continue operating while reducing the following management risks:

• Leakage of customer, employee, and business-partner information
• Fraudulent payments, impersonation, and account takeover
• Business interruption caused by ransomware or equipment failure
• Being used as a foothold for attacks against customers or business partners
• Financial losses such as recovery costs, investigation expenses, and compensation claims
• Loss of trust, customers, and business relationships
• Delayed detection and recovery when an incident occurs

Information security is not solely the responsibility of the IT team. Management must understand its importance, assign accountable owners, and ensure that every employee follows these practices as part of everyday work.

Relationship to SECURITY ACTION ★1 and the SCS Rating System

An organization that self-declares its commitment to these six practices may use ★1 (One Star), the first level of IPA’s SECURITY ACTION program. Because One Star is a declaration of the organization’s intention to begin implementing the practices, an application can be submitted before every measure has been completed. The organization must nevertheless create a plan and turn its declaration into real action.

Japan’s Cybersecurity Measures Evaluation System for Strengthening Supply Chains (SCS Rating System) indicates an organization’s security posture in stages represented by stars. Within this overall structure, ★1 and ★2 refer to the existing SECURITY ACTION program. A declaration to work on the six practices therefore corresponds to the entry-level ★1 (One Star) stage.

Important
SECURITY ACTION One Star is a self-declaration. It is not certification or assurance by IPA or an independent third party, and it does not guarantee an organization’s security or the quality of its products and services. It is also different from the expert review and third-party assessment used at higher SCS levels.

1. Keep operating systems and software up to date

Why this matters

Security weaknesses, known as vulnerabilities, are regularly discovered in operating systems, applications, routers, and other products. If an organization does not install the vendor’s security updates, those weaknesses remain exposed. Attackers actively search for unpatched systems and exploit publicly disclosed vulnerabilities.

Actions to take

• Enable automatic updates for Windows, macOS, iOS, Android, and other operating systems.
• Automatically update browsers, Microsoft 365, Adobe Acrobat Reader, Zoom, and other business applications.
• Update firmware for routers, VPN appliances, firewalls, NAS devices, multifunction printers, and security cameras.
• Keep content management systems such as WordPress, including themes and plug-ins, up to date.
• Maintain an inventory of computers, smartphones, servers, network devices, and business software.
• Record each product’s version, owner, purpose, and end-of-support date.
• Monitor alerts from IPA, JVN, and vendors, and prioritize patches for actively exploited or critical vulnerabilities.
• Assign an owner and a monthly review date for products that cannot update automatically.
• Take necessary backups and assess operational impact before applying major updates.
• After updating, verify that essential functions such as login, email, printing, and core business applications still work.
• Create a planned migration path for unsupported operating systems, software, and network equipment.
• Remove unused applications, browser extensions, services, and old accounts.
• If personal devices are permitted for work, define the minimum supported OS version.
• Restrict administrator privileges and use standard user accounts for routine work.

What may happen if this is not done

• Malware or ransomware exploits an unpatched vulnerability.
• Attackers remotely control computers or servers.
• Customer data, email, and authentication credentials are stolen.
• A website is defaced or used to distribute malware to visitors.
• An infected system is used to attack business partners.
• One outdated device becomes the entry point for a company-wide outage.
• Vendor support is unavailable during an incident because the product is no longer supported.

Checklist

• Automatic updates are enabled for operating systems and major applications.
• Routers, VPN appliances, NAS devices, and multifunction printers are included in update management.
• An asset inventory and end-of-support dates are maintained.
• An owner and review schedule have been assigned.

2. Install and use anti-malware protection

Why this matters

Malicious software can enter through email attachments, harmful links, fraudulent websites, USB devices, or exploitable vulnerabilities. Properly configured and continuously updated anti-malware software and built-in operating-system security features can detect and block known malware and suspicious behavior.

Actions to take

• Enable anti-malware protection on every business computer and server.
• Confirm that built-in protection, such as Microsoft Defender, has not been disabled.
• Automatically update malware definitions and detection engines.
• Enable real-time, web, email, and ransomware protection where available.
• Schedule automatic scans daily or weekly.
• Assign someone to review detection, quarantine, and update-failure alerts.
• Consider centrally managed protection that shows the status of every endpoint.
• Based on risk, consider endpoint detection and response (EDR) for monitoring suspicious activity and communications.
• Use email security features that inspect attachments and links.
• Disable Office macros by default and permit only those required for legitimate business purposes.
• Restrict USB storage and allow only company-managed devices when necessary.
• Establish a rule that employees must not ignore or bypass security warnings without approval.
• If infection is suspected, first isolate the device from the network and immediately notify the designated contact.
• Do not rely on anti-malware software alone; combine it with patching, strong authentication, backup, and employee education.

What may happen if this is not done

• Credentials, payment-card data, or confidential documents are stolen.
• Files are encrypted and a ransom is demanded.
• Attackers remotely operate a company computer.
• A compromised mailbox sends malicious messages to business partners.
• Keystrokes or screens are secretly monitored.
• Malware spreads from one endpoint to servers and other devices.
• The organization suffers fraudulent payments or invoice fraud.

Checklist

• Protection is enabled on every business endpoint.
• Definitions and detection engines update automatically.
• A designated person reviews security alerts.
• Employees know whom to contact and what to do if infection is suspected.

3. Strengthen passwords and authentication

Why this matters

Short and simple passwords are easy to guess or crack. Reusing a password exposed by one service allows attackers to take over other accounts. Organizations should not rely on passwords alone; multi-factor authentication (MFA) and passkeys provide stronger protection.

Actions to take

• Use at least 10 characters as a baseline and make passwords as long as practical.
• Avoid names, company names, phone numbers, birthdays, and simple dictionary words.
• Use combinations of uppercase and lowercase letters, numbers, and symbols when the service requires or supports them.
• Use a unique password for every service; never reuse passwords.
• Change default passwords on routers, multifunction printers, NAS devices, cameras, and other equipment.
• Do not store passwords on sticky notes, desk notes, or unprotected spreadsheets.
• Use an organization-approved password manager to generate and store long, unique passwords.
• Require MFA for email, cloud services, VPNs, internet banking, and administrator accounts.
• Prefer phishing-resistant passkeys or hardware security keys where supported.
• Use SMS verification when it is the only available option, but move to a stronger method when possible.
• Separate administrator accounts from ordinary work accounts.
• Issue individual accounts instead of sharing credentials so actions remain attributable.
• Configure account lockout or throttling and alerts for suspicious logins.
• Disable unnecessary accounts immediately when employees transfer, leave, or finish a contract.
• If a password may have been exposed, change it immediately and check every service where it was reused.
• Do not treat scheduled password changes as the only control; always change default, shared, or suspected-compromised credentials.

What may happen if this is not done

• Attackers access email or cloud storage without authorization.
• Customer data, contracts, quotations, and trade secrets are stolen.
• An attacker impersonates an employee and sends fraudulent payment instructions.
• Money is stolen through compromised internet banking.
• Social media or company websites are hijacked and used to damage the organization’s reputation.
• An administrator account is taken over and systems or backups are deleted.
• Password reuse causes one breach to spread across many services.

Checklist

• Password reuse is prohibited.
• MFA or passkeys are enabled for important services.
• All default passwords have been changed.
• Former employee and dormant accounts are disabled or deleted.
• The organization has defined how password managers should be used.

4. Review sharing and access settings

Why this matters

Misconfigured cloud storage, online meetings, NAS devices, multifunction printers, and security cameras can expose information to anyone with a link or make administrative interfaces reachable from the internet. Access, publication, and sharing rights should always be limited to what is necessary.

Actions to take

• Regularly review sharing in Google Drive, OneDrive, Dropbox, and similar services.
• Prohibit public access settings such as “Anyone on the internet” or “Anyone with the link” unless explicitly approved.
• Limit sharing to named individuals or approved groups.
• Grant only the required permissions for viewing, editing, downloading, and resharing.
• Set expiration dates and passcodes for shared links when available.
• Share personal and confidential information only with authenticated recipients, not through unrestricted links.
• Remove access when a project, employment, or supplier contract ends.
• Review all externally shared files and folders at least monthly.
• Do not expose management interfaces for NAS devices, printers, cameras, or routers directly to the internet.
• Disable unnecessary port forwarding, UPnP, guest access, and anonymous access.
• Grant folder and system permissions only to people with a legitimate business need.
• Minimize administrator privileges and do not grant them to ordinary users without necessity.
• Avoid shared computers; if sharing is unavoidable, create a separate account for each user.
• Disable file sharing on public Wi-Fi and use a trusted connection or VPN for sensitive work.
• Enable waiting rooms, meeting passwords, and participant verification for online meetings.
• Review default settings rather than assuming that cloud and web services are private by default.
• Enable audit logs so administrators can determine who changed a setting and when.

What may happen if this is not done

• Customer lists or employee data become publicly accessible.
• Competitors or unauthorized parties view quotations, contracts, or designs.
• Files are altered or deleted without authorization.
• Former employees or suppliers retain access to confidential information.
• Security-camera footage or documents stored in multifunction printers are exposed.
• An internet-facing management interface is used to penetrate the internal network.
• An outsider enters an online meeting and records or steals its contents.

Checklist

• All publicly accessible and externally shared information has been reviewed.
• Sharing and access rights are limited to the minimum necessary.
• Access for former employees and completed contracts has been removed.
• Management interfaces for NAS devices, printers, and cameras are not exposed directly to the internet.

5. Back up important data

Why this matters

Data can be lost through ransomware, hardware failure, mistakes, theft, natural disaster, or accidental deletion in a cloud service. Backup is not a measure that prevents an incident; it is what allows the business to resume operations after one.

Actions to take

• Identify the customer records, accounting data, contracts, design files, email, and system configurations required to continue the business.
• Define what is backed up, how often, where it is stored, and who is responsible.
• Automate daily or weekly backups according to the amount of data the business can afford to lose.
• Where practical, follow the 3-2-1 rule: keep three copies of data, on two different types of storage, with one copy off-site.
• Do not rely solely on backup storage that is permanently connected to a computer or server.
• Connect removable backup media only during backup and disconnect it afterward.
• For cloud backups, consider retention, deletion protection, versioning, and immutable storage.
• Avoid configurations in which the same production administrator account can delete every backup.
• Protect backup accounts with MFA.
• Encrypt backup data and secure the encryption keys and passwords.
• Store a copy at another location or with a trusted cloud provider to withstand fire, flood, and theft.
• Retain multiple historical versions so the business can return to a point before infection or accidental deletion.
• Assign someone to review backup success and failure notifications.
• Test restoration at least annually—and more often for critical systems.
• Preserve recovery procedures, contact details, licenses, and configuration information as well as the data itself.
• Define which services must be restored first and how quickly they need to return.
• Check exactly what a cloud provider backs up and for how long; create an independent backup when necessary.

What may happen if this is not done

• Ransomware encrypts both production data and continuously connected backups.
• Customer or accounting records are permanently lost after deletion or equipment failure.
• Orders, shipping, invoicing, and payroll cannot resume.
• Recovery takes weeks, causing lost revenue and customers.
• The organization feels pressured to pay a ransom in an attempt to recover data.
• Backups exist but are corrupt or cannot be restored.
• Records required by law or contract can no longer be produced.

Checklist

• Important data is backed up automatically and regularly.
• At least one backup is isolated from the production environment.
• Multiple versions are retained.
• Backup success and failure are monitored.
• Restoration has been tested successfully.

6. Learn about current threats and attack methods

Why this matters

Attackers impersonate business partners, executives, banks, delivery companies, and government agencies to trick people into opening attachments or visiting fraudulent websites. Generative AI also makes convincing text, voice, and image impersonation easier. Technology alone cannot completely stop attacks that target human judgment.

Actions to take

• Regularly review alerts from IPA, Japan’s National Cybersecurity Office (NCO), police, service providers, and industry associations.
• Assign someone to monitor relevant security information and distribute alerts internally.
• Provide security training when employees join and at least annually thereafter.
• Use practical examples to teach targeted email attacks, phishing, business email compromise, fake support scams, and ransomware.
• Check the sender’s full email address and domain, not only the displayed name.
• Do not immediately follow links in email or text messages; open the official app or use a saved bookmark instead.
• Treat unexpected attachments—especially executables, archives, and macro-enabled Office files—as suspicious.
• Never disclose passwords, MFA codes, private keys, or recovery codes by email or phone.
• Verify bank-detail changes, urgent transfers, and gift-card requests using a known phone number or another independent channel.
• Require approval by more than one person for unusual payments, even when the request appears to come from an executive.
• Be alert to QR-code phishing and verify the destination domain.
• Do not call numbers displayed in pop-up warnings or install remote-control software at a stranger’s request.
• Build a no-blame reporting culture so employees promptly report suspicious messages, accidental clicks, and credential entry.
• Create a one-page procedure stating what to report, to whom, and through which channel.
• Conduct phishing simulations or tabletop exercises and use the results to improve training.
• Define initial incident actions, including network isolation, evidence preservation, and internal notification.
• Keep emergency contacts for business partners, support providers, police, and IPA available offline.

What may happen if this is not done

• Employees enter credentials or MFA codes into a phishing site.
• Money is sent to an attacker after fraudulent invoice or bank-detail instructions.
• Malware enters the organization through an attachment.
• Staff follow instructions from someone impersonating an executive or business partner.
• A small warning sign is ignored and the incident spreads across the company or supply chain.
• Delayed discovery and reporting increase recovery cost, downtime, and the number of affected records.
• Fear of blame causes employees to conceal mistakes and prevents an effective response.

Checklist

• Someone is responsible for monitoring current security alerts.
• Every employee receives regular security education.
• Bank-detail changes and payment requests are verified through a separate channel.
• Employees know where to report suspicious messages and mistakes immediately.
• Initial incident procedures and emergency contacts are documented.

A practical first 30-day plan

Perfection is not required on day one. Assign owners and deadlines, then address the highest-risk issues first.

Week 1: Understand the current environment

• Management appoints an accountable executive and operational owner.
• Inventory computers, smartphones, servers, routers, NAS devices, and cloud services.
• Identify critical customer, personal, accounting, contract, and design data.
• Review former employee, dormant, and shared accounts.
• Establish an emergency contact and inform every employee.

Week 2: Make intrusion more difficult

• Update operating systems, applications, and network equipment.
• Create a migration plan for unsupported products.
• Confirm that anti-malware protection and automatic updates are active.
• Enable MFA for email, cloud services, VPNs, and administrator accounts.
• Eliminate default passwords and password reuse.

Week 3: Prepare for disclosure and data loss

• Review sharing and public-access settings for cloud services, NAS devices, and printers.
• Remove unnecessary external sharing and accounts.
• Configure automated backup of important data.
• Maintain at least one backup isolated from production.
• Restore at least one item to prove recovery works.

Week 4: Establish people and processes

• Deliver a short security briefing to all employees.
• Distribute reporting instructions for suspicious email, misdelivery, lost devices, and infection.
• Require independent verification and multiple approvals for bank-detail changes and high-value payments.
• Assign owners for monthly checks.
• Put unfinished measures into an action plan and have management review progress.

Monthly and annual checks

Every month

• Check for devices or software that have not been updated.
• Confirm that protection is active and alerts have not been ignored.
• Review accounts and permissions for new hires, transfers, and departures.
• Remove unnecessary external shares and public links.
• Confirm that backups completed successfully.
• Review major alerts from IPA and other trusted sources.

At least once a year

• Update the inventory of equipment, software, and cloud services.
• Review upcoming end-of-support dates, budgets, and migration plans.
• Test restoration of critical data.
• Train and exercise all employees.
• Review incident procedures and emergency contacts.
• Report implementation status to management and set the next improvement goals.

Conclusion

IPA’s Six Essential Information Security Practices are the basic controls that SMEs should establish first when people and budgets are limited.

Buying a security product is not enough. The organization must understand what it owns, configure protections correctly, assign responsibilities, monitor abnormalities, prove that recovery works, and keep improving.

Start with these six practices. Treat the One Star declaration as a beginning, not a destination, and turn it into sustained action that protects the business, its customers, its employees, and its partners.

References

• IPA: Declare SECURITY ACTION One Star / Six Essential Information Security Practices (Japanese)
• IPA: Six Essential Information Security Practices leaflet (PDF, Japanese)
• IPA: About SECURITY ACTION (Japanese)
• IPA: Information security awareness promotion initiatives for SMEs (English)
• IPA: Guidelines for Information Security Measures for SMEs (Japanese)
• IPA: Supply-chain Cybersecurity Rating System — SCS (Japanese)
• Ministry of Economy, Trade and Industry: Start Here with Security — SECURITY ACTION Self-Declaration (Japanese)
• JVN: Japan Vulnerability Notes
• NCO: Cybersecurity Portal for Everyone (Japanese)

This article is based on public information from IPA and Japan’s Ministry of Economy, Trade and Industry as of September 23, 2026. Programs and recommendations may change; consult the latest official sources before applying or making formal decisions.