Information Asset and Risk Practices

Company A is an industrial-equipment sales company with 120 employees. B, in the sales department, has been appointed the department's information security leader and is creating the sales department's information asset inventory for the first time. The sales department has contact information for customer representatives registered in the customer management system, paper contracts, business cards collected at trade shows, quotation files in Excel, loaned laptops, and a cloud service for sales support. When B consulted the information systems department, they were told, “We know what's on the servers, but we don't know about information the department holds on its own.” What should B do first in creating the inventory?

1. Report to the information security committee that the inventory has not been made, and wait for company-wide instructions before doing anything
2. Transcribe the list of servers managed by the information systems department directly as the sales department's inventory
3. Decide confidentiality, integrity, and availability ratings only for the data held in the customer management system
4. Identify everything the sales department handles in its work, without distinguishing electronic data, paper, equipment, or outside services

B in Company A's sales department identified the department's information and created the first version of the information asset inventory. The sales department handles customer contact information registered in the sales management server, original contracts kept in the third-floor archive, business cards collected at trade shows and visits, and a quotation template placed in a shared folder. B filled in the columns for using department, responsible manager, storage location, medium, and record count for each asset. For business cards, having heard that “each staff member receives and keeps their own,” B recorded it as such. Before submitting the finished inventory to a supervisor, B is checking whether there is any problem with how it was recorded. Which entry in this inventory most needs to be revised?

No  資産名          利用部門  管理責任者    保管場所          媒体  件数1   顧客連絡先一覧  営業部    営業部長      販売管理サーバ    電子  8,4002   契約書原本      営業部    営業事務課長  3階書庫(施錠)     紙    1,2003   受領した名刺    営業部    営業部全員    各自の名刺入れ    紙    不明4   見積書ひな形    営業部    営業企画課長  部門共有フォルダ  電子  40

1. No. 4 — An asset that is never taken outside the company does not need to be recorded in the inventory
2. No. 1 — An asset with a large record count must always be split across multiple rows, one per count
3. No. 3 — The responsible manager is not identified as a specific individual, and neither the storage location nor the record count is tracked
4. No. 2 — Paper documents are outside the scope of an information asset inventory, so this row should be deleted from it

At Company A, customer information entered by the sales department when taking an order is used by the logistics department to confirm the delivery address and by the accounting department to issue invoices. The customer information is stored in a sales management system operated by the information systems department. In creating the information asset inventory, the departments disagree over who should be the responsible manager for this customer information. Logistics and accounting each claim they “merely use it,” while the information systems department says it “merely holds the server and doesn't know the content.” Which is the most appropriate way to decide the responsible manager?

1. Make the head of the information systems department, which operates the system storing the information, the responsible manager, and list sales, logistics, and accounting alongside it in the inventory as using departments
2. Make the manager of the sales department, which generates the information in the course of its work and bears responsibility for its content and scope of use, the responsible manager, and list logistics and accounting alongside it in the inventory as using departments
3. Register the managers of all three using departments jointly as the responsible manager, deciding by consensus
4. Do not designate a responsible manager, and record only the using departments in the inventory

Company A has decided to update its information asset inventory during an annual inventory-taking exercise every March. This fiscal year in the sales department, the person in charge of the customer management system changed hands in an April personnel transfer. In June, a new sales-support cloud service was introduced and began storing negotiation history. In September, 1,000 paper contracts were moved from the internal archive to an outside warehouse. In November, one contract employee left, and another staff member took over the quotation files that person had handled. B thinks, “The annual inventory-taking is in March, so the inventory can stay as it is until then.” Which of the following is the most appropriate criticism of this thinking?

1. Information stored on a cloud service is something the provider manages, so it does not need to be listed in the company's own inventory
2. The inventory only needs to be updated when a system is replaced; a personnel transfer or a change of storage location falls outside the scope of an update
3. The inventory should be updated as soon as an asset changes, and the annual inventory-taking should be positioned as the occasion for filling in any overall gaps
4. The inventory is a record as of the time it was created, so once finalized it should never be changed at all, and a new one should be made from scratch the following fiscal year

B in Company A's sales department identified information assets through an internal survey. The responses gathered covered only three things: data in the customer management system, proposals in a shared folder, and contracts in the archive. But walking around the department in person, B found a staff member keeping a customer-list Excel file on their loaned laptop's desktop, a staff member saving proposals to a personally contracted free cloud storage service and editing them from home, a staff member keeping a bundle of business cards collected at trade shows in a drawer, and a staff member holding onto a USB drive taken over from a colleague who had left the company. None of these appeared in the survey responses. Which of the following is the most appropriate response for B?

1. Since business cards and a USB drive are small in quantity, register them together as a single entry called “other” without counting them
2. Add the information found through the on-site check to the inventory as well, and revise the identification method so it does not rely on self-reporting alone
3. Consider the identification work complete once a new regulation banning use of free cloud storage has been drawn up
4. Put only the assets written in the survey into the inventory, and treat everything else as personal belongings managed by the individual

B in Company A's sales department created the department's information asset inventory and has been asked to check for any asset that is not being properly managed. A supervisor said, “There's no time to check everything at once, so please look at the risky ones first.” The inventory records, for each asset, the medium, storage location, record count, and whether it may be taken out. B thinks the state of management can be read from the entries themselves and is comparing rows. An excerpt of the inventory is shown below. Which asset should be given top priority for an on-site check?

No  資産名          媒体  保管場所                    件数   持出し1   顧客連絡先一覧  電子  社内ファイルサーバ          8,400  不可2   契約書原本      紙    3階書庫(施錠)               1,200  不可3   商談メモ        電子  各自の貸与PCのデスクトップ  不明   可4   請求書控え      紙    営業部キャビネット(施錠)    3,000  不可

1. No. 1 (customer contact list)
2. No. 3 (negotiation notes)
3. No. 4 (invoice copies)
4. No. 2 (original contracts)

Team lead C in Company A's sales department is due to leave at the end of next month. C has stored the negotiation history for 20 client companies in a local folder on a loaned laptop and in a business email inbox, with only some of it placed in the department's shared folder. C also keeps a USB drive containing drawings entrusted by a client in a desk drawer. Told by a supervisor to “finish the handover before the departure,” B, as information security leader, needs to organize the procedure. What should B do first?

1. Reinitialize the laptop C used on the last working day, and discard the loaned USB drive without checking its contents
2. Identify and list the information C holds in the course of the job, and confirm with the responsible manager which of it should be handed over as an information asset
3. Have the supervisor read through all of C's business email inbox and forward whichever messages seem necessary to the department's shared folder one by one
4. Immediately disable every internal account loaned to C, so that C cannot use any internal system at all until the last working day

In Company A's sales department, a staff member had, for the sake of efficiency, signed up for an online survey service on a free plan. This service was used to collect the names, company names, and email addresses of trade-show visitors, later used for sales activity. No usage application had been filed with the information systems department, and only a few people in the department even knew it existed. When B found this in the course of identifying information assets, about 600 records had already been collected. The service's admin screen was set up so two staff members could log in with personal accounts. Which of the following is the most appropriate response for B?

1. Since the free plan incurs no cost, do not register it in the inventory and let its use continue as-is
2. List the two account holders' names in the responsible-manager column and leave all further management to those two
3. Immediately delete all collected personal information and cancel the service, skipping both an internal report and a record in the inventory
4. Record the information being collected and its usage in the inventory, go through the internal application process, and check the provider's security control measures

Starting this fiscal year, Company A has decided to build an information asset inventory in every department, and general affairs held a briefing session. After the session, several staff members asked B in the sales department, “How far does the inventory go in counting something as an information asset?” The sales department has a customer database, paper contracts, loaned laptops and smartphones, quotation software, and an outside sales-support cloud service. There is also negotiation and discount know-how known only to veteran employees. One staff member argued, “equipment listed in the company's equipment inventory shouldn't count as an information asset,” while another said, “data on the cloud belongs to the provider.” Which explanation of the scope of information assets is most appropriate?

1. Only things whose monetary value can be estimated count as information assets; things that cannot be estimated, like the know-how a person holds, are outside the scope
2. Electronic data, paper documents, equipment, software, outside services, and knowledge held by people are all treated as information assets as long as they have value to the business
3. Only things the company owns and keeps in-house are information assets; information stored on an outside cloud service and knowledge held by people are not included
4. Only electronic data is an information asset; paper documents, equipment, and outside services are not included

Company A has a company-wide unified rule for deciding an information asset's importance. Confidentiality, integrity, and availability are each rated on a three-level scale of high (3), medium (2), or low (1), and the rule states that an asset's importance equals the highest of its three ratings. B in the sales department rated the department's main assets under this rule and got the results below. B wants to pull out the assets rated “high” in importance to prioritize countermeasures for them. Under this rule, which combination of assets is rated “high” in importance?

No  資産名          機密性  完全性  可用性1   顧客連絡先一覧  高      中      中2   見積書ひな形    低      中      低3   受注データ      中      高      高4   展示会案内文    低      低      低

1. No. 2 and No. 3
2. No. 3 and No. 4
3. No. 1 and No. 2
4. No. 1 and No. 3

To explain the way of thinking behind ratings to the department's staff, B in Company A's sales department used a price sheet listing discount rates by customer as an example. If this price sheet reached a competitor, it would put the company at a disadvantage in price negotiations. If a figure on it were mistakenly rewritten, an incorrect quoted price could be presented to a customer, which would later have to be retracted. On the other hand, if a system failure made it unreadable for about half a day, business could continue using a printed copy from the previous month as a substitute. What is the most appropriate rating for this price sheet?

1. Confidentiality high, integrity low, availability high
2. Confidentiality low, integrity low, availability low
3. Confidentiality low, integrity high, availability high
4. Confidentiality high, integrity high, availability low

In Company A's sales department, information asset ratings were left to each staff member's own judgment, and almost every asset ended up rated “confidentiality high.” Under the company's handling standard, an asset rated high for confidentiality requires storage in a locked archive, a supervisor's approval to take it out, and encryption plus a handover record when shared outside the company. As a result, even taking out a trade-show invitation flyer or an already-published product catalog required approval. Approval requests climbed from a dozen or so a month to nearly two hundred. Eventually the supervisor started stamping approval without checking the content, and it turned out that even taking out the truly sensitive customer list was sailing through unchecked. Which of the following is the most appropriate response for B?

1. To reduce the burden of approval, abolish the supervisor's approval step for taking items out altogether, regardless of importance, for every asset
2. Uniformly lower the rating of every asset the sales department holds to “medium,” and greatly simplify the handling standard even for assets with high confidentiality
3. Present a rating standard that can be judged by the actual size of the impact, redo the ratings, and lower the rating of low-impact assets such as public information to match reality
4. Leave the asset ratings as they are, and change the approver for taking items out from the supervisor to the very staff member who is actually taking it outside the company, across the board

Company A has a handling standard tied to an information asset's importance. B in the sales department has been asked by the sales manager to provide a customer contact list, rated “high” in importance, to an outside agency for a joint campaign with a business partner. A services contract exists with the agency, but B has not checked whether it includes a confidentiality clause. The sales manager has said, “The campaign is starting soon, so please hurry.” An excerpt of the handling standard is shown below. What should B do first?

重要度  保管                  持出し        社外共有                廃棄高      施錠書庫または暗号化  上長承認必須  契約と部門長承認が必要  溶解またはデータ消去の記録中      施錠書庫              上長承認必須  上長承認が必要          溶解またはデータ消去低      指定なし              承認不要      承認不要                一般廃棄可

1. Change the customer contact list's importance to “medium” so it can be provided with just a supervisor's approval
2. Check whether the contract with the agency contains a confidentiality clause, and proceed with obtaining the department head's approval
3. Since narrowing the number provided to 100 records would lower the importance, create an excerpted version and provide it without approval
4. Send it to the agency's contact person as a password-protected compressed file, and communicate the password in a separate message

In Company A's sales department, the sales activity report file was rated “low” in importance on the grounds that it was “just a document shared internally,” and it was placed in a shared folder any staff member could edit. The report sometimes records the name and title of the person visited along with meeting content and trading terms with other companies. One day, a temporary staff member made an operating mistake and copied the report folder into the company-wide shared folder, leaving it viewable by every employee in other departments for two weeks. Following this event, B has to review the rating. Which approach to the review is most appropriate?

1. Redo the rating based on the impact if the information contained in the report leaked, and apply a handling rule that raises the confidentiality rating when it includes high-impact information such as trading terms
2. Since the report is updated daily and its content keeps changing, exclude it from rating altogether
3. Since the cause this time was the temporary staff member's operating mistake, leave the report's rating unchanged and prevent recurrence by deleting that person's account
4. It is enough to review the company-wide shared folder's access rights so staff in other departments cannot see the report, so leave the report's confidentiality rating as it is

Company A has set the confidentiality rating standard as: “information that could trigger a legal reporting obligation or damages claim if it leaked is rated high,” “information already published is rated low,” and “information matching neither is rated medium.” In the sales department, each staff member rated a share of the assets, and B compiled the results. In the process, B suspects the standard may have been applied inconsistently between staff members, particularly diverging on whether the information was collected at an outside event. The sales department's rating results are shown below. Which of these ratings needs to be revised against the standard?

No  資産名                  含まれる情報                                機密性の評価1   顧客連絡先一覧          顧客担当者の氏名・電話番号・メールアドレス  高2   展示会来場者アンケート  来場者の氏名・勤務先・メールアドレス        低3   契約書原本              取引条件・押印済みの署名                    高4   製品カタログ(公開版)    公開済みの製品仕様と価格                    低

1. No. 1 (the sales department's customer contact list)
2. No. 4 (product catalog currently published on the web)
3. No. 3 (original contracts)
4. No. 2 (trade-show visitor survey)

At Company A, each department had been rating information assets in its own terms: sales used “important / normal / minor,” manufacturing used “A / B / C,” and accounting used “a 5-level scale from 1 to 5.” When a company-wide risk assessment tried to compare across departments, it proved impossible to judge which asset should be prioritized for countermeasures. It also turned out that even the same word, “important,” was applied under different reasoning depending on the department. Which of the following is the most appropriate proposal for B, who serves as secretariat for the information security committee?

1. Define, company-wide, both the rating levels and the criteria (the impact of a leak, alteration, or loss of use) for placing something into each level, and have every department redo its ratings against the same standard
2. Have the information systems department carry out the company-wide rating on its own, without involving each department in the rating
3. Standardize every department's notation onto accounting's finer 5-level scale, while leaving the criteria for which level something falls into to each department's discretion as before
4. Leave each department's rating notation as it is, and have each department pick its own top three to serve as the company-wide list for countermeasures

In Company A's sales department, order data is entered into the sales management system, and shipping instructions and invoicing are all based on this data. If the system stops, shipments cannot go out that day; a full day's outage pushes roughly 20 million yen of sales into the following month and also causes delivery delays to clients. On the other hand, a shared folder holding past negotiation notes causes no major disruption to daily work even if it is unavailable for a week. The negotiation notes also number more records than the order data. B has to decide the availability rating for both. Which way of thinking is most appropriate?

1. Availability is a matter for the information systems department, which operates the system, to decide, and the sales department, as the using department, should refrain from involvement in the rating
2. Since both are information used routinely in internal business, set the same availability rating for both
3. Revise and set the negotiation notes, which hold more records, to a higher availability rating than the order data
4. Rate by how much business is halted when something becomes unusable and how long an outage can be tolerated, giving the order data high and the negotiation notes low

In Company A's sales department, the customer contact list is kept on the internal file server, configured so every staff member can access it. Last month, it turned out that a departed employee's account had been left un-deleted. Staff members also reference the same file from outside the office over a VPN on their company-issued laptops. B is beginning a risk assessment for this asset, starting with risk identification. Which of the following is the most appropriate task to carry out as risk identification?

1. Combine the threats to the customer contact list (unauthorized access, internal fraud, loss, etc.) with the vulnerabilities that could be exploited (a leftover unnecessary account, over-granted privileges, etc.) to identify the events that could occur
2. Estimate the cost of a countermeasure for each identified risk, carry out whichever ones fit within budget starting with the cheapest, and record their implementation status
3. Immediately delete the departed employee's remaining account on the customer contact list, narrow every staff member's access rights down to what is needed for their work, and consider the whole sequence of work on this asset finished at that point
4. Estimate the likelihood and the degree of impact for the customer contact list, multiply them to compute the size of the risk, and compare it against the acceptance criteria

Company A has defined a method for computing risk level and an acceptance criterion in its regulations. Risk level is the product of “likelihood (high 3, medium 2, low 1) × impact (high 3, medium 2, low 1).” A product of 6 or more is treated as an unacceptable risk to be addressed with priority. B in the sales department analyzed the department's risks using this method and got the results below. A supervisor has said, “I want to narrow it down to one item and move ahead with a countermeasure first.” Under this standard, which risk should be addressed with priority?

No  リスク                          発生可能性  影響度  積1   顧客連絡先一覧の外部への漏えい  低(1)       高(3)   32   退職者アカウントによる不正閲覧  中(2)       高(3)   63   紙の契約書の紛失                中(2)       中(2)   44   展示会案内文の誤送信            高(3)       低(1)   3

1. No. 2 (unauthorized viewing via a departed employee's account)
2. No. 3 (loss of an original paper contract)
3. No. 4 (misdirected email from an incorrect recipient for a trade-show invitation)
4. No. 1 (a large-scale external leak of the customer contact list)

In Company A's sales department, a meeting was held to decide the risk-treatment policy in response to the risk assessment results. The sales manager, B, and a representative from the information systems department attended. The discussion resulted in a different kind of treatment for each of four risks. B needs to classify the decisions by type of risk treatment to report them to the company-wide information security committee. The decisions are shown below. When each treatment is classified as risk avoidance, risk reduction, risk transfer, or risk retention (acceptance), which combination is correct?

No  リスク                      決めた対応1   展示会での名刺収集時の紛失  名刺の収集をやめ、来場者情報は取引先経由でのみ受け取る2   ファイルサーバへの不正侵入  アクセス権の見直しと多要素認証の導入を行う3   サイバー攻撃による損害賠償  サイバー保険に加入する4   社内掲示板の記載誤り        影響が小さいため対策は行わず、記録を残して年次で再評価する

1. 1 = avoidance, 2 = reduction, 3 = transfer, 4 = retention
2. 1 = transfer, 2 = reduction, 3 = avoidance, 4 = retention
3. 1 = reduction, 2 = avoidance, 3 = retention, 4 = transfer
4. 1 = avoidance, 2 = transfer, 3 = reduction, 4 = retention

In Company A's sales department, a reduction measure such as reviewing access rights was carried out for the risk of a customer contact list leak, but the risk level remained just slightly above the acceptance criterion. Introducing a dedicated data-removal management system is being considered as an additional measure, but it would cost 8 million yen a year. On the other hand, the expected loss from this risk is estimated at around 1 million yen a year. B is working out how to handle the remaining risk. Which response is most appropriate?

1. Since it exceeds the acceptance criterion, an additional countermeasure must always be carried out regardless of cost
2. Change the method for computing the risk level and redo the evaluation so that it falls within the acceptance criterion
3. Organize the cost-effectiveness and the nature of the remaining risk, explain it to the management-level people who bear responsibility, and record it as a residual risk once their approval is obtained
4. Since the cost is not worth it, B, as information security leader, decides on their own to accept the risk, keeping no particular record

Company A carries out a risk assessment every April. This fiscal year, a new sales-support cloud service was introduced in June and began storing customer information. In September, a revision to the law governing the handling of personal information took effect. In November, a malware infection incident occurred in another department, and a company-wide alert was issued. In January, the sales department and the sales planning department were merged, changing the responsible manager and the scope of authority. B thinks, “The next assessment is in April, so the current results can stand until then.” Which of the following is the most appropriate criticism of this thinking?

1. Introducing a new service, a legal revision, an incident occurring, and an organizational change are all events that change the premises of the assessment and require a review each time
2. Responding to a legal revision is the legal department's job, not a reason to review the sales department's risk assessment
3. An incident occurring in another department has nothing to do with this department, so it is not a reason for a review
4. Since the risk assessment was decided to happen once a year, changes occurring during the year can simply be folded into the next assessment all at once, with no need for a review each time

B in Company A's sales department is carrying out the department's first risk assessment. On hand is an information asset inventory completed last week, recording each asset's name, responsible manager, confidentiality/integrity/availability ratings, and importance. A supervisor has said, “Since the time available is limited, I want to address the highest-priority items first.” The company has regulations defining a method for computing risk level and an acceptance criterion. What should B do next?

1. Starting with the assets of highest importance, identify risks from combinations of threat and vulnerability, and compute risk levels from likelihood and impact
2. Gather examples of incidents that happened at other companies and apply the same countermeasures uniformly to every asset
3. Skip using the acceptance criterion and carry out whatever countermeasure comes to mind first
4. For every asset in the inventory, obtain quotes for countermeasure products from multiple vendors and compare cost and effectiveness

In Company A's sales department, a risk-treatment plan was drawn up based on the risk assessment results. The plan's template records, for each risk, the countermeasure, the person responsible, the deadline, and how any residual risk after implementation will be handled. Each risk's owner drafted their own part, and B compiled them. In compiling it, B noticed that some rows had been submitted blank or with unclear wording. An excerpt of the drawn-up plan is shown below. Which entry in this plan most needs to be revised?

No  リスク                      対応策                        責任者            期限            残留リスクの扱い1   退職者IDによる不正閲覧      退職手続にID即時停止を組込み  営業事務課長      10月末          受容し記録する2   紙の契約書の紛失            施錠書庫での保管と持出し記録  営業部長          11月末          受容し記録する3   ノートPC紛失時の情報漏えい  全台のディスク暗号化          情報システム部長  12月末          受容し記録する4   顧客情報の誤送信            注意喚起の周知                未定              できるだけ早く  未検討

1. No. 4 — Neither the person responsible nor the deadline has been decided, and how the residual risk will be handled is also undecided
2. No. 2 — The person responsible is set at the department-head level, too senior a position for this to be effective
3. No. 3 — The person responsible is assigned to a manager in a completely different department, not sales
4. No. 1 — The countermeasure relies solely on an operating procedure rather than a technical means

In Company A's sales department, a countermeasure is being considered for the risk of an information leak from losing a laptop that stores customer information. The expected loss if a leak occurs is 5 million yen per incident, and based on past experience, a loss is expected roughly once every five years, or 0.2 times a year. Option A is introducing disk encryption software, costing 300,000 yen a year, which prevents a leak almost entirely even if the laptop is lost. Option B is replacing every laptop taken outside with a model that has anti-loss features, costing 4 million yen a year. Option C is taking no countermeasure and instead paying a condolence payment to the customer when a loss occurs, with an expected annual outlay of 1 million yen. Which of the following is the most appropriate content for B to explain at the management meeting?

1. Since the size of a risk cannot be expressed in monetary terms in the first place, comparing the cost-effectiveness of the countermeasures should be skipped altogether
2. Since the cost of every countermeasure exceeds the expected annual loss, none of them should be carried out, and option C should simply be chosen as-is
3. The expected annual loss is 1 million yen, and option A, which prevents a leak almost entirely for 300,000 yen a year, is the best in terms of cost-effectiveness
4. Option B, the strongest countermeasure, should be chosen, and the size of its 4-million-yen annual cost need not be given particular weight