Recent activities on the information security management system (ISMS) at Yamaguchi University: publishing ISMS document templates and extending the scoped area

最近の山口大学メディア基盤センターにおける情報セキュリティマネジメントシステム (ISMS) 関連活動について報告を行う．本センターにおける ISMS 構築の目的の一つに，学内外における情報セキュリティ文化の普及が挙げられる．ここ数年，他の大学においても ISMS 構築の動きが見られ，本センターへの訪問依頼や文書提供などの情報提供依頼がなされている．本センターで ISMS 構築及び運用にあたって利用している文書をそのまま提供するのが最も簡単な方法であるが，(1) セキュリティ上外部に出せない部分が存在すること，(2) 契約上コンサルティング会社との共同著作物となっている部分が存在すること，また，(3) 関連文書が山口大学法人著作物であり，本学の知財提供のルールに従う必要があること，の三点に鑑み，文書類を適宜取捨選択を行った上で，コンサルティング会社と協力の上，出版物等として販売を行うこととした．また，学内においては，ISMS 適用範囲の拡張に関する議論が行われている．従来は，メディア基盤センターの教育・研究用サービス及び機関ネットワークを適用範囲としていたが，新たに事務部門が管轄するサーバ室を含めるよう適用範囲を再定義し，関係文書についても見直しを行う予定である．本報告では，これら二件について，現在の作業状況と今後の予定について概要を説明する．This report describes the recent activities regarding the information management system (ISMS) at Yamaguchi University. One of the aims of the ISMS at our university is to support proliferation of information security culture inand outside the university. In addition to a dozen of Japanese universities that are forerunner with respect to ISMS, several universities have been trying to establish effective ISMS, and some of them have required us to reveal ISMS documents such as manuals and records as to help them accomplish their tasks. It, however, is difficult to reveal the whole documents as is, since (1) some parts of the documents shall not be revealed due to security reasons, (2) some parts of the documents are copy-righted by our university and the consultant company that we had a contract with when we initially established our ISMS, and (3) we must follow the intellectual property provision rules of the university as the documents are owned by the university (not by the individual staff member). So, we are planning to publish ISMS doucment templates in cooperation with the consulting company that helped us build our initital ISMS. In addition to this activity, we are now planning to extend the scoped area of our ISMS so that it includes the server room managed by non-technical staff members as well as the original area, i.e., maintenance of the educational and research computer systems and backbone computer network system managed by the technical staff members belonging to Media and Information Technology center of Yamaguchi University. We have been discussing about which parts must be changed accordingly, especially, how the scoped area shall be modified, and which parts of the ISMS manuals and procedures should be adapted. This report describes the recent progress and the future plan of these activities briefly.