A Practical Guide to IPA’s Information Security Guidelines for SMEs

Start with leadership, assign an owner, protect the basics, and expand controls according to business risk. That is the working idea behind the Information Security Guidelines for SMEs published by Japan’s Information-technology Promotion Agency (IPA). They help small and medium-sized businesses protect valuable information against disclosure, alteration and loss, and reduce disruption to operations. This article is based on version 4.0, released on March 27, 2026.[1][2]

The guideline covers business IT and information assets across industries, including very small businesses. Its stated scope excludes factory equipment and industrial control systems; organizations with those systems need additional, specialized guidance. Part 1 is for management, Part 2 offers four implementation steps, and eight appendices provide templates and practical guides.[1][2]

This is an independent, practical adaptation of the Japanese version 4.0, not an official IPA translation. The actions, suggested schedules and evidence examples below turn its approach into a usable plan. Check the privacy, reporting, industry and contractual requirements that apply in your country; Japanese schemes mentioned here do not automatically apply elsewhere.

The four steps at a glance

Step	What the IPA guideline calls for	What your organization can do
1	Minimum basic controls for every business	Put the six basic security measures into daily use.
2	Identify weaknesses and manage basic controls as an organization	Approve a security policy, complete the 25-question self-assessment and assign improvements.
3	Strengthen organization and technical defenses	Formalize ownership, asset and access management, defensive controls, suppliers and incident response.
4	Apply stronger, broader controls based on risk	Analyze critical business processes and information, then strengthen controls and test their effectiveness.

IPA allows organizations to select their target step in light of their circumstances and resources. The third column is a practical interpretation, not a separate certification checklist.[2]

What the owner or chief executive must do

The guideline’s three management principles are to lead security work personally, consider the security of outsourced work, and communicate regularly with stakeholders. It then sets out seven areas of management action. In practical terms:[2]

1. Identify the operations and information whose loss, exposure or unavailability would seriously harm the business. Approve a short security policy.
2. Name a security owner, a backup contact and operational staff. Allocate money and external expertise where needed.
3. Review current controls. Assign each improvement an owner, priority, due date and proof of completion.
4. Review progress and exceptions periodically; change the plan when the business or threats change.
5. Establish decision makers, emergency contacts and recovery procedures before an incident, and practice them.
6. Define security responsibilities in supplier contracts and cloud services, including access, incident notification and return or deletion of data.
7. Keep informed about relevant threats, vulnerabilities and customer requirements.

Put these decisions in writing. A policy without an owner, a budget and an improvement process is unlikely to change how work is done.

Step 1: put the six basic measures into practice

The following six headings follow the Japanese guideline. The implementation suggestions include additional examples suitable for many countries.[2]

Measure	Practical actions	If neglected
Keep operating systems and software updated	Inventory laptops, phones, servers, routers, website software and plugins. Turn on supported automatic updates, prioritize serious flaws and replace unsupported products.	Known vulnerabilities can be used to gain access.
Use anti-malware protection	Enable suitable protection on work devices, keep it updated and review alerts. Make sure protection cannot be silently disabled.	Credential theft or ransomware may go undetected.
Strengthen passwords	Use long, unique passwords and a password manager. Enable multifactor authentication (MFA) for email, cloud and administrator accounts. Avoid shared logins.	A leaked password can give an attacker access to several systems.
Review sharing settings	Check cloud links, file shares, NAS devices, printers and meeting tools. Restrict access to people who need it and remove old external and former employee accounts.	Confidential files may become visible to outsiders.
Back up important information	Decide what to back up, how often, where copies are kept, who checks them and how long they are retained. Separate at least one copy from the affected production environment and test a restore.	A deletion, failure or ransomware attack can stop operations.
Learn how attacks work	Teach staff to recognize impersonation, fake sign-in pages, malicious attachments and requests to change payment details. Make reporting easy and prompt.	One deceptive message can lead to theft or business disruption.

A backup is useful only if it can be restored. Include configurations and essential service data, keep multiple recoverable versions and record the result of a real restoration exercise. MFA, password managers and separated backups are implementation examples, not the names of three additional IPA rules.[2]

Step 2: make security a shared business process

Write and approve a concise policy. State what the organization protects, to whom the policy applies, who is responsible, how staff report incidents, and that applicable laws and contracts will be followed. Communicate it to staff. Adapt IPA’s one-page sample rather than publishing an untouched template.[1][2]

Run the 25-question self-assessment. IPA’s five-minute questionnaire covers updates, anti-malware protection, passwords, sharing, backups, email, wireless networks, removable media and other everyday controls. Have a knowledgeable person complete it; where offices or teams differ, assess them separately. Treat “unknown” answers as issues to investigate.[1][2]

Turn gaps into assigned work. For each issue record the risk, action, owner, deadline and evidence. Create short employee instructions for routine tasks such as sharing files, handling sensitive data and reporting suspicious activity. Review open items regularly and repeat the assessment after significant changes. IPA supplies an employee handbook template and sample rules.[1]

Steps 3 and 4: build protection around business risk

The tasks below translate the guideline’s organizational controls, technical defenses and risk analysis into concrete work. Prioritize what would cause the greatest harm to customers and operations.[2]

Know what you have and who can access it

• Inventory customer and employee data, contracts, payment information, essential records, devices, servers, SaaS services and suppliers. Record each asset’s owner, location, users and retention period.
• Ask for each important process: What happens if its information is leaked, altered or unavailable? Include personal cloud storage and forgotten public sharing links in the review.
• Give access only to people who need it. Approve new access, remove it promptly when someone changes role or leaves, and review privileged accounts separately.

Protect devices, networks, websites and cloud services

• Track missing security updates and disabled protection. Remove unnecessary software, exposed services and public administration interfaces.
• Encrypt work devices where appropriate, configure screen locks and secure Wi-Fi, change default device passwords and protect remote access.
• Require MFA for important services and administrative users. Review sign-in alerts, administrator activity and third-party app connections.
• Patch websites, content management systems and plugins; secure administrative interfaces. Seek specialist help for critical customer-facing and payment systems.
• Separate backup access from production access, retain multiple versions and measure how long it takes to restore actual files and configurations.

Include people and suppliers

• Use joiner, role-change and leaver checklists. Document how information may be sent, taken off site, stored and destroyed. Train new staff and refresh training periodically.
• Ask suppliers and cloud providers who can access your data, what controls they operate, how quickly they report an incident, how recovery works and what happens to data when the contract ends. Record your own responsibilities too.
• Reassess risk after a new system, major customer demand, serious vulnerability or incident. Report unresolved risks to management and record who accepted or funded the response.

Prepare a usable incident procedure

1. Report and contain. Staff should immediately report suspicious logins, infected devices or misdirected data. The response owner decides how to disconnect affected systems or revoke access. Preserve logs and other evidence; do not erase or rebuild systems on impulse.
2. Establish the facts. Record when the issue was found, which accounts and services may be affected, which data is involved and what actions have been taken. Call a specialist when the scope is unclear.
3. Decide who must be informed. Check local law, contracts and the type of affected data to determine whether customers, regulators, insurers, providers or business partners must be notified. Separate confirmed facts from open questions.
4. Recover and learn. Close the entry point, replace compromised credentials, restore from verified backups and monitor for recurrence. Update controls and the response plan.

Keep emergency contacts, backup locations and a manual alternative for essential work somewhere accessible if your main systems are down. Test the plan with a tabletop exercise. IPA provides an incident response appendix.[1][2]

A workable starting schedule

Suggested timing	Actions and evidence
First week	Management appoints an owner. Inventory essential processes, services, administrator accounts and data. Review all six basic measures and quickly resolve critical exposure, unpatched systems and missing backups.
By about day 30	Approve a policy; complete the 25-question assessment; enable MFA for key accounts; review access and perform a real data restore. Assign every remaining issue.
By about day 90	Review suppliers and contract responsibilities; train staff; rehearse an incident; test recovery; report results and remaining risks to management.
Ongoing	Monitor updates, protection alerts and backup success; revisit access and public sharing; repeat the assessment when operations change.

These dates are suggested planning intervals, not IPA deadlines. Address serious risks as soon as they are discovered.

Keep evidence that the controls work

• Approved policy, named security owner and emergency contact list.
• Inventories of information, devices, cloud services and suppliers.
• Completed self-assessment and an improvement list with owners, dates and evidence.
• Records of updates, protection status, MFA and access reviews.
• Backup results, restore test results and recovery instructions for important processes.
• Staff training, incident exercises and management decisions about remaining risk.

Japanese program note. IPA’s SECURITY ACTION one-star and two-star levels are self-declarations associated with Steps 1 and 2 respectively; they are not third-party certifications. Version 4.0 also incorporates concepts from a Japanese supply-chain security evaluation initiative. Applying this article does not itself confer a rating under that initiative. Organizations outside Japan can use the security practices without joining either Japanese program.[2][3]

Primary sources and free templates

1. IPA: Information Security Guidelines for SMEs, version 4.0 and appendices (Japanese)
2. IPA: Full guideline, version 4.0 (Japanese PDF)
3. IPA: Announcement of version 4.0 (Japanese)

The eight appendices include a staffing and skills guide, a sample policy, a 25-question self-assessment, an employee handbook template, sample security rules, an asset inventory template, a cloud safety guide and an incident response guide. IPA also hosts an older official English translation of version 3.1; use the Japanese version 4.0 for the current structure and six measures.[1]

Checked September 25, 2026. Independent summary and adaptation based on IPA materials; not endorsed by IPA.