This white paper aims to provide users with information on the security measures and related matters implemented by our company as a cloud service provider, in accordance with ISO/IEC 27017:2015.

This document allows users to understand an overview of our security measures and to find the information necessary for ISO/IEC 27017 certification and evaluation.

1. Applicable to 

Our ISO/IEC 27017 compliance covers the following services: 

• G-Hibiki Datahub 
• G-Hibiki LMS

2. Security measures

2.1 Network Security

• Gateway technology is used: By configuring the security group settings of the cloud infrastructure being used, unnecessary communications for the service are blocked.
• WAF (Web Application Firewall): Prevents attacks on the service environment.
• Environment isolation: We build an independent environment for each customer.

2.2 Access Management

• Implement multi-factor authentication: MFA will be applied to access critical systems.
• Thorough access control: POLP (Personal Authorization Program) is the principle for granting only the minimum necessary permissions.
• Stricter password policy: We will comply with our established password policy.

2.3 Data Protection

• Data encryption: We will encrypt communication data using SSL/TLS, and encrypt stored data using the functions of the cloud infrastructure we utilize.
• When using encryption, we will comply with all applicable laws and regulations.
• Backup: Take regular backups.
• Disposal of unnecessary data: Data that is no longer needed for the provision of the service will be immediately deleted as soon as it becomes unnecessary.
• Countries where data may be stored: Japan
• Our company is located in Japan, and further details are available on our website.

2.4 Security Monitoring

• Log monitoring: We will acquire and monitor security logs using the functions of the cloud infrastructure we utilize. We will store logs and other records after taking measures to prevent tampering.
• Clock synchronization: To ensure log consistency, clock synchronization based on UTC will be performed using the functionality of the cloud infrastructure being used.

2.5 Vulnerability Countermeasures

• External diagnostics: Regular diagnostics will be conducted by external organizations.
• Secure Development: We implement secure development that takes into account OWASP Top 10 and other relevant factors.
• Tool-based scanning: We perform vulnerability scans using code scanning tools before release.
• Vulnerability Information Collection: We will collect appropriate vulnerability information and implement countermeasures.

2.6 Employee Training and Awareness Improvement

• We conduct regular security training.
• We will verify compliance with security rules through internal audits.

2.7 Establishment of a system based on legal compliance and various certifications

• We comply with all applicable laws and regulations regarding information security. (*Japanese law applies to the use of our services.)
• We will establish a management system based on standards such as ISO27001.

3. Incident Response

3.1 Scope of Responsibility

Based on our "Basic Information Security Policy," we define roles and responsibilities regarding information security. Furthermore, this document outlines the information security measures implemented in our cloud services, and we implement necessary measures according to the nature of each service. The division of responsibilities regarding information security and incident management in each service is as follows:

[Our company]

• Response to and reporting of security incidents affecting the entire service.
• Security updates for each service
• Security measures for service-related systems

[customer]

• Managing security incidents caused by customer actions
• Use of services based on each service manual
• Account Management
• Use the latest version

3.2 Incident Reporting

Our company detects security incidents that could have a significant impact on our customers, such as information leaks and data corruption. When an incident is detected, we report it to the relevant person within two business days.

The following are the security incidents that will be disclosed:

[subject]

• Loss, damage, or alteration of customer data
• Unauthorized external access affecting the service
• Malware infection
• Information leak to external parties
• Infringement of intellectual property rights

[Disclosure level]

• Details and scope of impact of the security incident
• Response measures, including measures to prevent recurrence

3.3 Contact information in the event of an incident

For inquiries regarding security incidents and incident response, please contact the "Incident Inquiry Desk" listed below.

3.4 How to recover from an incident

If you have any questions about how to recover from a system failure or incident, please contact the "Incident Inquiry Desk" listed below.

3.5 In the event of an information security incident (suspected incident)

If you experience an information security incident (suspected or possible security incident), please contact the "Incident Inquiry Desk" listed below.

We will promptly investigate and confirm the situation, and within two business days, a representative from our company will contact you via email regarding the situation and the proposed solutions.

We will provide updates on the status of security incidents via email as they occur. Furthermore, for incidents affecting a wide range of customers, we may also publish information on our website for you to check.

　

Incident Inquiry Contact:product_support@g-gravity.jp
Please contact the above contact point or your sales representative.