Last active
March 26, 2019 03:18
-
-
Save matsubo/0f348fa6cd68d9f45b47 to your computer and use it in GitHub Desktop.
PCI DSS v3 ja
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- èŠä»¶1ïŒã«ãŒãäŒå¡ããŒã¿ãä¿è·ããããã«ããã¡ã€ã¢ãŠã©ãŒã«ãã€ã³ã¹ããŒã«ããŠæ§æãç¶æãã: | |
- 1.1 以äžã®é ç®ãå«ããã¡ã€ã¢ãŠã©ãŒã«ããã³ã«ãŒã¿ãŒæ§æåºæºã確ç«ããå®è£ ããã: | |
- 1.1 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æåºæºããã³ä»¥äžã§æå®ããããã®ä»ææžãæ€æ»ããæšæºãå®å šã§ã以äžã®ããã«å®æœãããŠããããšã確èªããã | |
- 1.1.1 ãã¹ãŠã®ãããã¯ãŒã¯æ¥ç¶ããã³ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãžã®å€æŽãæ¿èªããã³ãã¹ãããæ£åŒãªããã»ã¹: | |
- 1.1.1.aãææžåãããæé ã調ã¹ãŠããã¹ãŠããã¹ããæ¿èªããæ£åŒãªããã»ã¹ãããããšã確èªããã\nã»ãããã¯ãŒã¯æ¥ç¶\nã»ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãžã®å€æŽ | |
- 1.1.1.bããããã¯ãŒã¯æ¥ç¶ã®ãµã³ãã«ã§ã¯ã責任è ãã€ã³ã¿ãã¥ãŒããèšé²ãæ€æ»ããŠãããã¯ãŒã¯æ¥ç¶ãæ¿èªãããŠãã¹ããããŠããããšã確èªããã | |
- 1.1.1.cããã¡ã€ã¢ãŠã©ãŒã«ããã³ã«ãŒã¿ãŒæ§æã«å®éã«å ããããå€æŽã®ãµã³ãã«ãç¹å®ããå€æŽèšé²ãšæ¯èŒããŠã責任è ãã€ã³ã¿ãã¥ãŒããŠå€æŽãæ¿èªãããã¹ããããããšã確èªããã | |
- 1.1.2 ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ãªã©ãã«ãŒãäŒå¡ããŒã¿ãžã®ãã¹ãŠã®æ¥ç¶ã瀺ãææ°ãããã¯ãŒã¯å³: | |
- 1.1.2.a ãããã¯ãŒã¯å³ãæ€æ»ããŠãããã¯ãŒã¯æ§æã芳å¯ããçŸåšã®ãããã¯ãŒã¯å³ãååšããããšããŸãããã®ææžãã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ãå«ããã«ãŒãäŒå¡ããŒã¿ãžã®å šæ¥ç¶ãå«ãã§ããããšã確èªããã | |
- 1.1.2.b 責任è ãã€ã³ã¿ãã¥ãŒããŠãå³ãææ°ã®ãã®ã§ããããšã確èªããã | |
- 1.1.3 ã·ã¹ãã ãšãããã¯ãŒã¯å ã§ã®ã«ãŒãäŒå¡ããŒã¿ã®ãããŒã瀺ãææ°å³ã: | |
- 1.1.3.a ããŒã¿ãããŒå³ã調æ»ããæ åœè ã«ã€ã³ã¿ãã¥ãŒãè¡ããå³ã確èªããã\nã»ã·ã¹ãã ãšãããã¯ãŒã¯ãæµãããã¹ãŠã®ã«ãŒãäŒå¡ããŒã¿ãããŒã瀺ããŠããã\nã»ææ°ã«ãªã£ãŠããããå¿ èŠãªç°å¢å€æŽãæŽæ°ãããŠãããã | |
- 1.1.4 åã€ã³ã¿ãŒãããæ¥ç¶ãããã³DMZ (demilitarized zone)ãšå éšãããã¯ãŒã¯ãŸãŒã³ãšã®éã®ãã¡ã€ã¢ãŠã©ãŒã«èŠä»¶: | |
- 1.1.4.a ãã¡ã€ã¢ãŠã©ãŒã«æ§æåºæºã調æ»ããããã«ãåã€ã³ã¿ãŒãããæ¥ç¶ãããã³DMZãšå éšãããã¯ãŒã¯ãŸãŒã³ãšã®éã®ãã¡ã€ã¢ãŠã©ãŒã«èŠä»¶ãå«ãŸããŠããããšã確èªããã | |
- 1.1.4.b çŸåšã®ãããã¯ãŒã¯å³ãããã¡ã€ã¢ãŠã©ãŒã«æ§æåºæºãšäžèŽããŠããããšã確èªããã | |
- 1.1.4.c ãããã¯ãŒã¯æ§æãèŠãŠãææžåãããæ§æåºæºãšãããã¯ãŒã¯å³ã§ãåã€ã³ã¿ãŒãããæ¥ç¶ãããã³DMZãšå éšãããã¯ãŒã¯ãŸãŒã³ãšã®éã«ãã¡ã€ã¢ãŠã©ãŒã«ãèšçœ®ãããŠããã確èªããã | |
- 1.1.5 ãããã¯ãŒã¯ã³ã³ããŒãã³ããè«ççã«ç®¡çããããã®ã°ã«ãŒãã圹å²ã責任ã«é¢ããèšè¿°: | |
- 1.1.5.a ãã¡ã€ã¢ãŠã©ãŒã«ããã³ã«ãŒã¿ãŒæ§æåºæºã«ããããã¯ãŒã¯ã³ã³ããŒãã³ãã®ç®¡çã®ããã®ã°ã«ãŒãã圹å²ã責任ã«é¢ããèšè¿°ãå«ãŸããŠããããšã確èªããã | |
- 1.1.5.b ãããã¯ãŒã¯ã³ã³ããŒãã³ãã®ç®¡ç責任è ãã€ã³ã¿ãã¥ãŒããææžéãã«åœ¹å²ãšè²¬ä»»ãå²ãåœãŠãããŠããããšã確èªããã | |
- 1.1.6 䜿çšãèš±å¯ãããŠãããã¹ãŠã®ãµãŒãã¹ããããã³ã«ãããŒãã®ææžåãããã³äœ¿çšãèš±å¯ãããŠããæ¥åäžã®çç±(å®å šã§ãªããšã¿ãªãããŠãããããã³ã«ã«å®è£ ãããŠããã»ãã¥ãªãã£æ©èœã®ææžåãªã©)ã\nå®å šã§ãªããµãŒãã¹ããããã³ã«ãããŒãã®äŸãšããŠãFTPãTelnetãPOP3ãIMAPãSNMP v1 ããã³ v2ãªã©ãããã: | |
- 1.1.6.a ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æåºæºã«ãæ¥åã«ãããå¿ èŠæ§ãå«ãããã¹ãŠã®ãµãŒãã¹ããããã³ã«ãããŒããææžåãããªã¹ããå«ãŸããŠããããšã確èªããïŒHTTPïŒãã€ããŒããã¹ããããã³ã«ïŒãSSLïŒã»ãã¥ã¢ãœã±ããã¬ã€ã€ïŒãSSHïŒã»ãã¥ã¢ã·ã§ã«ïŒãVPNïŒä»®æ³ãã©ã€ããŒããããã¯ãŒã¯ïŒãããã³ã«ãªã©ïŒã | |
- 1.1.6.b 䜿çšãèš±å¯ãããŠãããå®å šã§ãªããµãŒãã¹ããããã³ã«ãããŒããèå¥ããã»ãã¥ãªãã£æ©èœãææžåãããŠããããšã確èªããã | |
- 1.1.6.c ãã¡ã€ã¢ãŠã©ãŒã«ãšã«ãŒã¿ãŒã®æ§æãæ€æ»ããææžåãããŠããã»ãã¥ãªãã£æ©èœãå®å šã§ãªãåãµãŒãã¹ããããã³ã«ãããŒãã«å®è£ ãããŠããããšã確èªããã | |
- 1.1.7 ãã¡ã€ã¢ãŠã©ãŒã«ããã³ã«ãŒã¿ãŒã®ã«ãŒã«ã»ããã¯å°ãªããšã6ã«æããšã«ã¬ãã¥ãŒãããå¿ èŠããã: | |
- 1.1.7.a ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æåºæºã§ããã¡ã€ã¢ãŠã©ãŒã«ããã³ã«ãŒã¿ãŒã®ã«ãŒã«ã»ãããå°ãªããšã 6 ã«æããšã«ã¬ãã¥ãŒããããã«èŠæ±ããŠããããšã確èªããã | |
- 1.1.7.b ã«ãŒã«ã»ããã®ã¬ãã¥ãŒã«é¢é£ããææžãæ€æ»ããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã«ãŒã«ã»ãããå°ãªããšã 6 ã«æããšã«ã¬ãã¥ãŒãããŠããããšã確èªããã | |
- 1.2 ä¿¡é Œã§ããªããããã¯ãŒã¯ãšã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ããšã®æ¥ç¶ãå¶éãããã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ§ç¯ããã\n泚ïŒãä¿¡é Œã§ããªããããã¯ãŒã¯ããšã¯ãã¬ãã¥ãŒå¯Ÿè±¡ã®äºæ¥äœã«å±ãããããã¯ãŒã¯å€ã®ãããã¯ãŒã¯ããŸãã¯äºæ¥äœã®å¶åŸ¡ãŸãã¯ç®¡çãåã°ãªããããã¯ãŒã¯(ãããã¯ãã®äž¡æ¹)ã®ããšã§ããã: | |
- 1.2 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æã調æ»ããŠãä¿¡é Œã§ããªããããã¯ãŒã¯ãšã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®ã·ã¹ãã ã³ã³ããŒãã³ãéã§æ¥ç¶ãå¶éãããŠããããšã確èªããã | |
- 1.2.1 çä¿¡ããã³çºä¿¡ãã©ãã£ãã¯ããã«ãŒãäŒå¡ããŒã¿ç°å¢ã«å¿ èŠãªãã©ãã£ãã¯ã«ãããã以å€ã®ãã¹ãŠã®ãã©ãã£ãã¯ãç¹å®çã«æåŠããã: | |
- 1.2.1.a ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æåºæºã調ã¹ãŠãã«ãŒãäŒå¡ããŒã¿ç°å¢ã«å¿ èŠãªçä¿¡ããã³çºä¿¡ãã©ãã£ãã¯ãç¹å®ãããŠããããšã確èªããã | |
- 1.2.1.b çä¿¡ããã³çºä¿¡ãã©ãã£ãã¯ããã«ãŒãäŒå¡ããŒã¿ç°å¢ã«å¿ èŠãªãã©ãã£ãã¯ã«å¶éãããŠãããå¶éãææžåãããŠããããšã確èªããã | |
- 1.2.1.c ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ããŠãããšãã°æ瀺ã®ããã¹ãŠãæåŠãããŸãã¯èš±å¯æã®åŸã®æé»ã®æåŠã䜿çšããããšã§ãä»ã®ãã¹ãŠã®çä¿¡ããã³çºä¿¡ãã©ãã£ãã¯ãæ確ã«æåŠãããŠããããšã確èªããã | |
- 1.2.2 ã«ãŒã¿ãŒæ§æãã¡ã€ã«ãã»ãã¥ãªãã£ä¿è·ããã³åæåããã: | |
- 1.2.2.a ã«ãŒã¿ãŒæ§æãã¡ã€ã«ã調ã¹ãŠãäžæ£ã¢ã¯ã»ã¹ããã»ãã¥ãªãã£ä¿è·ãããŠããããšã確èªããã | |
- 1.2.2.b ã«ãŒã¿ãŒæ§æã調ã¹ãŠãåæåãããŠããããšã確èªãããããšãã°ãå®è¡ïŒã¢ã¯ãã£ãïŒæ§æãã¡ã€ã«ãèµ·åæ§æïŒãã·ã³ã®åèµ·åæã«äœ¿çšïŒã«äžèŽããããšã確èªããã | |
- 1.2.3 ãã¹ãŠã®ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ãšã«ãŒãäŒå¡ããŒã¿ç°å¢ã®éã«å¢çãã¡ã€ã¢ãŠã©ãŒã«ãã€ã³ã¹ããŒã«ããã¯ã€ã€ã¬ã¹ç°å¢ããã«ãŒãäŒå¡ããŒã¿ç°å¢ãžã®ãã¹ãŠã®ãã©ãã£ãã¯ãæåŠãŸãã¯å¶åŸ¡ããããã«(ãã®ãããªãã©ãã£ãã¯ãæ¥åäžå¿ èŠãªå Žå)ãã¡ã€ã¢ãŠã©ãŒã«ãæ§æããã: | |
- 1.2.3.a ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æã調ã¹ãŠããã¹ãŠã®ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ãšã«ãŒãäŒå¡ããŒã¿ç°å¢éã«å¢çãã¡ã€ã¢ãŠã©ãŒã«ãã€ã³ã¹ããŒã«ãããŠããããšã確èªããã | |
- 1.2.3.b ãã¡ã€ã¢ãŠã©ãŒã«ããã¯ã€ã€ã¬ã¹ç°å¢ãšã«ãŒãäŒå¡ããŒã¿ç°å¢éã®ãã¹ãŠã®ãã©ãã£ãã¯ãæåŠãŸãã¯ãæ¥åäžå¿ èŠãªå Žåãæ¿èªããããã©ãã£ãã¯ã®ã¿èš±å¯ããããšã確èªããã | |
- 1.3 ã€ã³ã¿ãŒããããšã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãéã®ãçŽæ¥çãªãããªãã¯ã¢ã¯ã»ã¹ãçŠæ¢ããã: | |
- 1.3 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æã以äžã«èª¬æãããšããã«èª¿æ»ããã€ã³ã¿ãŒããããšå éšã®ã«ãŒãäŒå¡ãããã¯ãŒã¯ã»ã°ã¡ã³ãã®ã·ã¹ãã ã³ã³ããŒãã³ãéã«çŽæ¥ã¢ã¯ã»ã¹ããªãããšã確èªãããã·ã¹ãã ã³ã³ããŒãã³ãã«ã¯ãã€ã³ã¿ãŒãããã®ãã§ãŒã¯ã«ãŒã¿ãŒãDMZã«ãŒã¿ãŒããã³ãã¡ã€ã¢ãŠã©ãŒã«ãDMZã«ãŒãäŒå¡ã»ã°ã¡ã³ããå¢çã«ãŒã¿ãŒãå éšã®ã«ãŒãäŒå¡ãããã¯ãŒã¯ã»ã°ã¡ã³ããªã©ãå«ãŸããã | |
- 1.3.1 DMZ ãå®è£ ããæ¿èªãããå ¬éãµãŒãã¹ããããã³ã«ãããŒããæäŸããã·ã¹ãã ã³ã³ããŒãã³ãã®ã¿ãžã®çä¿¡ãã©ãã£ãã¯ã«å¶éããã: | |
- 1.3.1 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ããDMZ ãå®è£ ãããæ¿èªãããå ¬éãµãŒãã¹ããããã³ã«ãããŒããæäŸããã·ã¹ãã ã³ã³ããŒãã³ãã®ã¿ãžã®çä¿¡ãã©ãã£ãã¯ã«å¶éããŠããããšã確èªããã | |
- 1.3.2 çä¿¡ã€ã³ã¿ãŒããããã©ãã£ãã¯ãDMZå ã®IPã¢ãã¬ã¹ã«å¶éããã: | |
- 1.3.2 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ããçä¿¡ã€ã³ã¿ãŒããããã©ãã£ãã¯ããDMZ å ã® IP ã¢ãã¬ã¹ã«å¶éãããŠããããšã確èªããã | |
- 1.3.3 ã€ã³ã¿ãŒããããšã«ãŒãäŒå¡ããŒã¿ç°å¢éãã©ãã£ãã¯ã®ããã¹ãŠã®çŽæ¥æ¥ç¶(çä¿¡/çºä¿¡)ã䜿çšäžå¯ã«ããã: | |
- 1.3.3 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ããã€ã³ã¿ãŒããããšã«ãŒãäŒå¡ããŒã¿ç°å¢éãã©ãã£ãã¯ã®çŽæ¥çµè·¯ïŒçä¿¡/çºä¿¡ïŒããªãããšã確èªãã | |
- 1.3.4 ã¢ã³ãã¹ããŒãã£ã³ã°å¯Ÿçãå®æœããåœã®éä¿¡å IP ã¢ãã¬ã¹ãæ€åºããŠããããã¯ãŒã¯ã«äŸµå ¥ãããªãããã«ãããã¯ããã\nïŒããšãã°ãå éšéä¿¡å ã¢ãã¬ã¹ãæã€ã€ã³ã¿ãŒãããããã®ãã©ãã£ãã¯ããããã¯ãããªã©ïŒ: | |
- 1.3.4 ãã¡ã€ã¢ãŠã©ãŒã«ããã³ã«ãŒã¿ãŒæ§æãæ€æ»ããããšãã°ãå éšã¢ãã¬ã¹ãã€ã³ã¿ãŒãããããDMZå ãžééã§ããªããªã©ãã¹ããŒãã£ã³ã°å¯Ÿçãå®è£ ãããŠããããšã確èªããã | |
- 1.3.5 ã«ãŒãäŒå¡ããŒã¿ç°å¢ããã€ã³ã¿ãŒããããžã®çºä¿¡ãã©ãã£ãã¯ãçŠæ¢ããã: | |
- 1.3.5 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ããã«ãŒãäŒå¡ããŒã¿ç°å¢ããã€ã³ã¿ãŒããããžã®çºä¿¡ãã©ãã£ãã¯ãæ瀺çã«æ¿èªãããŠããããšã確èªããã | |
- 1.3.6 åçãã±ãããã£ã«ã¿ãªã³ã°ãšãåŒã°ãããã¹ããŒããã«ã€ã³ã¹ãã¯ã·ã§ã³ãå®è£ ããã(ãããã¯ãŒã¯å ãžã¯ãã確ç«ããããæ¥ç¶ã®ã¿èš±å¯ãããã): | |
- 1.3.6 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ãããã¡ã€ã¢ãŠã©ãŒã«ãã¹ããŒããã«ã€ã³ã¹ãã¯ã·ã§ã³ïŒåçãã±ãããã£ã«ã¿ãªã³ã°ïŒãå®è¡ããããšã確èªãããïŒç¢ºç«ãããæ¥ç¶ã®ã¿èš±å¯ãããåã«ç¢ºç«ãããã»ãã·ã§ã³ã«é¢é£ä»ããããŠããå Žåã«ã®ã¿èš±å¯ãããå¿ èŠããããïŒ | |
- 1.3.7 DMZ ããã®ä»ã®ä¿¡é Œã§ããªããããã¯ãŒã¯ããéé¢ãããŠããå éšãããã¯ãŒã¯ãŸãŒã³ã§ãã«ãŒãäŒå¡ããŒã¿ãä¿åããã³ã³ããŒãã³ãïŒããŒã¿ããŒã¹ïŒãå®è£ ãããŠããã: | |
- 1.3.7 ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ããDMZ ããã®ä»ã®ä¿¡é Œã§ããªããããã¯ãŒã¯ããéé¢ãããŠããå éšãããã¯ãŒã¯ãŸãŒã³ã§ãã«ãŒãäŒå¡ããŒã¿ãä¿åããã·ã¹ãã ã³ã³ããŒãã³ãã確èªããã | |
- 1.3.8 ãã©ã€ããŒã IP ã¢ãã¬ã¹ãšã«ãŒãã£ã³ã°æ å ±ãèš±å¯ãããŠããªã第äžè ã«é瀺ããªãã\næ³šïŒ IP ã¢ãã¬ã¹ãé瀺ããªãæ¹æ³ã«ã¯ã以äžã®ãã®ãå«ãŸãããããããã«éå®ãããããã§ã¯ãªã:\nã»ãããã¯ãŒã¯ã¢ãã¬ã¹å€æïŒNATïŒ\nã»ã«ãŒãäŒå¡ããŒã¿ãä¿æãããµãŒãããããã·ãµãŒã/ãã¡ã€ã¢ãŠã©ãŒã«ã®èåŸã«é 眮ããã\nã» ç»é²ãããã¢ãã¬ã¹æå®ã䜿çšãããã©ã€ããŒããããã¯ãŒã¯ã®ã«ãŒãã¢ããã¿ã€ãºãåé€ãããããã£ã«ã¿ãªã³ã°ããã\nã» ç»é²ãããã¢ãã¬ã¹ã®ä»£ããã«RFC1918 ã¢ãã¬ã¹ç©ºéãå éšã§äœ¿çšããã: | |
- 1.3.8.a ãã¡ã€ã¢ãŠã©ãŒã«/ã«ãŒã¿ãŒæ§æãæ€æ»ãããã©ã€ããŒã IP ã¢ãã¬ã¹ããã³å éšãããã¯ãŒã¯ããã€ã³ã¿ãŒããããžã®ã«ãŒãã£ã³ã°æ å ±ãé瀺ããªãæ¹æ³ãå°å ¥ãããŠããããšã確èªããã | |
- 1.3.8.b æ åœè ã®ã€ã³ã¿ãã¥ãŒãææžã®èª¿æ»ã«ãããã©ã®ãã©ã€ããŒãIPã¢ãã¬ã¹ããã³å€éšäºæ¥äœãžã®ã«ãŒãã£ã³ã°æ å ±é瀺ã«ãèš±å¯ãå¿ èŠã§ããããšã確èªããã | |
- 1.4 ã€ã³ã¿ãŒãããã«çŽæ¥æ¥ç¶ãããã¹ãŠã®ã¢ãã€ã«ããã€ã¹ãŸãã¯åŸæ¥å¡ææã®ããã€ã¹ïŒãããã¯ãã®äž¡æ¹ïŒã§ããããã¯ãŒã¯ã®å€åŽã§ã¯ã€ã³ã¿ãŒãããã«æ¥ç¶ããããŸããããã¯ãŒã¯ãžã®ã¢ã¯ã»ã¹ã«ã䜿çšããããã®ã«ïŒåŸæ¥å¡ã䜿çšããã©ããããããªã©ïŒãããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã€ã³ã¹ããŒã«ããããã¡ã€ã¢ãŠã©ãŒã«æ§æã«ã¯ä»¥äžãå«ãŸããŸãã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢å°çšã®æ§æèšå®ãå®çŸ©ãããŠããããš\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã¢ã¯ãã£ãã«å®è¡äžã§ããããš\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã¢ãã€ã«ããã€ã¹ãŸãã¯åŸæ¥å¡ææã®ããã€ã¹ã®ãŠãŒã¶ã«ãã£ãŠå€æŽãããŠããªãããš: | |
- 1.4.a ããªã·ãŒãšæ§æåºæºã調ã¹ãŠä»¥äžã確èªããïŒ\n⢠ãããã¯ãŒã¯å€ã§ã€ã³ã¿ãŒãããã«æ¥ç¶ãããããã¯ãŒã¯ãžã®ã¢ã¯ã»ã¹ã«ã䜿çšãããããã¹ãŠã®ã¢ãã€ã«ããã€ã¹ãŸãã¯åŸæ¥å¡ææã®ããã€ã¹ïŒãããã¯ãã®äž¡æ¹ïŒã«ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãå¿ èŠãšãããŠãã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢å°çšã®æ§æèšå®ãå®çŸ©ãããŠãã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã¢ã¯ãã£ãã«å®è¡ããããã«æ§æãããŠãã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ã®æ§æãã¢ãã€ã«ããã€ã¹ãåŸæ¥å¡ææã®ããã€ã¹ã®ãŠãŒã¶ã«ãã£ãŠå€æŽã§ããªãããã«ãªã£ãŠãã | |
- 1.4.b ã¢ãã€ã«ããã€ã¹ãŸãã¯åŸæ¥å¡ææããã€ã¹ïŒãŸãã¯ãã®äž¡æ¹ïŒãæ€æ»ããŠã以äžã確èªããã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã€ã³ã¹ããŒã«ãããŠãããçµç¹ã®æ§æèšå®ã«åŸã£ãŠèšå®ãããŠãã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã¢ã¯ãã£ãã«å®è¡äžã§ãã\n⢠ããŒãœãã«ãã¡ã€ã¢ãŠã©ãŒã«ãœãããŠã§ã¢ãã¢ãã€ã«ããã€ã¹ãŸãã¯åŸæ¥å¡ææã®ããã€ã¹ã®ãŠãŒã¶ã«ãã£ãŠå€æŽããŠããªã | |
- 1.5 ãã¡ã€ã¢ãŠã©ãŒã«ã®ç®¡çã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåããã³äœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠããããšã確èªããã: | |
- 1.5 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ããã¡ã€ã¢ãŠã©ãŒã«ã®ç®¡çã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶2ïŒã·ã¹ãã ãã¹ã¯ãŒãããã³ä»ã®ã»ãã¥ãªãã£ãã©ã¡ãŒã¿ã«ãã³ãæäŸã®ããã©ã«ãå€ã䜿çšããªã: | |
- 2.1 ã·ã¹ãã ããããã¯ãŒã¯ã«å°å ¥ããåã«ãå¿ ããã³ãæäŸã®ããã©ã«ãå€ãå€æŽããäžèŠãªããã©ã«ãã¢ã«ãŠã³ããç¡å¹ã«ããã\nããã¯ããªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãã»ãã¥ãªãã£ãµãŒãã¹ãæäŸãããœãããŠã§ã¢ãã¢ããªã±ãŒã·ã§ã³ãã·ã¹ãã ã¢ã«ãŠã³ãããã€ã³ããªãã»ãŒã«ã¹ïŒPOSïŒç«¯æ«ãç°¡æãããã¯ãŒã¯ç®¡çãããã³ã«ïŒSNMPïŒã³ãã¥ããã£æååã§äœ¿çšãããããããã«éå®ãããªãããã¹ãŠã®ããã©ã«ããã¹ã¯ãŒãã«é©çšãããŸãã: | |
- 2.1.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãéžæãããã³ãæäŸã®ããã©ã«ãã®ã¢ã«ãŠã³ããšãã¹ã¯ãŒãã䜿çšããŠããã€ã¹ãžã®ãã°ãªã³ãè©Šã¿ïŒã·ã¹ãã 管çè ã®ååãåŸãŠïŒããã¹ãŠã®ããã©ã«ããã¹ã¯ãŒãïŒãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãã»ãã¥ãªãã£ãµãŒãã¹ãæäŸãããœãããŠã§ã¢ãã¢ããªã±ãŒã·ã§ã³ãã·ã¹ãã ã¢ã«ãŠã³ããPOS 端æ«ãç°¡æãããã¯ãŒã¯ç®¡çãããã³ã«ïŒSNMPïŒã³ãã¥ããã£æååã§äœ¿çšããããã®ãå«ãïŒãå€æŽãããŠããããšã確èªãããïŒãã³ãã®ããã¥ã¢ã«ããã³ã€ã³ã¿ãŒãããäžã®ãœãŒã¹ã䜿çšããŠããã³ãæäŸã®ã¢ã«ãŠã³ã/ãã¹ã¯ãŒããæ¢ããïŒ | |
- 2.1.b ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã§ããã¹ãŠã®äžèŠãªããã©ã«ãã¢ã«ãŠã³ããæ€èšŒããïŒãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãã»ãã¥ãªãã£ãœãããŠã§ã¢ãã¢ããªã±ãŒã·ã§ã³ãã·ã¹ãã ãPOS 端æ«ãSNMP ãªã©ã§äœ¿çšãããŠããã¢ã«ãŠã³ããå«ãïŒ ãåé€ãŸãã¯ç¡å¹åãããŠããããšã確èªããã | |
- 2.1.c æ åœè ãã€ã³ã¿ãã¥ãŒããé¢ä¿ææžã調ã¹ãŠã以äžã確èªããã\n⢠ã·ã¹ãã ããããã¯ãŒã¯ã«ã€ã³ã¹ããŒã«ããåã«ãã¹ãŠã®ãã³ãããã©ã«ãïŒãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãã»ãã¥ãªãã£ãµãŒãã¹ãæäŸãããœãããŠã§ã¢ãã¢ããªã±ãŒã·ã§ã³ãã·ã¹ãã ã¢ã«ãŠã³ããPOS 端æ«ãç°¡æãããã¯ãŒã¯ç®¡çãããã³ã«ïŒSNMPïŒã³ãã¥ããã£æååã®ããã©ã«ããã¹ã¯ãŒãïŒãå€æŽãããŠãã\n⢠ã·ã¹ãã ããããã¯ãŒã¯ã«ã€ã³ã¹ããŒã«ãããåã«ãã¹ãŠã®äžèŠãªããã©ã«ãã¢ã«ãŠã³ãïŒãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ãã»ãã¥ãªãã£ãœãããŠã§ã¢ãã¢ããªã±ãŒã·ã§ã³ãã·ã¹ãã ãPOS 端æ«ãSNMP ãªã©ã§äœ¿çšãããŠããã¢ã«ãŠã³ããå«ãïŒ ãåé€ãŸãã¯ç¡å¹åãããŠãã | |
- 2.1.1 ã«ãŒãäŒå¡ããŒã¿ç°å¢ã«æ¥ç¶ãããŠããããŸãã¯ã«ãŒãäŒå¡ããŒã¿ãäŒéããã¯ã€ã€ã¬ã¹ç°å¢ã®å Žåãã€ã³ã¹ããŒã«æã«ãã¹ãŠã®ã¯ã€ã€ã¬ã¹ãã³ãã®ããã©ã«ãå€ãå€æŽãããããã«ã¯ãããã©ã«ãã®ã¯ã€ã€ã¬ã¹æå·åããŒããã¹ã¯ãŒããSNMPã³ãã¥ããã£æååãå«ãŸãã(ãã ãããããã«éå®ãããªã)ã: | |
- 2.1.1 ã¯ã€ã€ã¬ã¹ç°å¢ã®ãã³ãããã©ã«ãèšå®ã«ã€ããŠã次ã®äºé ã確èªããã | |
- 2.1.1.a æ åœè ãã€ã³ã¿ãã¥ãŒããé¢ä¿ææžã調ã¹ãŠã以äžã確èªããã\n⢠æå·åããŒãã€ã³ã¹ããŒã«æã®ããã©ã«ãããå€æŽãããŠããããšã\n⢠æå·åããŒã®ç¥èãæã€äººç©ãé瀟ãŸãã¯ç°åãããã³ã«ããã®ããŒãå€æŽãããŠããããšã | |
- 2.1.1.b æ åœè ãã€ã³ã¿ãã¥ãŒããããªã·ãŒãšæé ã調ã¹ãããšã§ã以äžã確èªããã\n⢠ããã©ã«ãã® SNMP ã³ãã¥ããã£æååãã€ã³ã¹ããŒã«åŸã«å€æŽããå¿ èŠãããããšã\n⢠ã¢ã¯ã»ã¹ãã€ã³ãã®ããã©ã«ãã®ãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãã€ã³ã¹ããŒã«ããšã«å€æŽããå¿ èŠãããããšã | |
- 2.1.1.c ã·ã¹ãã 管çè ã®ååãåŸãŠããã³ãææžã調ã¹ãã¯ã€ã€ã¬ã¹ããã€ã¹ã«ãã°ã€ã³ããŠã以äžã確èªããã\n⢠ã¯ã€ã€ã¬ã¹ããã€ã¹ã®ããã©ã«ãã® SNMP ã³ãã¥ããã£æååãå€æŽãããŠããªãããšã\n⢠ã¢ã¯ã»ã¹ãã€ã³ãã®ããã©ã«ãã®ãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãå€æŽãããŠããªãããšã | |
- 2.1.1.d ãã³ãææžã調ã¹ãã¯ã€ã€ã¬ã¹æ§æèšå®ã芳å¯ããŠãã¯ã€ã€ã¬ã¹ããã€ã¹ã®ãã¡ãŒã ãŠã§ã¢ãã以äžã®åŒ·åãªæå·åããµããŒãããããã«æŽæ°ãããŠããããšã確èªããã\n⢠ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯çµç±ã§ã®èªèšŒ\n⢠ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯çµç±ã§ã®éä¿¡ | |
- 2.1.1.e ãã³ãææžã調ã¹ãã¯ã€ã€ã¬ã¹æ§æèšå®ã芳å¯ããããšã§ãå¿ èŠã«å¿ããŠãä»ã®ã»ãã¥ãªãã£ã«é¢ããã¯ã€ã€ã¬ã¹ãã³ãã®ããã©ã«ããå€æŽãããããšã確èªããã | |
- 2.2 ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã«ã€ããŠãæ§æåºæºãäœæããããã®åºæºã¯ããã¹ãŠã®æ¢ç¥ã®ã»ãã¥ãªãã£è匱æ§ãã«ããŒãããŸãæ¥çã§èªç¥ãããã·ã¹ãã 匷ååºæºãšäžèŽããŠããå¿ èŠãããã\næ¥çã§èªç¥ãããã·ã¹ãã 匷ååºæºã®ãœãŒã¹ã«ã¯ä»¥äžãå«ãŸãã(ãããã«éå®ãããªã)ã\n⢠Center for Internet Security(CIS)\n⢠åœéæšæºåæ©æ§(ISO)\n⢠SysAdmin Audit Network Security(SANS) \nInstitute\n⢠米åœåœç«æšæºæè¡ç 究æ(NIST): | |
- 2.2.a ãã¹ãŠã®ã¿ã€ãã®ã·ã¹ãã ã³ã³ããŒãã³ãã«ã€ããŠäŒæ¥ã®ã·ã¹ãã æ§æåºæºã調ã¹ãŠãã·ã¹ãã æ§æåºæºããæ¥çã§èªç¥ãããã·ã¹ãã 匷ååºæºãšäžèŽããŠããããšã確èªããã | |
- 2.2.b ããªã·ãŒã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã·ã¹ãã æ§æåºæºããæ°ããªè匱æ§ã®åé¡ãèŠã€ãã£ããšãã«ãèŠä»¶ 6.2 ã§èŠå®ãããŠããããã«æŽæ°ãããŠããããšã確èªãã | |
- 2.2.c ããªã·ãŒã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãæ°ããã·ã¹ãã ãæ§æããããšãã«ã·ã¹ãã æ§æåºæºãé©çšããããããã¯ãŒã¯ã«ã·ã¹ãã ãã€ã³ã¹ããŒã«ãããåã«ãã®å®è£ ãæ€èšŒãããããšã確èªããã | |
- 2.2.d ã·ã¹ãã æ§æåºæºã«ããã¹ãŠã®çš®é¡ã®ã·ã¹ãã ã³ã³ããŒãã³ãã«å¯Ÿãã以äžã®æé ãå«ãŸããŠããããšã確èªããã\n⢠ãã¹ãŠã®ãã³ãæäŸããã©ã«ãå€ãå€æŽããäžèŠãªããã©ã«ãã¢ã«ãŠã³ããåé€ãã\n⢠åããµãŒãã«ç°ãªã£ãã»ãã¥ãªãã£ã¬ãã«ãå¿ èŠãšããæ©èœãå ±åããªãããã«ã1 ã€ã®ãµãŒãã«ã¯ãäž»èŠæ©èœã 1 ã€ã ãå®è£ ãã\n⢠ã·ã¹ãã ã®æ©èœã«å¿ èŠãªå®å šæ§ã®é«ããµãŒãã¹ããããã³ã«ãããŒã¢ã³ãªã©ã®ã¿ãæå¹ã«ãã\n⢠å®å šã§ãªããšã¿ãªãããŠããå¿ èŠãªãµãŒãã¹ããããã³ã«ããŸãã¯ããŒã¢ã³ã«è¿œå ã®ã»ãã¥ãªãã£æ©èœãå®è£ ãã\n⢠ã·ã¹ãã ã»ãã¥ãªãã£ã®ãã©ã¡ãŒã¿ãã誀çšãé²ãããã«èšå®ãããŠãã\n⢠ã¹ã¯ãªããããã©ã€ããæ©èœããµãã·ã¹ãã ããã¡ã€ã«ã·ã¹ãã ãäžèŠãªWeb ãµãŒããªã©ãäžèŠãªæ©èœããã¹ãŠåé€ãã | |
- 2.2.1 åããµãŒãã«ç°ãªã£ãã»ãã¥ãªãã£ã¬ãã«ãå¿ èŠãšããæ©èœãå ±åããªãããã«ã1 ã€ã®ãµãŒãã«ã¯ãäž»èŠæ©èœã 1 ã€ã ãå®è£ ãããïŒããšãã°ãWe ãµãŒããããŒã¿ããŒã¹ãµãŒããDNS ã¯å¥ã ã®ãµãŒãã«å®è£ ããå¿ èŠããããïŒ\næ³šïŒ ä»®æ³åãã¯ãããžã䜿çšããŠããå Žåã¯ã1 ã€ã®ä»®æ³ã·ã¹ãã ã³ã³ããŒãã³ãã«äž»èŠæ©èœã 1 ã€ã ãå®è£ ããã: | |
- 2.2.1.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãéžæããã·ã¹ãã æ§æã調ã¹ãŠ 1 ã€ã®ãµãŒãã«äž»èŠæ©èœã 1 ã€ã ãå®è£ ãããŠããããšã確èªããã | |
- 2.2.1.b ä»®æ³ãã¯ãããžã䜿çšãããŠããå Žåã¯ãã·ã¹ãã æ§æã調ã¹ãŠã1 ã€ã®ä»®æ³ã·ã¹ãã ã³ã³ããŒãã³ããŸãã¯ããã€ã¹ã«äž»èŠæ©èœã 1 ã€ã ãå®è£ ãããŠããããšã確èªããã | |
- 2.2.2 ã·ã¹ãã ã®æ©èœã«å¿ èŠãªå®å šæ§ã®é«ããµãŒãã¹ããããã³ã«ãããŒã¢ã³ãªã©ã®ã¿ãæå¹ã«ããã: | |
- 2.2.2.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãéžæããæå¹ãªã·ã¹ãã ãµãŒãã¹ãããŒã¢ã³ããããã³ã«ãæ€æ»ããŠãå¿ èŠãªãµãŒãã¹ãŸãã¯ãããã³ã«ã ããæå¹ã«ãªã£ãŠããããšã確èªããã | |
- 2.2.2.b æå¹ã«ãªã£ãŠãããå®å šã§ãªããµãŒãã¹ãããŒã¢ã³ããããã³ã«ãç¹å®ããæ åœè ãã€ã³ã¿ãã¥ãŒããŠãããããææžåãããæ§æåºæºã«åŸã£ãŠæ£åœåãããŠããããšã確èªããã | |
- 2.2.3 å®å šã§ãªããšã¿ãªãããŠããå¿ èŠãªãµãŒãã¹ããããã³ã«ããŸãã¯ããŒã¢ã³ã«ã»ãã¥ãªãã£æ©èœãå®è£ ããïŒããšãã°ãSSHãSFTPãSSLããŸã㯠IPSec VPN ãªã©ã®å®å šãªãã¯ãããžã䜿çšããŠã NetBIOSããã¡ã€ã«å ±æãTelnetãFTP ãªã©ã®å®å šæ§ã®äœããµãŒãã¹ãä¿è·ãã: | |
- 2.2.3.a æ§æèšå®ã調ã¹ãŠãå®å šã§ãªããã¹ãŠã®ãµãŒãã¹ãããŒã¢ã³ããããã³ã«ã«å¯Ÿããã»ãã¥ãªãã£æ©èœãææžåããã³åæ ãããŠããããšã確èªããã | |
- 2.2.4 ã·ã¹ãã ã®èª€çšãé²æ¢ããããã«ã·ã¹ãã ã»ãã¥ãªãã£ãã©ã¡ãŒã¿ãæ§æããã: | |
- 2.2.4.a ã·ã¹ãã 管çè ãã»ãã¥ãªãã£ç®¡çè ã®ã€ã³ã¿ãã¥ãŒãè¡ããã·ã¹ãã ã³ã³ããŒãã³ãã®äžè¬çãªã»ãã¥ãªãã£ãã©ã¡ãŒã¿èšå®ã«é¢ããç¥èãããããšã確èªããã | |
- 2.2.4.b ã·ã¹ãã æ§æåºæºã調ã¹ãŠãäžè¬çãªã»ãã¥ãªãã£ãã©ã¡ãŒã¿èšå®ãå«ãŸããŠããããšã確èªããã | |
- 2.2.4.c ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãéžæããäžè¬çãªã»ãã¥ãªãã£ãã©ã¡ãŒã¿èšå®ã調ã¹ãŠãããããæ§æåºæºã«åŸã£ãŠæ£ããèšå®ãããŠããããšã確èªããã | |
- 2.2.5 ã¹ã¯ãªããããã©ã€ããæ©èœããµãã·ã¹ãã ããã¡ã€ã«ã·ã¹ãã ãããã³äžèŠãªWebãµãŒããªã©ããã¹ãŠã®äžèŠãªæ©èœãåé€ããã: | |
- 2.2.5.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãéžæããæ§æã調ã¹ãäžèŠãªæ©èœïŒã¹ã¯ãªããããã©ã€ããæ©èœããµãã·ã¹ãã ããã¡ã€ã«ã·ã¹ãã ãªã©ïŒããã¹ãŠåé€ãããŠããããšã確èªããã | |
- 2.2.5.b. ææžãšã»ãã¥ãªãã£ãã©ã¡ãŒã¿ã調ã¹ãŠãæå¹ãªæ©èœãææžåãããŠããŠãã»ãã¥ãªãã£ä¿è·ãããæ§æããµããŒãããŠããããšã確èªããã | |
- 2.2.5.c. ææžãšã»ãã¥ãªãã£ãã©ã¡ãŒã¿ã調ã¹ãŠãææžåãããæ©èœã ãããµã³ããªã³ã°ãããã·ã¹ãã ã³ã³ããŒãã³ãã«ååšããŠããããšã確èªããã | |
- 2.3 匷åãªæå·åã䜿çšããŠããã¹ãŠã®ã³ã³ãœãŒã«ä»¥å€ã®ç®¡çã¢ã¯ã»ã¹ãæå·åããã\nWebããŒã¹ã®ç®¡çãªã©éã³ã³ãœãŒã«ç®¡çã¢ã¯ã»ã¹ã«ã€ããŠã¯ãSSHãVPNããŸãã¯SSL/TLSãªã©ã®ãã¯ãããžã䜿çšããŸãã: | |
- 2.3 ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãéžæããã³ã³ãœãŒã«ä»¥å€ã®ç®¡çã¢ã¯ã»ã¹ãã以äžã«ãã£ãŠæå·åãããŠããããšã確èªããã | |
- 2.3.a åã·ã¹ãã ãžã®ç®¡çè ãã°ãªã³ã芳å¯ããã·ã¹ãã æ§æã調ã¹ãŠã管çè ã®ãã¹ã¯ãŒããèŠæ±ãããåã«ã匷åãªæå·åã¡ãœãããå®è¡ãããŠããããšã確èªããã | |
- 2.3.b ãµãŒãã¹ããã³ãã©ã¡ãŒã¿ãã¡ã€ã«ã·ã¹ãã ãã¬ãã¥ãŒããTelnet ããã®ä»ã®å®å šã§ãªããªã¢ãŒããã°ã€ã³ã³ãã³ããã³ã³ãœãŒã«å€ããã®ã¢ã¯ã»ã¹ã«äœ¿çšã§ããªãããšã確èªããã | |
- 2.3.c 管çè ã®åã·ã¹ãã ãžã®ãã°ãªã³ã芳å¯ããWeb ããŒã¹ã®ç®¡çã€ã³ã¿ãã§ãŒã¹ãžã®ç®¡çè ã¢ã¯ã»ã¹ãã匷åãªæå·æ¹åŒã§æå·åãããŠããããšã確èªããã | |
- 2.3.d ãã³ãææžã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ã䜿çšãã¯ãããžã®åŒ·åãªæå·åãæ¥çã®ãã¹ããã©ã¯ãã£ã¹ãšãã³ãã®æšå¥šäºé ã«åŸã£ãŠå°å ¥ãããŠããããšã確èªãã | |
- 2.4 PCI DSS ã®é©çšç¯å²ã§ããã·ã¹ãã ã³ã³ããŒãã³ãã®ã€ã³ãã³ããªãç¶æãã: | |
- 2.4.a ã·ã¹ãã ã®ã€ã³ãã³ããªã調ã¹ãŠãããŒããŠã§ã¢ãšãœãããŠã§ã¢ã®ã³ã³ããŒãã³ããªã¹ããç¶æãããŠãããããããã®æ©èœ/䜿çšã«é¢ãã説æãå«ãŸããŠããããšã確èªããã | |
- 2.4.b æ åœè ãã€ã³ã¿ãã¥ãŒããŠãææžåãããã€ã³ãã³ããªãææ°ç¶æ ã«ä¿ãããŠããããšã確èªããã | |
- 2.5 ãã³ãããã©ã«ãå€ããã³ãã®ä»ã®ã»ãã¥ãªãã£ãã©ã¡ãŒã¿ã®ç®¡çã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªãã: | |
- 2.5 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ããã³ããŒããã©ã«ããšãã®ä»ã®ã»ãã¥ãªãã£ãã©ã¡ãŒã¿ã®ç®¡çã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- 2.6 å ±æãã¹ãã£ã³ã°ãããã€ãã¯ãåäºæ¥äœã®ãã¹ãç°å¢ããã³ã«ãŒãäŒå¡ããŒã¿ãä¿è·ããå¿ èŠãããããããã®ãããã€ãã¯ãä»é²A:ãå ±æãã¹ãã£ã³ã°ãããã€ãã§ã®è¿œå PCIDSS èŠä»¶ãã«ç€ºãããŠããããã«ãç¹å®ã®èŠä»¶ãæºããå¿ èŠãããã: | |
- 2.6 å ±æãã¹ãã£ã³ã°ãããã€ãã® PCI DSS è©äŸ¡ã«ã€ããŠããä»é² A: å ±æãã¹ãã£ã³ã°ãããã€ãåãã® PCI DSS è¿œå èŠä»¶ãã«è©³ãã説æãããŠãããã¹ãæé A.1.1 ïœ A.1.4 ãå®è¡ããå ±æãã¹ãã£ã³ã°ãããã€ããäºæ¥äœïŒå çåºããã³ãµãŒãã¹ãããã€ãïŒã®ãã¹ãç°å¢ããã³ããŒã¿ãä¿è·ããŠããããšã確èªããã | |
- èŠä»¶3ïŒä¿åãããã«ãŒãäŒå¡ããŒã¿ãä¿è·ãã: | |
- 3.1 ããŒã¿ä¿åããã³å»æ£ããªã·ãŒãæé ãããã»ã¹ãå®è£ ãããã¹ãŠã®ã«ãŒãäŒå¡ããŒã¿ïŒCHDïŒã¹ãã¬ãŒãžã«å°ãªããšã以äžã®ãã®ãå«ãããã«ããããšã§ä¿åããã«ãŒãäŒå¡ããŒã¿ãæå°éã«æããã\nã»ä¿åããããŒã¿éãšä¿åæéããæ³åŸäžãèŠåäžãæ¥åäžå¿ èŠãªç¯å²ã«éå®ããã\nã»å¿ èŠæ§ããªããªã£ãå Žåã®ããŒã¿ãå®å šã«åé€ããããã®ããã»ã¹\nã»ã«ãŒãäŒå¡ããŒã¿ã®ç¹å®ã®ããŒã¿ä¿åèŠä»¶\nã»å®çŸ©ãããä¿åèŠä»¶ãè¶ ããã«ãŒãäŒå¡ããŒã¿ãå®å šã«å»æ£ããååæããšã®ããã»ã¹ã: | |
- 3.1.a ããŒã¿ã®ä¿åããã³å»æ£ã«ã€ããŠãããªã·ãŒãæé ãããã»ã¹ã調ã¹ãå°ãªããšã以äžã®ããšãå«ãŸããŠããããšã確èªããã\n⢠以äžãå«ãããŒã¿ä¿åã«ã€ããŠã®ãæ³åŸäžãèŠå¶äžãæ¥åäžã®èŠä»¶\n⢠ã«ãŒãäŒå¡ããŒã¿ã®ä¿åã«ã€ããŠã®ç¹å®ã®èŠä»¶ïŒã«ãŒãäŒå¡ããŒã¿ã¯ãX ã®æéãY ãšããæ¥åäžã®çç±ã§ä¿åããå¿ èŠãããããªã©ïŒã\n⢠æ³åŸäžãèŠå¶äžããŸãã¯æ¥åäžã®çç±ã§äžèŠã«ãªã£ãã«ãŒãäŒå¡ããŒã¿ã®å®å šãªåé€\n⢠ã«ãŒãäŒå¡ããŒã¿ã®ä¿åãã¹ãŠã察象ãšãã\n⢠å®çŸ©ãããä¿åèŠä»¶ãè¶ ããã«ãŒãäŒå¡ããŒã¿ãå®å šã«å»æ£ããååæããšã®ããã»ã¹ã | |
- 3.1.b æ åœè ãã€ã³ã¿ãã¥ãŒããŠã以äžã確èªããã\n⢠ä¿åãããŠããã«ãŒãäŒå¡ããŒã¿ã®å Žæãã¹ãŠãããŒã¿ä¿åããã³ç Žæ£ããã»ã¹ã«å«ãŸããŠããã\n⢠ã«ãŒãäŒå¡ããŒã¿ãèŠã€ããŠå®å šã«å»æ£ããååæããšã®èªåãŸãã¯æåããã»ã¹ãå«ãŸããŠããã\n⢠ã«ãŒãäŒå¡ããŒã¿ã®ãã¹ãŠã®å Žæã«å¯ŸããŠååæããšã®èªåãŸãã¯æåããã»ã¹ãå®æœãããŠããã | |
- 3.1.c ã«ãŒãäŒå¡ããŒã¿ãä¿åããã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«\n⢠ãã¡ã€ã«ãšã·ã¹ãã ã¬ã³ãŒãã調ã¹ãŠãä¿åãããŠããããŒã¿ãããŒã¿ä¿åããªã·ãŒã§å®çŸ©ãããèŠä»¶ãè¶ ããŠããªãããšã確èªããã\n⢠åé€æ¹æ³ã芳å¯ããŠãããŒã¿ãå®å šã«åé€ãããããšã確èªããã | |
- 3.2 æ¿èªåŸã«æ©å¯èªèšŒããŒã¿ãä¿åããªãïŒæå·åãããŠããå Žåã§ãïŒãæ©å¯èªèšŒããŒã¿ãåãåã£ãå ŽåãèªèšŒããã»ã¹ãå®äºã次第ãã¹ãŠã®ããŒã¿ã埩å äžå¯èœã«ããã\n以äžã®å Žåã«ãããŒã¿ãå®å šã«ä¿åãããå Žåã¯ãçºè¡è ãšäŒæ¥ããæ©å¯èªèšŒããŒã¿ãä¿åãããããçºè¡ãµãŒãã¹ããµããŒãããããšãå¯èœã§ããã\n⢠æ¥åäžã®çç±ããã\n⢠ããŒã¿ãå®å šã«ä¿åãããŠãã\næ©å¯èªèšŒããŒã¿ã«ã¯ã以éã®èŠä»¶ 3.2.1ïœ 3.2.3 ã§èšåãããŠããããŒã¿ãå«ãã: | |
- 3.2.a ãµãŒãã¹ã®çºè¡ããµããŒãããæ©å¯èªèšŒããŒã¿ãä¿åãã\nçºè¡è ãŸãã¯äŒç€Ÿã«ã€ããŠãæ©å¯èªèšŒããŒã¿ã®ä¿åã«é¢ããŠæ¥åäžã®çç±ãããããšã確èªããã | |
- 3.2.b ãµãŒãã¹ã®çºè¡ããµããŒãããæ©å¯èªèšŒããŒã¿ãä¿åããçºè¡è ãŸãã¯äŒç€Ÿã«ã€ããŠãããŒã¿ã¹ãã¢ãšã·ã¹ãã æ§æã調ã¹ãŠãæ©å¯èªèšŒããŒã¿ãã»ãã¥ãªãã£ã§ä¿åãããŠããããšã確èªããã | |
- 3.2.c ãã®ä»ã®ãã¹ãŠã®äºæ¥äœã§ã¯ãæ©å¯èªèšŒããŒã¿ãåä¿¡ããå Žåãããªã·ãŒãšæé ãã¬ãã¥ãŒããã·ã¹ãã æ§æã調ã¹ãŠãèªèšŒåŸã«ããŒã¿ãä¿åãããŠããªãããšã確èªããŸãã | |
- 3.2.d ãã®ä»ã®ãã¹ãŠã®äºæ¥äœã§ã¯ãæ©å¯èªèšŒããŒã¿ãåãåã£ãå Žåãæé ãã¬ãã¥ãŒããŠããŒã¿ãå®å šã«åé€ããããã»ã¹ã調ã¹ãããŒã¿ãå埩äžèœã§ããããšã確èªããã | |
- 3.2.1 ïŒã«ãŒãã®èé¢ããããäžã®åçã®ããŒã¿ãªã©ã«ããç£æ°ã¹ãã©ã€ãã®ïŒè¿œè·¡ããŒã¿ã®å®å šãªå 容ãä¿åããªãããã®ããŒã¿ã¯ãå šãã©ãã¯ããã©ãã¯ããã©ã㯠1ããã©ã㯠2ãç£æ°ã¹ãã©ã€ãããŒã¿ãšãåŒã°ããŸãã\næ³šïŒ éåžžã®ååŒéçšã§ã¯ãç£æ°ã¹ãã©ã€ãããã®ä»¥äžã®ããŒã¿èŠçŽ ãä¿åããå¿ èŠãçããå ŽåããããŸãã\nã» ã«ãŒãäŒå¡å\nã»ãã©ã€ããªã¢ã«ãŠã³ãçªå·ïŒPANïŒ\nã» æå¹æé\nã» ãµãŒãã¹ã³ãŒããªã¹ã¯ãæå°éã«æãããããååŒã«å¿ èŠãªããŒã¿èŠçŽ ã®ã¿ãä¿åããŸãã: | |
- 3.2.1 ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã§ãããŒã¿ãœãŒã¹ã調ã¹ããããã«ã¯ã以äžã®é ç®ãå«ãŸããããããã«éå®ãããªãããŸããã«ãŒãè£é¢ã®ç£æ°ã¹ãã©ã€ããŸãã¯ãããã®åçããŒã¿ããåŸããããã©ãã¯å 容ããæ¿èªåŸãä¿åãããŠããªãããšã確èªããã\nã»åä¿¡ãã©ã³ã¶ã¯ã·ã§ã³ããŒã¿\nã»ãã¹ãŠã®ãã°ïŒãã©ã³ã¶ã¯ã·ã§ã³ãå±¥æŽããããã°ããšã©ãŒãªã©ïŒ\nã»å±¥æŽãã¡ã€ã«\nã»ãã¬ãŒã¹ãã¡ã€ã«\nã»ããŒã¿ããŒã¹ã¹ããŒã\nã»ããŒã¿ããŒã¹ã³ã³ãã³ã | |
- 3.2.2 ã«ãŒããæ瀺ããªãååŒãæ€èšŒããããã«äœ¿çšããããã«ãŒãæ€èšŒã³ãŒããŸãã¯å€ïŒãã€ã¡ã³ãã«ãŒãã®åé¢ãŸãã¯èé¢ã«å°åãããŠãã 3 æ¡ãŸã㯠4 æ¡ã®æ°åïŒãä¿åããªãã: | |
- 3.2.2 ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠãã«ãŒãåé¢ãŸãã¯çœ²åæ¬ã«å°åãããŠãã 3 æ¡ãŸã㯠4 æ¡ã®ã«ãŒãæ€èšŒã³ãŒããŸãã¯å€ïŒCVV2ãCVC2ãCIDãCAV2 ããŒã¿ïŒãå«ã\nïŒãã ãããããã«éå®ãããªãïŒããŒã¿ãœãŒã¹ã調ã¹ãŠããããããæ¿èªåŸãä¿åãããªãããšã確èªããã\nã»åä¿¡ãã©ã³ã¶ã¯ã·ã§ã³ããŒã¿\nã»ãã¹ãŠã®ãã°ïŒãã©ã³ã¶ã¯ã·ã§ã³ãå±¥æŽããããã°ããšã©ãŒãªã©ïŒ\nã»å±¥æŽãã¡ã€ã«\nã»ãã¬ãŒã¹ãã¡ã€ã«\nã»ããŒã¿ããŒã¹ã¹ããŒã\nã»ããŒã¿ããŒã¹ã³ã³ãã³ã | |
- 3.2.3 å人èå¥çªå·ïŒPINïŒãŸãã¯æå·åãããPINãããã¯ãä¿åããªãã: | |
- 3.2.3 ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠãããŒã¿ãœãŒã¹ã調ã¹ããããã«ã¯ PIN ããã³æå·åããã PIN ãããã¯ããæ¿èªåŸãä¿åãããªãããšã®ç¢ºèªãå«ãŸããïŒãã ãããããã«éå®ãããªãïŒã\nã»åä¿¡ãã©ã³ã¶ã¯ã·ã§ã³ããŒã¿\nã»ãã¹ãŠã®ãã°ïŒãã©ã³ã¶ã¯ã·ã§ã³ãå±¥æŽããããã°ããšã©ãŒãªã©ïŒ\nã»å±¥æŽãã¡ã€ã«\nã»ãã¬ãŒã¹ãã¡ã€ã«\nã»ããŒã¿ããŒã¹ã¹ããŒã\nã»ããŒã¿ããŒã¹ã³ã³ãã³ã | |
- 3.3 衚瀺æã« PAN ããã¹ã¯ããŠïŒæåã® 6 æ¡ãšæåŸã® 4 æ¡ãæ倧衚瀺æ¡æ°ïŒãæ¥åäžã®æ£åœãªå¿ èŠæ§ãããé¢ä¿è ã ãã PAN å šäœãèŠãããšãã§ããããã«ãããæ³šïŒ ã«ãŒãäŒå¡ããŒã¿ã®è¡šç€ºïŒæ³åŸäžããŸãã¯ãã€ã¡ã³ãã«ãŒããã©ã³ãã«ãã POS ã¬ã·ãŒãèŠä»¶ãªã©ïŒã«é¢ããããããå³ããèŠä»¶ãããå Žåã¯ããã®èŠä»¶ããåªå ãããããšã¯ãããŸããã: | |
- 3.3.a PAN ã®è¡šç€ºããã¹ã¯ããããã®ãæžé¢ã«ããããªã·ãŒãšæé ã調ã¹ãŠã以äžã確èªããã\n⢠PAN å šäœã®è¡šç€ºãžã®ã¢ã¯ã»ã¹ãå¿ èŠãšãã圹å²ã®äžèŠ§ããå圹å²ããã®ãããªã¢ã¯ã»ã¹æš©ãæã€å¿ èŠæ§ã®æ£åœãªæ¥åäžã®çç±ãšå ±ã«ææžåãããŠããããšã\n⢠PAN ã¯ãæ¥åäžã®åæ³çãªå¿ èŠæ§ã«ãã PAN å šäœãèŠãå¿ èŠãããæ åœè ã®ã¿ã PAN å šäœã衚瀺ããããšãã§ããããã«ãã¹ã¯ããå¿ èŠãããã\n⢠PAN å šäœã衚瀺ããæ¿èªã®ãªã圹å²ã®è ã¯ãã¹ãŠããã¹ã¯ããã PAN ããèŠããªãããã | |
- 3.3.b ã·ã¹ãã æ§æã調ã¹ãŠãææžåãããæ¥åäžã®å¿ èŠæ§ã®ãããŠãŒã¶/圹å²ã«å¯ŸããŠã®ã¿ PAN å šäœã衚瀺ãããä»ã®ãã¹ãŠã®è¡šç€ºèŠæ±ã«å¯ŸããŠã¯ PAN ã¯ãã¹ã¯ãããããšã確èªããã | |
- 3.3.c PAN ã®è¡šç€ºïŒç»é¢ãçŽã®ã¬ã·ãŒããªã©ïŒã調ã¹ãŠãæ¥åäžã®åæ³çãªå¿ èŠæ§ã«ãã PAN å šäœãèŠãå¿ èŠã®ããå Žåãé€ããã«ãŒãäŒå¡ããŒã¿ã衚瀺ããéã« PAN ããã¹ã¯ãããããšã確èªããã | |
- 3.4 以äžã®ææ³ã䜿çšããŠããã¹ãŠã®ä¿åå Žæã§PANãèªã¿åãäžèœã«ãã(ããŒã¿ãã«ããžã¿ã«ã¡ãã£ã¢ãããã¯ã¢ããã¡ãã£ã¢ããã°ãå«ã)ã\n⢠匷åãªæå·åãããŒã¹ã«ããã¯ã³ãŠã§ã€ããã·ã¥(PANå šäœãããã·ã¥ããå¿ èŠããã)\n⢠ãã©ã³ã±ãŒã·ã§ã³(PANã®åãæšãŠãããã»ã°ã¡ã³ãã®çœ®ãæãã«ã¯ããã·ã¥ã䜿çšã§ããªã)\n⢠ã€ã³ããã¯ã¹ããŒã¯ã³ãšããã(ãããã¯å®å šã«ä¿åããå¿ èŠããã)\n⢠é¢é£ããããŒç®¡çããã»ã¹ããã³æé ã䌎ãã匷åãªæå·å\næ³šïŒ æªæã®ããå人ããã©ã³ã±ãŒã·ã§ã³ãããPANãšããã·ã¥åãããPANã®äž¡æ¹ãååŸããå Žåãå ã® PAN ãæ¯èŒç容æã«åçŸããããšãã§ããŸããããã·ã¥åããã³åãæšãŠããã PAN ã®åãããŒãžã§ã³ãäºæ¥äœã®ç°å¢ã«ååšããå Žåãå ã® PAN ãåæ§ç¯ããããã«ãããã·ã¥åããã³åãæšãŠãããããŒãžã§ã³ãé¢é£ä»ããããšã¯ã§ããªãããšã確èªããè¿œå ã³ã³ãããŒã«ãå°å ¥ããå¿ èŠããããŸãã: | |
- 3.4.a 以äžã®æ¹æ³ãçšããŠããã³ããã·ã¹ãã /ããã»ã¹ã®ã¿ã€ããæå·åã¢ã«ãŽãªãºã ïŒè©²åœããå ŽåïŒãªã©ãèšèŒããããPAN ã®ä¿è·ã«äœ¿çšãããŠããã·ã¹ãã ã«é¢ããææžã調ã¹ãã\n⢠匷åãªæå·åæè¡ãããŒã¹ã«ããã¯ã³ãŠã§ã€ããã·ã¥\n⢠ãã©ã³ã±ãŒã·ã§ã³\n⢠ã€ã³ããã¯ã¹ããŒã¯ã³ãšããã(ãããã¯å®å šã«ä¿åããå¿ èŠããã)\n⢠é¢é£ããããŒç®¡çããã»ã¹ããã³æé ã䌎ãã匷åãªæå·å | |
- 3.4.b ããŒã¿ãªããžããªã®ãµã³ãã«ããè€æ°ã®ããŒãã«ãŸãã¯ãã¡ã€ã«ãæ€æ»ããPANãèªã¿åãäžèœã«ãªã£ãŠããããšã確èªããïŒå¹³æã§ä¿åãããŠããªãïŒã | |
- 3.4.c ãªã ãŒããã«ã¡ãã£ã¢ïŒããã¯ã¢ããããŒããªã©ïŒãæ€æ»ããPAN ãèªã¿åãäžèœã§ããããšã確èªããã | |
- 3.4.d ç£æ»ãã°ã®ãµã³ãã«ãæ€æ»ããPAN ãèªã¿åãäžèœã§ããããšã確èªããã | |
- 3.4.1 ïŒãã¡ã€ã«ãŸãã¯åã¬ãã«ã®ããŒã¿ããŒã¹æå·åã§ã¯ãªãïŒãã£ã¹ã¯æå·åã䜿çšãããå Žåãè«çã¢ã¯ã»ã¹ã¯ãã€ãã£ããªãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®èªèšŒããã³ã¢ã¯ã»ã¹å¶åŸ¡ã¡ã«ããºã ãšã¯å¥ã«ç®¡çããå¿ èŠãããïŒããŒã«ã«ãŠãŒã¶ã¢ã«ãŠã³ãããŒã¿ããŒã¹ãäžè¬çãªãããã¯ãŒã¯ãã°ã€ã³è³æ Œæ å ±ã䜿çšããªããªã©ã®æ¹æ³ã§ïŒã埩å·ããŒããŠãŒã¶ã¢ã«ãŠã³ããš\né¢é£ä»ããããŠããªã: | |
- 3.4.1.a ãã£ã¹ã¯æå·åã䜿çšããŠããå Žåãæ§æã調ã¹ãŠãèªèšŒããã»ã¹ã芳å¯ããæå·åããããã¡ã€ã«ã·ã¹ãã ãžã®è«çã¢ã¯ã»ã¹ãããã€ãã£ããªãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®ã¡ã«ããºã ãšã¯å¥ã®ã¡ã«ããºã ã§å®è£ ãããŠããããšã確èªãã\nïŒããŒã«ã«ãŠãŒã¶ã¢ã«ãŠã³ãããŒã¿ããŒã¹ãäžè¬çãªãããã¯ãŒã¯ãã°ã€ã³è³æ Œæ å ±ã䜿çšããªããªã©ã®æ¹æ³ã§ïŒã | |
- 3.4.1.b ããã»ã¹ã芳å¯ããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãæå·åããŒãå®å šã«ä¿åãããŠããããšã確èªããïŒåŒ·åãªã¢ã¯ã»ã¹å¶åŸ¡ã§é©åã«ä¿è·ãããŠãããªã ãŒããã«ã¡ãã£ã¢ã«ä¿åãããŠãããªã©ïŒã | |
- 3.4.1.c æ§æã調ã¹ãŠãããã»ã¹ã芳å¯ããããšã§ãã©ãã«ä¿åãããŠããå Žåã§ãããªã ãŒããã«ã¡ãã£ã¢ã®ã«ãŒãäŒå¡ããŒã¿ãæå·åãããŠããããšã確èªããã\næ³šïŒ ãã£ã¹ã¯æå·åããªã ãŒããã«ã¡ãã£ã¢ã®æå·åã«äœ¿çšãããŠããªãå Žåã¯ããã®åªäœã«ä¿åãããããŒã¿ããä»ã®æ¹æ³ã䜿ã£ãŠãèªã¿åãäžèœã«ããå¿ èŠããããŸãã | |
- 3.5 ã«ãŒãäŒå¡ããŒã¿ãæŒæŽ©ãšèª€çšããä¿è·ããããã«äœ¿çšãããããŒãä¿è·ããããã®æé ãææžåããå®æœããã\næ³šïŒ ãã®èŠä»¶ã¯ãä¿åãããŠããã«ãŒãäŒå¡ããŒã¿ãæå·åããããŒã«é©çšããããŸãããŒã¿æå·åããŒã®ä¿è·ã«äœ¿çšããããŒæå·åããŒã«ãé©çšããããã€ãŸããããŒæå·åããŒã¯ãå°ãªããšãããŒã¿æå·åããŒãšåã匷床ãæã€å¿ èŠãããã: | |
- 3.5 ããŒç®¡çããªã·ãŒãšæé ã調ã¹ãŠãããã»ã¹ãã«ãŒãäŒå¡ããŒã¿ãæå·åããããŒãæŒæŽ©ãšèª€äœ¿çšããä¿è·ããæå®ãšãªã£ãŠãããå°ãªããšã以äžãå«ãããšã確èªããã\n⢠æå·åããŒãžã®ã¢ã¯ã»ã¹ãå¿ èŠæå°éã®ç®¡çè ã«å¶éãããŠãã\n⢠ããŒæå·åããŒãå°ãªããšãä¿è·å¯Ÿè±¡ããŒã¿ã®æå·åããŒãšåã匷床ãæã€\n⢠ããŒæå·åããŒãããŒã¿æå·åããŒãšã¯å¥ã«ä¿åãããŠãã\n⢠ããŒã®ä¿åå Žæãšåœ¢åŒãæå°éã«ããå®å šã«ä¿åãã | |
- 3.5.1 æå·åããŒãžã®ã¢ã¯ã»ã¹ããå¿ èŠæå°éã®ç®¡çè ã«å¶éããã: | |
- 3.5.1 ãŠãŒã¶ã¢ã¯ã»ã¹ãªã¹ãã調æ»ããããŒãžã®ã¢ã¯ã»ã¹ãå¿ èŠæå°éã®ç®¡çè ã«å¶éãããŠããããšã確èªããã | |
- 3.5.2 ã«ãŒãäŒå¡ããŒã¿ã®æå·åã«äœ¿çšãããç§å¯æå·åããŒã¯ã以äžã®ããããã®åœ¢åŒïŒè€æ°å¯ïŒã§åžžæä¿åããã\n⢠å°ãªããšãããŒã¿æå·åããŒãšåã匷床ã®ããŒæå·åããŒã§æå·åãããŠãããããŒã¿æå·åããŒãšã¯å¥ã®å Žæã«ä¿åãããŠãã\n⢠å®å šãªæå·åããã€ã¹ïŒãã¹ãã»ãã¥ãªãã£ã¢ãžã¥ãŒã«ïŒHSMïŒãŸã㯠PTS æ¿èªã®å çåºç«¯æ«è£ 眮ãªã©ïŒå \n⢠æ¥çæ¿èªã®æ¹åŒã«åŸããå°ãªããšã 2 ã€ã®å šé·ããŒã³ã³ããŒãã³ããŸãã¯ããŒå ±æãšããŠ\næ³šïŒ å ¬éããŒããããã®åœ¢åŒã§ä¿åãããŠããããšã¯èŠæ±ãããŠããŸããã: | |
- 3.5.2.a ææžåãããæé ã調ã¹ãŠãã«ãŒãäŒå¡ããŒã¿ã®æå·åã«äœ¿çšãããæå·åããŒãåžžã«ä»¥äžã®ããããã®åœ¢åŒã§ã®ã¿ååšããããšã確èªããã\n⢠å°ãªããšãããŒã¿æå·åããŒãšåã匷床ã®ããŒæå·åããŒã§æå·åãããŠãããããŒã¿æå·åããŒãšã¯å¥ã®å Žæã«ä¿åãããŠãã\n⢠å®å šãªæå·åããã€ã¹ïŒãã¹ãã»ãã¥ãªãã£ã¢ãžã¥ãŒã«ïŒHSMïŒãŸã㯠PTS æ¿èªã®å çåºç«¯æ«è£ 眮ãªã©ïŒå \n⢠æ¥çæ¿èªã®æ¹åŒã«åŸããããŒã³ã³ããŒãã³ããŸãã¯ããŒå ±æãšã㊠| |
- 3.5.2.b ã·ã¹ãã æ§æãšããŒä¿åå Žæã調ã¹ãŠãã«ãŒãäŒå¡ããŒã¿ã®æå·åã«äœ¿çšãããæå·åããŒãåžžã«æ¬¡ã®ããããã®åœ¢åŒïŒè€æ°å¯ïŒã§ååšããŠããããšã確èªããã\n⢠ããŒæå·åããŒä»ãæå·å\n⢠å®å šãªæå·åããã€ã¹ïŒãã¹ãã»ãã¥ãªãã£ã¢ãžã¥ãŒã«ïŒHSMïŒãŸã㯠PTS æ¿èªã®å çåºç«¯æ«è£ 眮ãªã©ïŒå \n⢠æ¥çæ¿èªã®æ¹åŒã«åŸããããŒã³ã³ããŒãã³ããŸãã¯ããŒå ±æãšã㊠| |
- 3.5.2.c ããŒæå·åããŒã䜿çšããå Žåãã·ã¹ãã æ§æãšããŒä¿åå Žæã調ã¹ãŠã以äžã確èªããã\n⢠ããŒæå·åããŒãå°ãªããšãä¿è·å¯Ÿè±¡ããŒã¿ã®æå·åããŒãšåã匷床ãæã€\n⢠ããŒæå·åããŒãããŒã¿æå·åããŒãšã¯å¥ã«ä¿åãããŠãã | |
- 3.5.3 æå·åããŒãæå°éã®å Žæã«ä¿åããã: | |
- 3.5.3 ããŒã®ä¿åå Žæã調ã¹ãããã»ã¹ã芳å¯ããå¿ èŠæå°éã®å Žæã«ããŒãä¿åãããŠããããšã確èªããã | |
- 3.6 ã«ãŒãäŒå¡ããŒã¿ã®æå·åã«äœ¿çšããã以äžã®æå·åããŒã®ããŒç®¡çããã»ã¹ããã³æé ããã¹ãŠææžåããå®è£ ãããããã«ã¯ã以äžãå«ãŸããã\n泚ïŒããŒç®¡çã«ã¯å€æ°ã®æ¥çæšæºããããNIST(http://csrc.nist.govãåç §)ãªã©ããŸããŸãªãªãœãŒã¹ããå ¥æå¯èœã§ããã: | |
- 3.6.a ãµãŒãã¹ãããã€ãçšã®è¿œå æé ïŒãµãŒãã¹ãããã€ããã«ãŒãäŒå¡ããŒã¿ã®äŒéã«äœ¿çšããããŒã顧客ãšå ±æããŠããå ŽåããµãŒãã¹ãããã€ãã顧客ã«æäŸããææžã調ã¹ãŠã以äžã®èŠä»¶ 3.6.1ã3.6.8 ã«åŸã£ãŠã顧客ã®ããŒïŒé¡§å®¢ãšãµãŒãã¹ãããã€ãéã§ããŒã¿ãäŒéããããã«äœ¿çšãããïŒãå®å šã«äŒéãä¿åãå€æŽããæ¹æ³ãèšè¿°ãããŠããããšã確èªããã | |
- 3.6.b ã«ãŒãäŒå¡ããŒã¿ã®æå·åã«äœ¿çšãããæå·åããŒã®ç®¡çæé ãšããã»ã¹ã調ã¹ãŠã以äžãè¡ãã | |
- 3.6.1 匷åãªæå·åããŒã®çæ: | |
- 3.6.1.a ããŒç®¡çæé ã«ã匷åãªããŒã®çææ¹æ³ãæå®ãããŠããããšã確èªããã | |
- 3.6.1.b ããŒã®çææ¹æ³ã芳å¯ããŠã匷åãªããŒãçæãããããšã確èªããã | |
- 3.6.2 å®å šãªæå·åããŒã®é åž: | |
- 3.6.2.a ããŒç®¡çæé ã«ãããŒã®å®å šãªé åžæ¹æ³ãæå®ãããŠããããšã確èªããã | |
- 3.6.2.b ããŒãé åžããæ¹æ³ã芳å¯ããããŒãå®å šã«é åžãããããšã確èªããã | |
- 3.6.3 å®å šãªæå·åããŒã®ä¿å: | |
- 3.6.3.a ããŒç®¡çæé ã«ãããŒã®å®å šãªä¿åæ¹æ³ãæå®ãããŠããããšã確èªããã | |
- 3.6.3.b ããŒãä¿åããæ¹æ³ã芳å¯ããŠãããŒãå®å šã«ä¿åãããããšã確èªããã | |
- 3.6.4 é¢é£ã¢ããªã±ãŒã·ã§ã³ãã³ããŸãã¯ããŒãªãŒããŒãå®çŸ©ããæ¥çã®ãã¹ããã©ã¯ãã£ã¹ããã³ã¬ã€ãã©ã€ã³(ããšãã°ãNIST Special Publication 800-57)ã«åºã¥ãããæå·åæéã®çµäºæç¹ã«å°éããããŒã®æå·åããŒã®å€æŽãæå·åæéã®çµäºæç¹ãšã¯ãããšãã°ãå®çŸ©ãããæéãçµéããåŸããŸãã¯ä»äžãããããŒã§äžå®éã®æå·åããã¹ããäœæããåŸ(ãŸãã¯ãã®äž¡æ¹)ã§ããã: | |
- 3.6.4.aããŒç®¡çæé ã«ã䜿çšãããŠããåããŒã¿ã€ãçšã®æå·åæéã®å®çŸ©ãå«ãŸããŠãããå®çŸ©ãããæå·åæéã®çµããã«è¡ãããŒå€æŽã®ããã»ã¹ãå®çŸ©ãããŠããããšã確èªããã | |
- 3.6.4.b æ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãå®çŸ©ãããæå·åæéã®çµããã«ããŒãå€æŽãããŠããããšã確èªããã | |
- 3.6.5 ã¯ãªã¢ããã¹ãããŒã®ç¥èãæã€åŸæ¥å¡ãé¢è·ãããªã©ãããŒã®æŽåæ§ãè匱ã«ãªã£ãŠããå ŽåããŸãã¯ããŒã®è匱æ§ãæªçšãããå¯èœæ§ãããå Žåã«å¿ èŠãªãããŒã®ç Žæ£ãŸãã¯åãæ¿ãïŒã¢ãŒã«ã€ããç Žå£ãç¡å¹åãªã©ïŒã\næ³šïŒ ç Žæ£ãããããŸãã¯åãæ¿ããããæå·åããŒãä¿æããå¿ èŠãããå Žåããã®ããŒãïŒããšãã°ãããŒæå·åããŒã䜿çšããããšã«ããïŒå®å šã«ã¢ãŒã«ã€ãããå¿ èŠããããã¢ãŒã«ã€ããããæå·åããŒã¯ã埩å·/æ€èšŒã®ç®çã®ããã«ã®ã¿äœ¿çšã§ããŸãã: | |
- 3.6.5.a ããŒç®¡çæé ã«ã以äžã®ããã»ã¹ãæå®ãããŠããããšã確èªããã\n⢠ããŒã®æŽåæ§ãè匱ã«ãªã£ããšãã®ããŒã®ç Žæ£ãŸãã¯åãæ¿ãã\n⢠䟵害ãããããšãããã£ãŠãããŸãã¯çãããããŒã®åãæ¿ãã\nâ¢ ç Žæ£ãããããŸãã¯åãæ¿ããããããŒãä¿æããå Žåããã®ããŒãæå·åæäœã«äœ¿çšãããŠããªãããšã | |
- 3.6.5.bãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ã以äžã®ããã»ã¹ãå®æœãããŠããããšã確èªããã\n⢠ããŒã®ç¥èãæã€åŸæ¥å¡ãéè·ããå Žåãªã©ãããŒã®æŽåæ§ãè匱ã«ãªã£ããšãã«å¿ èŠã«å¿ããŠããŒãç Žæ£ããããŸãã¯åãæ¿ããã\n⢠䟵害ãããããšãããã£ãŠãããŸãã¯çãããããŒãåãæ¿ããããŠããã\nâ¢ ç Žæ£ãããããŸãã¯åãæ¿ããããããŒãä¿æããå Žåããã®ããŒãæå·åæäœã«äœ¿çšãããŠããªãããšã | |
- 3.6.6 å¹³ææå·åããŒç®¡çãæåã§æäœããå ŽåãããŒã®ç¥èåå²ãšäºé管çã䜿çšããå¿ èŠãããã\næ³šïŒ æåã®ããŒç®¡çæäœã®äŸã«ã¯ãããŒã®çæãäŒéãèªã¿èŸŒã¿ãä¿åãç Žæ£ãªã©ãå«ãŸããŸããããããã«éå®ãããŸãã: | |
- 3.6.6.a æåã®å¹³æããŒç®¡çæé ã«ã以äžã®ããã»ã¹ãæå®ãããŠããããšã確èªããã\n⢠ããŒç¥èã®åå²ã«ãããããŒã³ã³ããŒãã³ãã 2 人以äžã®ç®¡çäžã«çœ®ãããå人ã¯èªåã®ããŒã³ã³ããŒãã³ãã«é¢ããç¥èããæããªãããã«ãããããã³\n⢠ããŒã®äºé管çã«ãããã©ã®ãããªããŒç®¡çæäœãè¡ãå Žåã«ã 2 人以äžãå¿ èŠãšããã©ã¡ããä»æ¹ã®èªèšŒæ å ±ïŒãã¹ã¯ãŒããããŒãªã©ïŒã«ã¢ã¯ã»ã¹ã§ããªãããã«ããã | |
- 3.6.6 b æ åœè ãã€ã³ã¿ãã¥ãŒãããããã»ã¹ã芳å¯ããŠãæåã®å¹³æããŒã次ã®æ¹æ³ã§ç®¡çãããŠããããšã確èªããã\n⢠ç¥èåå²ãããã³\n⢠äºé管ç | |
- 3.6.7 æå·åããŒã®äžæ£çœ®æã®é²æ¢ã: | |
- 3.6.7.a ããŒç®¡çæé ã§ãããŒã®äžæ£çœ®æãé²æ¢ããããã»ã¹ãæå®ãããŠããããšã確èªããŸãã | |
- 3.6.7.b æ åœè ãã€ã³ã¿ãã¥ãŒãããããã»ã¹ã芳å¯ããŠãããŒã®äžæ£çœ®æãé²æ¢ãããŠããããšã確èªããã | |
- 3.6.8 æå·åããŒç®¡çè ãèªèº«ã®è²¬åãç解ããããŒç®¡çè ãšããŠã®è²¬åãåè«Ÿããã: | |
- 3.6.8.a ããŒç®¡çæé ã«ãããŒç®¡çè ãèªèº«ã®è²¬åãç解ããããŒç®¡çè ãšããŠã®è²¬åãåè«Ÿããããšã瀺ãæžé¢ãŸãã¯é»åãã¡ã€ã«ãžã®çœ²åãèŠæ±ããããã»ã¹ãæå®ãããŠããããšã確èªããã | |
- 3.6.8.b ããŒç®¡çæé ã«ãããŒç®¡çè ãããŒç®¡çè ãšããŠã®è²¬åãç解ããåè«Ÿããããšãæžé¢ãŸãã¯é»åçã«ç€ºãææžãŸãã¯ä»ã®èšŒæ ã調ã¹ãã | |
- 3.7 ä¿åãããŠããã«ãŒãäŒå¡ããŒã¿ãä¿è·ããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåããã³äœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 3.7 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ãä¿åãããŠããã«ãŒãäŒå¡ããŒã¿ãä¿è·ããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶4ïŒãªãŒãã³ãªå ¬å ±ãããã¯ãŒã¯çµç±ã§ã«ãŒãäŒå¡ããŒã¿ãäŒéããå Žåãæå·åãã: | |
- 4.1 ãªãŒãã³ãªå ¬å ±ãããã¯ãŒã¯çµç±ã§æ©å¯æ§ã®é«ãã«ãŒãäŒå¡ããŒã¿ãäŒéããå Žåã以äžã®ãããªã匷åãªæå·åãšã»ãã¥ãªãã£ãããã³ã«ïŒSSL/TLSãIPSECãSSH ãªã©ïŒã䜿çšããŠä¿è·ããã\nâ¢ ä¿¡é Œã§ããããŒãšèšŒææžã®ã¿ãåãå ¥ãã\n⢠䜿çšãããŠãããããã³ã«ããå®å šãªããŒãžã§ã³ãŸãã¯æ§æã®ã¿ããµããŒãããŠãã\n⢠æå·åã®åŒ·åºŠã䜿çšäžã®æå·åæ¹åŒã«é©ããŠãã\nãªãŒãã³ãªå ¬å ±ãããã¯ãŒã¯ã®äŸãšããŠ\n以äžãæãããããããããã«éå®ãããªãã\nã»ã€ã³ã¿ãŒããã\nã»802.11 ãš BluetoothïŒãã«ãŒãã¥ãŒã¹ïŒãå«\nãã¯ã€ã€ã¬ã¹ãã¯ãããž\nã»Global System for Mobile communicationsïŒGSMïŒ ã Code division multiple accessïŒCDMAïŒ ãªã©ã®æºåž¯ç«¯æ«ãã¯ãããž\nã»General Packet Radio Service ïŒGPRSïŒ\nã» è¡æéä¿¡: | |
- 4.1 ã«ãŒãäŒå¡ããŒã¿ããªãŒãã³ãªå ¬å ±ãããã¯ãŒã¯çµç±ã§éåä¿¡ãããå Žæããã¹ãŠç¹å®ããææžåãããåºæºã調ã¹ãã·ã¹ãã æ§æãæ¯èŒããŠããã¹ãŠã®å Žæã§ã»ãã¥ãªãã£ãããã³ã«ãšåŒ·åãªæå·åã䜿çšãããŠããããšã確èªããã | |
- 4.1.a ææžåãããããªã·ãŒãšæé ã調ã¹ãŠã以äžã®ããã»ã¹ãæå®ãããŠããããšã確èªããã\nâ¢ ä¿¡é Œã§ããããŒãŸãã¯èšŒææžïŒãããã¯ãã®äž¡æ¹ïŒã®ã¿ãåãä»ããããŠãã\n⢠䜿çšãããŠãããããã³ã«ãå®å šãªããŒãžã§ã³ãšæ§æã®ã¿ããµããŒãããŠãããå®å šã§ãªãããŒãžã§ã³ãæ§æããµããŒããããªã\n⢠䜿çšäžã®æå·åææ³ã«ãé©åãªåŒ·åºŠã®æå·åãå®è£ ãããŠãã | |
- 4.1.b çºä¿¡ãšçä¿¡ãã©ã³ã¶ã¯ã·ã§ã³ã®ãµã³ãã«ãéžã³ããã©ã³ã¶ã¯ã·ã§ã³ãå®éã«èŠ³å¯ããã«ãŒãäŒå¡ããŒã¿ã転éäžã«åŒ·åãªæå·ã§æå·åãããŠãããã©ããã確èªããã | |
- 4.1.c ããŒ/蚌ææžã調ã¹ãŠãä¿¡é Œã§ããããŒ/蚌ææžã®ã¿ãåãä»ããããŠããããšã確èªããã | |
- 4.1.d ã·ã¹ãã æ§æã調ã¹ãŠããããã³ã«ã®å®å šãªæ§æã®ã¿ã䜿çšãããå®å šã§ãªãããŒãžã§ã³ãŸãã¯æ§æããµããŒããããªãããšã確èªããã | |
- 4.1.e ã·ã¹ãã æ§æã調ã¹ãŠã䜿çšäžã®æå·åææ³ã«ãé©åãªåŒ·åºŠã®æå·åãå®è£ ãããŠããããšã確èªããïŒãã³ãã®æšå¥šäºé /ãã¹ããã©ã¯ãã£ã¹ã確èªããïŒã | |
- 4.1.f SSL/TLS å®è£ ã®å ŽåïŒã·ã¹ãã æ§æã調ã¹ãŠãã«ãŒãäŒå¡ããŒã¿ã®éåä¿¡æã« SSL/TLS ãæå¹ã«ãªã£ãŠããããšã確èªããã\nããšãã°ããã©ãŠã¶ããŒã¹ã®å®è£ ã®å ŽåïŒ\nã» ãã©ãŠã¶ã® URL ãããã³ã«ãšã㊠HTTPS ã衚瀺ããã\nã»ã«ãŒãäŒå¡ããŒã¿ã¯ãURL ã« HTTPS ã衚瀺ãããå Žåã«ã®ã¿èŠæ±ããã | |
- 4.1.1 ã«ãŒãäŒå¡ããŒã¿ãäŒéããããŸãã¯ã«ãŒãäŒå¡ããŒã¿ç°å¢ã«æ¥ç¶ãããŠããã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ããèªèšŒããã³äŒéçšã«åŒ·åãªæå·åãå®è£ ãããããæ¥çã®ãã¹ããã©ã¯ãã£ã¹ïŒIEEE 802.11i èŠæ Œãªã©ïŒã䜿çšããŠããããšã確èªããã\næ³šïŒ ã»ãã¥ãªãã£å¶åŸ¡ãšããŠã® WEP ã®äœ¿çšã¯ãçŠæ¢ãããŠããŸãã: | |
- 4.1.1 ã«ãŒãäŒå¡ããŒã¿ãäŒéããããŸãã¯ã«ãŒãäŒå¡ããŒã¿ç°å¢ã«æ¥ç¶ãããŠãããã¹ãŠã®ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ãèå¥ãããææžåãããŠããåºæºã調ã¹ãã·ã¹ãã æ§æèšå®ãšæ¯èŒããŠãèå¥ããããã¹ãŠã®ã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ã«ã€ããŠä»¥äžã確èªããã\n⢠æ¥çã®ãã¹ããã©ã¯ãã£ã¹ïŒIEEE 802.11i ãªã©ïŒã䜿çšããŠèªèšŒããã³äŒéçšã®åŒ·åãªæå·åãå®è£ ãããŠããã\n⢠èªèšŒãéä¿¡ã®ã»ãã¥ãªãã£å¶åŸ¡ã«åŒ±ãæå·åïŒWEPãSSLããŒãžã§ã³ 2.0 以åãªã©ïŒã䜿çšãããŠããªãã | |
- 4.2 ä¿è·ãããŠããªãPANããšã³ããŠãŒã¶ã¡ãã»ãŒãžã³ã°ãã¯ãããž(é»åã¡ãŒã«ãã€ã³ã¹ã¿ã³ãã¡ãã»ãŒãžã³ã°ããã£ãããªã©)ã§éä¿¡ããªãã: | |
- 4.2.a ãšã³ããŠãŒã¶ã¡ãã»ãŒãžã³ã°ãã¯ãããžã䜿çšããŠã«ãŒãäŒå¡ããŒã¿ãéä¿¡ããå Žåã¯ãPAN ãéä¿¡ããããã»ã¹ã芳å¯ããéä¿¡å 容ã®ãµã³ãã«ã調æ»ããŠãPAN ãèªã¿åãäžèœã«ãããã匷åãªæå·åã§ä¿è·ããŠããããšã確èªããã | |
- 4.2.b ææžåãããŠããããªã·ãŒã調ã¹ãä¿è·ãããŠããªãPANããšã³ããŠãŒã¶ã¡ãã»ãŒãžã³ã°ãã¯ãããžãä»ããŠéä¿¡ãããªãããšãèšããããªã·ãŒã®ååšã確èªããã | |
- 4.3 ã«ãŒãäŒå¡ããŒã¿ã®äŒéãæå·åããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 4.3 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ãã«ãŒãäŒå¡ããŒã¿ã®äŒéãæå·åããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\nã» ææžåãããŠãã\n㻠䜿çšãããŠãã\n㻠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶5ïŒã¢ã³ããŠã£ã«ã¹ãœãããŠã§ã¢ãŸãã¯ããã°ã©ã ã䜿çšããå®æçã«æŽæ°ãã: | |
- 5.1 æªæã®ãããœãããŠã§ã¢ã®åœ±é¿ãåãããããã¹ãŠã®ã·ã¹ãã (ç¹ã«ããŒãœãã«ã³ã³ãã¥ãŒã¿ãšãµãŒã)ã«ãããŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãå°å ¥ããã: | |
- 5.1 æªæã®ãããœãããŠã§ã¢ã®åœ±é¿ãåãããããã¹ãŠã®ãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã¿ã€ããå«ããã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠãé©çšå¯èœãªãŠã£ã«ã¹å¯Ÿçãã¯ãããžãååšããå Žåã¯ããŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãå°å ¥ãããŠããããšã確èªããã | |
- 5.1.1 ãŠã£ã«ã¹å¯Ÿçããã°ã©ã ããæ¢ç¥ã®æªæã®ãããœãããŠã§ã¢ã®å šã¿ã€ãã«å¯ŸããŠãæ€åºãåé€ãä¿è·ãå¯èœã§ããããšã確èªããã: | |
- 5.1.1 ãã³ãææžãèªã¿ããŠã£ã«ã¹å¯Ÿçæ§æã調ã¹ãŠããŠã£ã«ã¹å¯Ÿçããã°ã©ã ã以äžãè¡ãããšã確èªãã\n⢠æ¢ç¥ã®æªæã®ãããœãããŠã§ã¢ã®å šã¿ã€ããæ€åºããã\n⢠æ¢ç¥ã®æªæã®ãããœãããŠã§ã¢ã®å šã¿ã€ããåé€ããã\n⢠æ¢ç¥ã®æªæã®ãããœãããŠã§ã¢ã®å šã¿ã€ãããä¿è·ããã\näŸãšããŠããŠã£ã«ã¹ãããã€ã®æšéŠ¬ãã¯ãŒã ãã¹ãã€ãŠã§ã¢ãã¢ããŠã§ã¢ãã«ãŒãããããªã©ããããŸãã | |
- 5.1.2 äžè¬çã«æªæã®ãããœãããŠã§ã¢ã«åœ±é¿ãããªããšã¿ãªãããŠããã·ã¹ãã ã§ã¯ãå®æçã«è©äŸ¡ãè¡ã£ãŠãé²åãç¶ãããã«ãŠã§ã¢ã®è åšãç¹å®ããŠè©äŸ¡ããããšã§ãã·ã¹ãã ã«ãŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãäŸç¶ãšããŠå¿ èŠãªããã©ãããå€æãã: | |
- 5.1.2.b æ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã·ã¹ãã ã«ãŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãäŸç¶ãšããŠå¿ èŠãªããã©ãããå€æããããã«ãé²åãç¶ãããã«ãŠã§ã¢ã®è åšã®ãäžè¬çã«æªæã®ãããœãããŠã§ã¢ã«åœ±é¿ãããªããšã¿ãªãããŠããã·ã¹ãã ã«å¯Ÿãã圱é¿ãç£èŠãããŠããããšã確èªããã | |
- 5.2 ãã¹ãŠã®ãŠã£ã«ã¹å¯Ÿçã¡ã«ããºã ã以äžã®ããã«ç¶æãããŠããããšã確èªããã\n⢠ææ°ã®ç¶æ ã§ãã\n⢠å®æçã«ã¹ãã£ã³ãè¡ã\n⢠PCI DSS èŠä»¶ 10.7 ã«åŸã£ãŠç£æ»ã\nã»ä¿æãã: | |
- 5.2 ãã¹ãŠã®ã¢ã³ããŠã£ã«ã¹ãœãããŠã§ã¢ãææ°ã§ãæå¹ã«å®è¡ãããŠãããç£æ»ãã°ãçæãããããšã確èªããããã«ã以äžã®é ç®ã確èªããã | |
- 5.2.a ããªã·ãŒãšæé ã調ã¹ãŠããŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ããã³å®çŸ©ãææ°ç¶æ ã«ä¿ã€ããšãèŠæ±ãããŠããããšã確èªããã | |
- 5.2.b ãœãããŠã§ã¢ã®ãã¹ã¿ã€ã³ã¹ããŒã«ãå«ãããŠã£ã«ã¹å¯Ÿçæ§æã調ã¹ãããšã§ããŠã£ã«ã¹å¯Ÿçã¡ã«ããºã ã以äžãæºããããšã確èªããã\n⢠èªåæŽæ°ãè¡ãããã«æ§æãããŠãã\n⢠å®æçã«ã¹ãã£ã³ãè¡ãããã«æ§æãããŠãã | |
- 5.2.c æªæã®ãããœãããŠã§ã¢ã®åœ±é¿ãåãããããã¹ãŠã®ãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã¿ã€ããå«ããã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠã以äžã確èªããã\n⢠ãŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãšå®çŸ©ãææ°ã§ããã\n⢠å®æçãªã¹ãã£ã³ãå®è¡ãããã | |
- 5.2.d ãœãããŠã§ã¢ã®ãã¹ã¿ã€ã³ã¹ããŒã«ãå«ãããŠã£ã«ã¹å¯Ÿçæ§æã調ã¹ãããšã§ããŠã£ã«ã¹å¯Ÿçã¡ã«ããºã ã以äžãæºããããšã確èªããã\n⢠ãŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãã°ã®çæãæå¹ã«ãªã£ãŠãã\n⢠ãã°ã PCI DSS èŠä»¶ 10.7 ã«åŸã£ãŠä¿æãããŠãã | |
- 5.3 ãŠã£ã«ã¹å¯Ÿçã¡ã«ããºã ãã¢ã¯ãã£ãã«å®è¡ãããŠãããçµå¶ç®¡çè ããã±ãŒã¹ãã€ã±ãŒã¹ã§æéãéã£ãŠç¹å¥ã«èš±å¯ãããªãéãããŠãŒã¶ãç¡å¹ã«ãããå€æŽã§ããªãããšã確èªããã\næ³šïŒ ãŠã£ã«ã¹å¯Ÿçãœãªã¥ãŒã·ã§ã³ã¯ãã±ãŒã¹ãã€ã±ãŒã¹ã§çµå¶ç®¡çè ã«ããèš±å¯ãããããšãåæã«ãæ£åœãªæè¡äžã®ããŒãºãããå Žåã«éããäžæçã«ç¡å¹ã«ããããšãã§ããŸããç¹å®ã®ç®çã§ã¢ã³ããŠã£ã«ã¹ä¿è·ãç¡å¹ã«ããå¿ èŠãããå Žåãæ£åŒãªèš±å¯ãåŸãå¿ èŠããããŸããã¢ã³ããŠã£ã«ã¹ä¿è·ãç¡å¹ã«ãªã£ãŠããéãè¿œå ã®ã»ãã¥ãªãã£æ段ãå¿ èŠã«ãªãå ŽåããããŸãã: | |
- 5.3.a ãœãããŠã§ã¢ã®ãã¹ã¿ã€ã³ã¹ããŒã«ãšã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãå«ãããŠã£ã«ã¹å¯Ÿçæ§æã調ã¹ãããšã§ããŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ãã¢ã¯ãã£ãã«å®è¡ãããŠããããšã確èªããã | |
- 5.3.b ãœãããŠã§ã¢ã®ãã¹ã¿ã€ã³ã¹ããŒã«ãšã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ãå«ãããŠã£ã«ã¹å¯Ÿçæ§æã調ã¹ãããšã§ããŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ããŠãŒã¶ã«ãã£ãŠç¡å¹åã»å€æŽã§ããªãããšã確èªããã | |
- 5.3.c 責任è ãã€ã³ã¿ãã¥ãŒããããã»ã¹ã芳å¯ããããšã§ããŠã£ã«ã¹å¯ŸçãœãããŠã§ã¢ã¯ãçµå¶ç®¡çè ããã±ãŒã¹ãã€ã±ãŒã¹ã§æéãéã£ãŠç¹å¥ã«èš±å¯ãããªãéãããŠãŒã¶ãç¡å¹åã»å€æŽã§ããªãããšã確èªããã | |
- 5.4 ãã«ãŠã§ã¢ããã·ã¹ãã ãä¿è·ããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 5.4 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ããã«ãŠã§ã¢ããã·ã¹ãã ãä¿è·ããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶6ïŒå®å šæ§ã®é«ãã·ã¹ãã ãšã¢ããªã±ãŒã·ã§ã³ãéçºããä¿å®ãã: | |
- 6.1 ã»ãã¥ãªãã£è匱æ§æ å ±ã®ä¿¡é Œã§ãã瀟å€æäŸå ã䜿ã£ãŠã»ãã¥ãªãã£ã®è匱æ§ãç¹å®ããæ°ãã«çºèŠãããã»ãã¥ãªãã£ã®è匱æ§ã«ãªã¹ã¯ã®ã©ã³ã¯ïŒãé«ãããäžãããäœããªã©ïŒãå²ãåœãŠãããã»ã¹ã確ç«ããã\næ³šïŒ ãªã¹ã¯ã®ã©ã³ã¯åãã¯ãæ¥çã®ãã¹ããã©ã¯ãã£ã¹ãšèãããã圱é¿ã®çšåºŠã«åºã¥ããŠããå¿ èŠããããŸããããšãã°ãè匱æ§ãã©ã³ã¯åãããåºæºã¯ãCVSS ããŒã¹ã¹ã³ã¢ããã³ãã«ããåé¡ã圱é¿ãåããã·ã¹ãã ã®çš®é¡ãªã©ãå«ãå ŽåããããŸãã\nè匱æ§ãè©äŸ¡ãããªã¹ã¯ã®ã©ã³ã¯ãå²ãåœãŠãæ¹æ³ã¯ãçµç¹ã®ç°å¢ãšãªã¹ã¯è©äŸ¡æŠç¥ã«ãã£ãŠç°ãªããŸãããªã¹ã¯ã®ã©ã³ã¯ã¯ãæå°éãç°å¢ã«å¯Ÿãããé«ãªã¹ã¯ããšã¿ãªããããã¹ãŠã®è匱æ§ãç¹å®ãããã®ã§ããå¿ èŠããããŸãããªã¹ã¯ã®ã©ã³ã¯åãã«å ããŠãç°å¢ã«å¯Ÿããå·®ãè¿«ã£ãè åšããããããéèŠã·ã¹ãã ã«åœ±é¿ãåãŒãã察åŠããªããšäŸµå®³ãããå±éºãããå Žåãè匱æ§ã¯ãé倧ããšã¿ãªãããŸããéèŠã·ã¹ãã ã®äŸãšããŠã¯ãã»ãã¥ãªãã£ã·ã¹ãã ãäžè¬å ¬éã®ããã€ã¹ãã·ã¹ãã ãããŒã¿ããŒã¹ãããã³ã«ãŒãäŒå¡ããŒã¿ãä¿åãåŠçãéä¿¡ããã·ã¹ãã ãªã©ããããŸãã: | |
- 6.1.a ããªã·ãŒãšæé ã調ã¹ã以äžã®ããã»ã¹ãå®çŸ©ãããŠããããšã確èªããã\n⢠æ°ããã»ãã¥ãªãã£ã®è匱æ§ã®èå¥\n⢠ãã¹ãŠã®ãé«ããªã¹ã¯ãšãé倧ããªè匱æ§ã®èå¥ãå«ãè匱æ§ã®ã©ã³ã¯åãã®å²ãåœãŠ\n⢠ã»ãã¥ãªãã£è匱æ§æ å ±ã®ä¿¡é Œã§ããå€éšæ å ±æºã®äœ¿çš | |
- 6.1.b æ åœè ãã€ã³ã¿ãã¥ãŒãããããã»ã¹ã芳å¯ããŠã以äžã確èªããã\n⢠æ°ããã»ãã¥ãªãã£ã®è匱æ§ãèå¥ãããŠãã\n⢠ãã¹ãŠã®ãé«ããªã¹ã¯ãšãé倧ããªè匱æ§ã®èå¥ãå«ãè匱æ§ã®ã©ã³ã¯åããå²ãåœãŠãããŠãã\n⢠æ°ããã»ãã¥ãªãã£ã®è匱æ§ãç¹å®ããããã»ã¹ã«ãã»ãã¥ãªãã£è匱æ§æ å ±ãåŸãããã®å€éšæ å ±æºã®äœ¿çšãå«ãŸããŠãã | |
- 6.2 ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ããšãœãããŠã§ã¢ã«ããã³ãæäŸã®ã»ãã¥ãªãã£ããããã€ã³ã¹ããŒã«ãããæ¢ç¥ã®è匱æ§ããä¿è·ãããŠãããéèŠãªã»ãã¥ãªãã£ãããã¯ããªãªãŒã¹åŸ 1 ã«æ以å ã«ã€ã³ã¹ããŒã«ããã\næ³šïŒ èŠä»¶ 6.1 ã§å®çŸ©ãããŠãããªã¹ã¯ã®ã©ã³ã¯åãããã»ã¹ã«åŸã£ãŠãéèŠãªã»ãã¥ãªãã£ããããèå¥ããå¿ èŠããããŸã: | |
- 6.2.a ã»ãã¥ãªãã£ãããã®ã€ã³ã¹ããŒã«ã«é¢é£ããããªã·ãŒãšæé ã調ã¹ãŠã以äžã®ããã»ã¹ãå®çŸ©ãããŠããããšã確èªããã\n⢠該åœããããã³ãæäŸã®éèŠã»ãã¥ãªãã£ãããã¯ããªãªãŒã¹åŸ 1 ã«æ以å ã«ã€ã³ã¹ããŒã«ããã\n⢠該åœããããã³ãæäŸã®ã»ãã¥ãªãã£ãããããã¹ãŠãé©åãªæéæ å ïŒ3 ã«æ以å ãªã©ïŒã«ã€ã³ã¹ããŒã«ããã | |
- 6.2.b ã·ã¹ãã ã³ã³ããŒãã³ãããã³é¢é£ãœãããŠã§ã¢ã®ãµã³ãã«ã«ã€ããŠãåã·ã¹ãã ã«ã€ã³ã¹ããŒã«ãããã»ãã¥ãªãã£ãããã®ãªã¹ããšããã³ãã®ææ°ã®ã»ãã¥ãªãã£ãããã®ãªã¹ããæ¯èŒããŠã以äžã確èªããã\n⢠該åœããããã³ãæäŸã®éèŠã»ãã¥ãªãã£ãããã¯ããªãªãŒã¹åŸ1 ã«æ以å ã«ã€ã³ã¹ããŒã«ããã\n⢠該åœãããã¹ãŠã®ãã³ããæäŸããã»ãã¥ãªãã£ãããã¯ãé©åãªæéæ ïŒããšãã° 3 ã«æ以å ïŒå ã«èšçœ®ãããŠããã | |
- 6.3 å éšããã³å€éšãœãããŠã§ã¢ã¢ããªã±ãŒã·ã§ã³ïŒã¢ããªã±ãŒã·ã§ã³ãžã® WebããŒã¹ã®ç®¡çã¢ã¯ã»ã¹ãå«ãïŒã次ã®ããã«éçºããã\n⢠PCI DSS ïŒå®å šãªèªèšŒããã®ã³ã°ãªã©ïŒã«åŸã£ãŠã\n⢠æ¥çåºæºããã¹ããã©ã¯ãã£ã¹ã«åºã¥ããŠã\n⢠ãœãããŠã§ã¢éçºã©ã€ããµã€ã¯ã«å šäœã«æ å ±ã»ãã¥ãªãã£ãçµã¿èŸŒãã\n泚ïŒããã¯ã瀟å éçºãœãããŠã§ã¢ãã¹ãŠãããã³ç¬¬äžè ã«ãã£ãŠéçºãããã«ã¹ã¿ã ãœãããŠã§ã¢ã«ãåœãŠã¯ãŸããŸãã: | |
- 6.3.a ææžåããããœãããŠã§ã¢éçºããã»ã¹ã調ã¹ãŠãããã»ã¹ãæ¥çæšæºãŸãã¯ãã¹ããã©ã¯ãã£ã¹ïŒãããã¯ãã®äž¡æ¹ïŒã«åºã¥ããŠããããšã確èªããã | |
- 6.3.b èšè¿°ããããœãããŠã§ã¢éçºããã»ã¹ãæ€æ»ããã©ã€ããµã€ã¯ã«å šäœã«æ å ±ã»ãã¥ãªãã£ãçµã¿èŸŒãŸããŠããããšã確èªããã | |
- 6.3.c èšè¿°ããããœãããŠã§ã¢éçºããã»ã¹ãæ€æ»ããPCI DSS ã«åŸã£ãŠããœãããŠã§ã¢ã¢ããªã±ãŒã·ã§ã³ãéçºãããŠããããšã確èªããã | |
- 6.3.d ãœãããŠã§ã¢éçºè ã®ã€ã³ã¿ãã¥ãŒãããææžåããããœãããŠã§ã¢éçºããã»ã¹ãå®è£ ãããŠããããšã確èªããã | |
- 6.3.1 ã¢ããªã±ãŒã·ã§ã³ãã¢ã¯ãã£ãã«ãªãåããŸãã¯é¡§å®¢ã«ãªãªãŒã¹ãããåã«ããã¹ã/ã«ã¹ã¿ã ã¢ããªã±ãŒã·ã§ã³ã¢ã«ãŠã³ãããŠãŒã¶ IDããã¹ã¯ãŒããåé€ãã: | |
- 6.3.1 ææžåããããœãããŠã§ã¢éçºæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãæ¬çªåãšã«ã¹ã¿ã ã¢ããªã±ãŒã·ã§ã³ã¢ã«ãŠã³ãããŠãŒã¶ ID/ãã¹ã¯ãŒãããã·ã¹ãã ãæ¬çªç°å¢ã«å°å ¥ãããããŸãã¯é¡§å®¢ã«ãªãªãŒã¹ãããåã«åé€ãããããšã確èªããã | |
- 6.3.2 ã³ãŒãã£ã³ã°ã®è匱æ§ããªãããšã確èªããããã®ãæ¬çªãŸãã¯é¡§å®¢ã®ãªãªãŒã¹åã®ã«ã¹ã¿ã ã³ãŒãã®ã¬ãã¥ãŒããïŒæåãŸãã¯èªåããã»ã¹ã«ããïŒã\nã»ã³ãŒãå€æŽã¯ãã³ãŒãäœæè 以å€ã®ãã³ãŒãã¬ãã¥ãŒææ³ãšå®å šãªã³ãŒãã£ã³ã°ææ³ã®ç¥èã®ãã人ãã¬ãã¥ãŒããã\nã» ã³ãŒãã¬ãã¥ãŒã«ãããã³ãŒããå®å šãªã³ãŒãã£ã³ã°ã¬ã€ãã©ã€ã³ã«åŸã£ãŠéçºãããããšãä¿èšŒããã\nã» ãªãªãŒã¹åã«ãé©åãªä¿®æ£ãå®è£ ããŠããã\nã» ã³ãŒãã¬ãã¥ãŒçµæã¯ããªãªãŒã¹åã«ç®¡çè·ã«ãã£ãŠã¬ãã¥ãŒããã³æ¿èªãããã\næ³šïŒ ãã®ã³ãŒãã¬ãã¥ãŒèŠä»¶ã¯ãã·ã¹ãã éçºã©ã€ããµã€ã¯ã«ã®äžç°ãšããŠããã¹ãŠã®ã«ã¹ã¿ã ã³ãŒãïŒå éšããã³å ¬éïŒã«é©çšãããã\nã³ãŒãã¬ãã¥ãŒã¯ãç¥èãæã€ç€Ÿå æ åœè ãŸãã¯ç¬¬äžè ãå®æœã§ãããäžè¬ã«å ¬éãããŠãã Web ã¢ããªã±ãŒã·ã§ã³ã¯ãå®è£ åŸã®è åšããã³è匱æ§ã«å¯ŸåŠããããã«ãPCI DSS èŠä»¶ 6.6 ã«å®çŸ©ãããŠããè¿œå ã³ã³ãããŒã«ã®å¯Ÿè±¡ãšãªãã: | |
- 6.3.2.a ããªã·ãŒãå ¥æããŠã¬ãã¥ãŒãããã¹ãŠã®ã«ã¹ã¿ã ã¢ããªã±ãŒã·ã§ã³ã³ãŒãã®å€æŽã«å¯ŸããŠã(æåãŸãã¯èªåããã»ã¹ã§)以äžã®ããã«ã¬ãã¥ãŒãèŠæ±ãããŠããããšã確èªããã\n⢠ã³ãŒãå€æŽã¯ãã³ãŒãäœæè 以å€ã®ãã³ãŒãã¬ãã¥ãŒææ³ãšå®å šãªã³ãŒãã£ã³ã°ææ³ã®ç¥èã®ãã人ãã¬ãã¥ãŒããã\n⢠ã³ãŒãã¬ãã¥ãŒã«ãããã³ãŒããå®å šãªã³ãŒãã£ã³ã°ã¬ã€ãã©ã€ã³ã«åŸã£ãŠéçºãããããšãä¿èšŒããã(PCI DSSèŠä»¶6.5ãåç §)ã\n⢠ãªãªãŒã¹åã«ãé©åãªä¿®æ£ãå®è£ ããŠããã\n⢠ã³ãŒãã¬ãã¥ãŒçµæã¯ããªãªãŒã¹åã«ç®¡çè·ã«ãã£ãŠã¬ãã¥ãŒããã³æ¿èªãããã | |
- 6.3.2.b æè¿ã®ã«ã¹ã¿ã ã¢ããªã±ãŒã·ã§ã³ã®å€æŽã«ã€ããŠãµã³ãã«ãéžæãããã®ã«ã¹ã¿ã ã¢ããªã±ãŒã·ã§ã³ã³ãŒããäžèš6.3.2.aã«åŸã£ãŠã¬ãã¥ãŒãããŠããããšã確èªããã | |
- 6.4 ã·ã¹ãã ã³ã³ããŒãã³ããžã®ãã¹ãŠã®å€æŽã«ãããŠãå€æŽç®¡çã®ããã»ã¹ããã³æé ã«åŸãããããã®ããã»ã¹ã«ã¯ã以äžãå«ããå¿ èŠãããã: | |
- 6.4 ããªã·ãŒãšæé ã調ã¹ã以äžãå®çŸ©ãããŠããããšã確èªããã\n⢠éçº/ãã¹ãç°å¢ããæ¬çªç°å¢ããåé¢ãããŠããŠãåé¢ãå®æœããããã®ã¢ã¯ã»ã¹å¶åŸ¡ãè¡ãããŠããããš\n⢠éçº/ãã¹ãç°å¢ã«å²ãåœãŠãããŠããæ åœè ãšæ¬çªç°å¢ã«å²ãåœãŠãããŠããæ åœè ãšã®éã§è²¬åãåé¢ãããŠããããš\n⢠ãã¹ããŸãã¯éçºã«æ¬çªç°å¢ããŒã¿ïŒå®éã® PANïŒã䜿çšããªãããšã\n⢠æ¬çªç°å¢ã·ã¹ãã ãã¢ã¯ãã£ãã«ãªãåã«ãã¹ãããŒã¿ãšãã¹ãã¢ã«ãŠã³ããåé€ãããããš\n⢠ã»ãã¥ãªãã£ãããããœãããŠã§ã¢ã®å€æŽã®å®è£ ã«é¢é£ããå€æŽç®¡çæé ãææžåãããŠããããš | |
- 6.4.1 éçº/ãã¹ãç°å¢ãæ¬çªç°å¢ããåé¢ããåé¢ãå®æœããããã®ã¢ã¯ã»ã¹å¶åŸ¡ãè¡ãã: | |
- 6.4.1.a ãããã¯ãŒã¯ææžãšãããã¯ãŒã¯ããã€ã¹æ§æã調ã¹ãŠãéçº/ãã¹ãç°å¢ãæ¬çªç°å¢ããåé¢ãããŠããããšã確èªããã | |
- 6.4.1.b ã¢ã¯ã»ã¹å¶åŸ¡èšå®ã調ã¹ãŠãéçº/ãã¹ãç°å¢ãšæ¬çªç°å¢ã®åé¢ã匷å¶ããããã®ã¢ã¯ã»ã¹å¶åŸ¡ãè¡ãããŠããããšã確èªããã | |
- 6.4.2 éçº/ãã¹ãç°å¢ãšæ¬çªç°å¢ã§ã®è²¬åã®åé¢: | |
- 6.4.2 ããã»ã¹ã芳å¯ããéçº/ãã¹ãç°å¢ã«å²ãåœãŠãããŠããæ åœè ãšæ¬çªç°å¢ã«å²ãåœãŠãããŠããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãéçº/ãã¹ãç°å¢ãšæ¬çªç°å¢ã®è²¬åãåé¢ãããŠããããšã確èªããã | |
- 6.4.3 ãã¹ããŸãã¯éçºã«æ¬çªç°å¢ããŒã¿(å®éã®PAN)ã䜿çšããªã: | |
- 6.4.3.a ãã¹ãããã»ã¹ã芳å¯ããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãæ¬çªç°å¢ããŒã¿ïŒå®éã® PANïŒããã¹ããŸãã¯éçºã«äœ¿çšãããŠããªãããšã確èªããã | |
- 6.4.3.b ãã¹ãããŒã¿ã®ãµã³ãã«ã芳å¯ããŠãæ¬çªç°å¢ããŒã¿ïŒå®éã® PANïŒããã¹ããŸãã¯éçºã«äœ¿çšãããŠããªãããšã確èªããã | |
- 6.4.4 æ¬çªç°å¢ã·ã¹ãã ãã¢ã¯ãã£ãã«ãªãåã«ãã¹ãããŒã¿ãšãã¹ãã¢ã«ãŠã³ããåé€ãã: | |
- 6.4.4.a ãã¹ãããã»ã¹ã芳å¯ããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãæ¬çªç°å¢ã·ã¹ãã ãã¢ã¯ãã£ãã«ãªãåã«ãã¹ãããŒã¿ãšã¢ã«ãŠã³ããåé€ãããããšã確èªããã | |
- 6.4.4.b æè¿ã€ã³ã¹ããŒã«ããããæŽæ°ãããæ¬çªã·ã¹ãã ããã®ããŒã¿ãšã¢ã«ãŠã³ãã®ãµã³ãã«ã調ã¹ãŠãæ¬çªç°å¢ã·ã¹ãã ãã¢ã¯ãã£ãã«ãªãåã«ãã¹ãããŒã¿ãšã¢ã«ãŠã³ããåé€ãããããšã確èªããã | |
- 6.4.5 ã»ãã¥ãªãã£ãããã®é©çšãšãœãããŠã§ã¢ã®å€æŽã«é¢ããå€æŽç®¡çæé ã¯ä»¥äžãå«ãå¿ èŠãããã: | |
- 6.4.5.a ã»ãã¥ãªãã£ãããããœãããŠã§ã¢ã®å€æŽã®å®è£ ã«é¢ããææžåãããå€æŽç®¡çæé ã調ã¹ãŠã以äžã®æé ãå®çŸ©ãããŠããããšã確èªããã\n⢠圱é¿ã®ææžå\n⢠é©åãªæš©éãæã€é¢ä¿è ã«ããææžåãããå€æŽæ¿èªã\n⢠å€æŽãã·ã¹ãã ã®ã»ãã¥ãªãã£ã«æªåœ±é¿ãäžããŠããªãããšã確èªããããã®æ©èœãã¹ã\n⢠å埩æé | |
- 6.4.5.b ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãææ°ã®å€æŽ/ã»ãã¥ãªãã£ãããã確èªãããããã®å€æŽå 容ã«é¢é£ããå€æŽç®¡çææžã確èªããã確èªããå€æŽå 容ã«ã€ããŠã以äžãå®è¡ããã | |
- 6.4.5.1 圱é¿ã®ææžåã: | |
- 6.4.5.1 ãµã³ããªã³ã°ããå€æŽã§ã圱é¿ã®ææžåãå€æŽç®¡çææžã«å«ãŸããŠããããšã確èªããã | |
- 6.4.5.2 é©åãªæš©éãæã€é¢ä¿è ã«ããææžåãããå€æŽæ¿èªã: | |
- 6.4.5.2 ãµã³ããªã³ã°ããå€æŽã§ãé©åãªæš©éãæã€é¢ä¿è ã«ããææžåãããå€æŽæ¿èªãååšããŠããããšã確èªããã | |
- 6.4.5.3 å€æŽãã·ã¹ãã ã®ã»ãã¥ãªãã£ã«æªåœ±é¿ãäžããªãããšã確èªããããã®æ©èœãã¹ãã: | |
- 6.4.5.3.a ãµã³ããªã³ã°ããåå€æŽã§ãå€æŽãã·ã¹ãã ã®ã»ãã¥ãªãã£ã«æªåœ±é¿ãäžããªãããšã確èªãããããæ©èœãã¹ããå®æœãããããšã確èªããã | |
- 6.4.5.3.b ã«ã¹ã¿ã ã³ãŒãã®å€æŽã§ã¯ããã¹ãŠã®æŽæ°ãæ¬çªç°å¢ã«å°å ¥ããåã«ãPCI DSS ã®èŠä»¶ 6.5 ã«åŸã£ãŠæºæ ããã¹ããããŠããããšã確èªããã | |
- 6.4.5.4 å埩æé ã: | |
- 6.4.5.4 ãµã³ããªã³ã°ããåå€æŽã§ãå埩æé ãæºåãããŠããããšã確èªããã | |
- 6.5 次ã®ããã«ããŠãœãããŠã§ã¢éçºããã»ã¹ã§äžè¬çãªã³ãŒãã£ã³ã°ã®è匱æ§ã«å¯Ÿå¿ããã\n⢠éçºè ã«å®å šãªã³ãŒãã£ã³ã°ææ³ã®ãã¬ãŒãã³ã°ããã\n⢠äžè¬çãªã³ãŒãã£ã³ã°ã®è匱æ§ãé¿ããæ©å¯ããŒã¿ãã¡ã¢ãªã§æ±ãæ¹æ³ãç解ããããšãå«ããå®å šãªã³ãŒãã£ã³ã°ã¬ã€ãã©ã€ã³ã«åºã¥ããŠã¢ããªã±ãŒã·ã§ã³ãéçºãã\næ³šïŒ èŠä»¶6.5.1ïœ6.5.11ã«æããããŠããè匱æ§ã¯ããã®ããŒãžã§ã³ã® PCI DSSãçºè¡ãããæç¹ã®ææ°ã®æ¥çãã¹ããã©ã¯ãã£ã¹ãèžè¥²ããŠããããããããè匱æ§ç®¡çã®ããã®æ¥çã®ãã¹ããã©ã¯ãã£ã¹ã¯æŽæ°ãããŠããããïŒOWASPã¬ã€ããSANS CWE Top 25ãCERT\nSecure Coding ãªã©ïŒãçŸåšã®ãã¹ããã©ã¯ãã£ã¹ã¯ããããã®èŠä»¶ã䜿çšããå¿ èŠãããã: | |
- 6.5.a ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ãããã»ã¹ããæ¥çã®ãã¹ããã©ã¯ãã£ã¹ãšã¬ã€ãã³ã¹ã«åºã¥ããéçºè ã®ããã®å®å šãªã³ãŒãã£ã³ã°ææ³ã«ã€ããŠãã¬ãŒãã³ã°ãèŠæ±ããŠããããšã確èªããã | |
- 6.5.b æ°äººã®éçºè ãã€ã³ã¿ãã¥ãŒããå®å šãªã³ãŒãã£ã³ã°ææ³ã«ç²ŸéããŠããããšã確èªããã | |
- 6.5.c ãã¬ãŒãã³ã°èšé²ã調ã¹ãŠããœãããŠã§ã¢éçºè ããäžè¬çãªã³ãŒãã£ã³ã°ã®è匱æ§ãé¿ããæ©å¯ããŒã¿ãã¡ã¢ãªã§æ±ãæ¹æ³ãç解ããããšãå«ããå®å šãªã³ãŒãã£ã³ã°ææ³ã«ã€ããŠã®ãã¬ãŒãã³ã°ãåããããšã確èªããã | |
- 6.5.d ã¢ããªã±ãŒã·ã§ã³ãå°ãªããšã以äžã®è匱æ§ããä¿è·ããããã®ããã»ã¹ãååšããããšã確èªããã\n泚ïŒä»¥äžã®èŠä»¶ 6.5.1 ãã 6.5.6 ã¯ããã¹ãŠã®ã¢ããªã±ãŒã·ã§ã³\nïŒå éšãŸãã¯å€éšïŒã«é©çšãããŸãã | |
- 6.5.1 ã€ã³ãžã§ã¯ã·ã§ã³ã®äžå ·åïŒç¹ã«SQL ã€ã³ãžã§ã¯ã·ã§ã³ïŒãOS ã³ãã³ãã€ã³ãžã§ã¯ã·ã§ã³ãLDAP ããã³Xpath ã®ã€ã³ãžã§ã¯ã·ã§ã³ã®äžå ·åããã®ä»ã®ã€ã³ãžã§ã¯ã·ã§ã³ã®äžå ·åãèæ ®ããã: | |
- 6.5.1 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ã以äžãå«ããã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠã€ã³ãžã§ã¯ã·ã§ã³ã®äžå ·åã察åŠãããŠããããšã確èªããã\nâ¢ å ¥åã調ã¹ãŠããŠãŒã¶ããŒã¿ãã³ãã³ããšã¯ãšãªã®æå³ãå€æŽã§ããªãããšã確èªãã\n⢠ãã©ã¡ãŒã¿åã¯ãšãªã䜿çšãã | |
- 6.5.2 ãããã¡ãªãŒããŒãããŒ: | |
- 6.5.2 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ã以äžãå«ããã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠãããã¡ãªãŒããŒãããŒã察åŠãããŠããããšã確èªããã\n⢠ãããã¡å¢çãæ€èšŒãã\nâ¢ å ¥åæååããã©ã³ã±ãŒã·ã§ã³ãã | |
- 6.5.3 å®å šã§ãªãæå·åä¿å: | |
- 6.5.3 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ã以äžãå«ããã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠå®å šã§ãªãæå·åä¿åã察åŠãããŠããããšã確èªããã\n⢠æå·åã®äžå ·åãé²æ¢ãã\n⢠匷åãªæå·åã¢ã«ãŽãªãºã ãšããŒã䜿çšãã | |
- 6.5.4 å®å šã§ãªãéä¿¡: | |
- 6.5.4 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãå®å šã§ãªãéä¿¡ããã¹ãŠã®æ©å¯æ å ±ã®éä¿¡ãé©åã«èªèšŒããŠæå·åããã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠå¯ŸåŠãããŠããããšã確èªãã | |
- 6.5.5 äžé©åãªãšã©ãŒåŠç: | |
- 6.5.5 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãäžé©åãªãšã©ãŒåŠçãããšã©ãŒã¡ãã»ãŒãžãéããŠæ å ±ãæŒæŽ©ããªãã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠå¯ŸåŠãããŠããããšã確èªããïŒããšãã°ãå ·äœçãªãšã©ãŒæ å ±ã§ã¯ãªãæ±çšãšã©ãŒã¡ãã»ãŒãžãè¿ããªã©ïŒ | |
- 6.5.6 è匱æ§ç¹å®ããã»ã¹ïŒPCI DSSèŠä»¶ 6.1 ã§å®çŸ©ïŒã§ç¹å®ãããããã¹ãŠã®ãé«ãªã¹ã¯ãè匱æ§ã: | |
- 6.5.6 ã³ãŒãã£ã³ã°ææ³ã«ãããã¢ããªã±ãŒã·ã§ã³ã䟵害ããå¯èœæ§ã®ãããPCI DSS èŠä»¶ 6.1 ã§ç¹å®ããããã¹ãŠã®ãé«ãªã¹ã¯ãè匱æ§ã«å¯ŸåŠããã\n- 泚ïŒä»¥äžã®èŠä»¶6.5.7ïœ6.5.10ã¯ãWebã¢ããªã±ãŒã·ã§ã³ãšã¢ããªã±ãŒã·ã§ã³ã€ã³ã¿ãŒãã§ãŒã¹(å éšãŸãã¯å€éš)ã«é©çšãããã | |
- 6.5.7 ã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°(XSS): | |
- 6.5.7 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ã以äžãå«ããã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠã¯ãã¹ãµã€ãã¹ã¯ãªããã£ã³ã°ïŒXSSïŒã察åŠãããŠããããšã確èªããã\n⢠åã蟌ãåã«ãã¹ãŠã®ãã©ã¡ãŒã¿ãæ€èšŒ\n⢠ã³ã³ããã¹ãäŸåãšã¹ã±ãŒãã®äœ¿çš | |
- 6.5.8 äžé©åãªã¢ã¯ã»ã¹å¶åŸ¡ïŒå®å šã§ãªããªããžã§ã¯ãã®çŽæ¥åç §ãURL ã¢ã¯ã»ã¹å¶éã®å€±æããã£ã¬ã¯ããªãã©ããŒãµã«ãæ©èœãžã®ãŠãŒã¶ã¢ã¯ã»ã¹å¶éã®å€±æãªã©ïŒ: | |
- 6.5.8 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãäžé©åãªã¢ã¯ã»ã¹å¶åŸ¡ïŒå®å šã§ãªããªããžã§ã¯ãã®çŽæ¥åç §ãURL ã¢ã¯ã»ã¹å¶éã®å€±æããã£ã¬ã¯ããªãã©ããŒãµã«ãªã©ïŒã以äžãå«ãã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠå¯ŸåŠãããŠããããšã確èªãã\nâ¢ãŠãŒã¶ã®é©åãªèªèšŒ\nâ¢ å ¥åå€ã®åé€\n⢠å éšãªããžã§ã¯ãåç §ããŠãŒã¶ã«å ¬éããªã\n⢠ãŠãŒã¶ã€ã³ã¿ãã§ãŒã¹ã§ç¡èš±å¯ã®æ©èœãžã®ã¢ã¯ã»ã¹ãèš±å¯ããªã | |
- 6.5.9 ã¯ãã¹ãµã€ããªã¯ãšã¹ãåœé (CSRF): | |
- 6.5.9 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ããã¯ãã¹ãµã€ããªã¯ãšã¹ãåœé ïŒCSRFïŒã¯ãã¢ããªã±ãŒã·ã§ã³ããã©ãŠã¶ããèªåçã«éä¿¡ãããèªèšŒæ å ±ãšããŒã¯ã³ã«äŸåããªãã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠå¯ŸåŠãããŠããããšã確èªããã | |
- 6.5.10 äžå®å šãªèªèšŒç®¡çãšã»ãã·ã§ã³ç®¡ç\næ³šïŒ èŠä»¶ 6.5.11 ã¯ã2015 幎 6 æ 30 æ¥ãŸã§ã¯ãã¹ããã©ã¯ãã£ã¹ãšã¿ãªããããã以éã¯èŠä»¶ã«ãªãã: | |
- 6.5.10 ãœãããŠã§ã¢éçºããªã·ãŒãšæé ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ã以äžãå«ããã³ãŒãã£ã³ã°ææ³ã«ãã£ãŠäžå®å šãªèªèšŒç®¡çãšã»ãã·ã§ã³ç®¡çã察åŠãããŠããããšã確èªããã\n⢠ã»ãã·ã§ã³ããŒã¯ã³ïŒã¯ãããŒãªã©ïŒããå®å šããšããŠãã©ã°ä»ããã\n⢠URL ã«ã»ãã·ã§ã³ãå«ããªã\n⢠ãã°ã€ã³åŸã®é©åãªã¿ã€ã ã¢ãŠããšã»ãã·ã§ã³ ID ã®å·¡å\n⢠ãŠãŒã¶ ID ãšãã¹ã¯ãŒããã¢ããªã±ãŒã·ã§ã³ã¢ã«ãŠã³ãæ©èœã䜿ã£ãŠäžæžãã§ããªããã | |
- 6.6 äžè¬å ¬éãããŠããWebã¢ããªã±ãŒã·ã§ã³ã§ãç¶ç¶çã«æ°ããªè åšãè匱æ§ã«å¯ŸåŠãããããã®ã¢ããªã±ãŒã·ã§ã³ãã次ã®ããããã®æ¹æ³ã«ãã£ãŠãæ¢ç¥ã®æ»æããä¿è·ãããŠããããšã確èªããã\nã»äžè¬å ¬éãããŠããWeb ã¢ããªã±ãŒã·ã§ã³ã¯ãã¢ããªã±ãŒã·ã§ã³ã®ã»ãã¥ãªãã£è匱æ§ã\næå/èªåã§è©äŸ¡ããããŒã«ãŸãã¯ææ³ã«ãã£ãŠãå°ãªããšã幎 1 åããã³äœããã®å€æŽãå ããåŸã«ã¬ãã¥ãŒãã\næ³šïŒ ãã®è©äŸ¡ã¯ãèŠä»¶ 11.2 ã§å®æœããè匱æ§ã¹ãã£ã³ãšã¯ç°ãªãã\nã»Web ããŒã¹ã®æ»æãæ€ç¥ããã³åé¿ããããã«ãäžè¬å ¬éãããŠãã Web ã¢ããªã±ãŒã·ã§ã³ã®æåã«ãWeb ã¢ããªã±ãŒã·ã§ã³ãã¡ã€ã¢ãŠã©ãŒã«ãã€ã³ã¹ããŒã«ããã: | |
- 6.6 äžè¬å ¬éãããŠããWebã¢ããªã±ãŒã·ã§ã³ã«ã€ããŠã以äžã®ããããã®ææ³ããšãããŠããããšã確èªããã\nã» ææžåãããŠããããã»ã¹ã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããŠãã¢ããªã±ãŒã·ã§ã³ã»ãã¥ãªãã£è©äŸ¡èšé²ãèŠãããšã§ãäžè¬å ¬éãããŠãã Web ã¢ããªã±ãŒã·ã§ã³ãïŒã»ãã¥ãªãã£è匱æ§ãæå/èªåã§è©äŸ¡ããããŒã«ãŸãã¯ææ³ã䜿çšããŠïŒä»¥äžã®ããã«ã¬ãã¥ãŒãããŠããããšã確èªããã\n- å°ãªããšã幎ã«äžåºŠå®æœãã\n- äœããã®å€æŽãå ããåŸ\n- ã¢ããªã±ãŒã·ã§ã³ã®ã»ãã¥ãªãã£ãå°éãšããçµç¹ã«ãã£ãŠ\n- è©äŸ¡ã«å°ãªããšãèŠä»¶ 6.5 ã«èšèŒãããŠããè匱æ§ãå«ãã\n- è匱æ§ããã¹ãŠä¿®æ£ãããŠãã\n- ä¿®æ£åŸãã¢ããªã±ãŒã·ã§ã³ãåè©äŸ¡ãããŠãã\nã»é²æ¢ããæè¡çãªè§£æ±ºçïŒWeb ã¢ããªã±ãŒã·ã§ã³ãã¡ã€ã¢ãŠã©ãŒã«ãªã©ïŒã以äžã®éãåãã£ãŠããããšã確èªããã\n- Web ããŒã¹ã®æ»æãæ€ç¥ããã³é²æ¢ããããã«ãäžè¬å ¬éãããŠãã Web ã¢ããªã±ãŒã·ã§ã³ã®æåã«ã€ã³ã¹ããŒã«ãããŠãã\n- ã¢ã¯ãã£ãã«å®è¡ãããŠãããææ°ç¶æ ã§ããïŒè©²åœããå ŽåïŒ\n- ç£æ»ãã°ãçæãã\n- Web ããŒã¹ã®æ»æããããã¯ããããã¢ã©ãŒããçæãã | |
- 6.7 ã»ãã¥ã¢ã·ã¹ãã ãšã¢ããªã±ãŒã·ã§ã³ãéçºã»ä¿å®ããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã | |
- 6.7 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ãå®å šãªã·ã¹ãã ãšã¢ããªã±ãŒã·ã§ã³ãéçºã»ä¿å®ããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶7ïŒã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ããæ¥åäžå¿ èŠãªç¯å²å ã«å¶éãã: | |
- 7.1 ã·ã¹ãã ã³ã³ããŒãã³ããšã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ããæ¥åäžå¿ èŠãªäººã«éå®ããã: | |
- 7.1.a ã¢ã¯ã»ã¹å¶åŸ¡ã«é¢ããææžåãããããªãŒãå ¥æããŠæ€èšããããªã·ãŒã以äžã®ããã« 7.1.1ã7.1.4 ãå«ãã§ããããšã確èªããã\n⢠å圹å²ã®ã¢ã¯ã»ã¹ããŒãºãšç¹æš©å²ãåœãŠãå®çŸ©ãã\n⢠ç¹æš©ãŠãŒã¶ ID ã«äžããã¢ã¯ã»ã¹æš©ããè·åã®å®è¡ã«å¿ èŠãªæå°éã®ç¹æš©ã«å¶éãããŠããããš\n⢠ç¹æš©ã®ä»äžã¯ãå人ã®è·çš®ãšè·åã«åºã¥ãããš\n⢠ãã¹ãŠã®ã¢ã¯ã»ã¹ã«å¯ŸããŠãæš©éãæã€é¢ä¿è ã«ãããèš±å¯ãããç¹æš©ã®ãªã¹ããå«ããææžåãããæ¿èªïŒæžé¢ãŸãã¯é»åçïŒ | |
- 7.1.1 以äžãå«ããå圹å²ã®ã¢ã¯ã»ã¹ããŒãºãå®çŸ©ãã\n⢠å圹å²ãè·åäžã¢ã¯ã»ã¹ããå¿ èŠã®ããã·ã¹ãã ã³ã³ããŒãã³ããšããŒã¿ãªãœãŒã¹\n⢠ãªãœãŒã¹ãžã®ã¢ã¯ã»ã¹ã«å¿ èŠãªç¹æš©ã¬ãã«ïŒãŠãŒã¶ã管çè ãªã©ïŒ: | |
- 7.1.1 圹å²ã®ãµã³ãã«ãéžæããå圹å²ã®ã¢ã¯ã»ã¹ããŒãºãå®çŸ©ãããŠããã以äžãå«ãããšã確èªããã\n⢠å圹å²ãè·åäžã¢ã¯ã»ã¹ããå¿ èŠã®ããã·ã¹ãã ã³ã³ããŒãã³ããšããŒã¿ãªãœãŒã¹\n⢠å圹å²ãè·åãéè¡ããããã«å¿ èŠãªç¹æš©ã®ç¹å® | |
- 7.1.2 ç¹æš©ãŠãŒã¶ ID ã«äžããã¢ã¯ã»ã¹æš©ãè·åã®å®è¡ã«å¿ èŠãªæå°éã®ç¹æš©ã«å¶éããã: | |
- 7.1.2.a ã¢ã¯ã»ã¹æš©ã®å²ãåœãŠã®è²¬ä»»è ãã€ã³ã¿ãã¥ãŒããããšã§ãç¹æš©ãŠãŒã¶ ID ãžã®ã¢ã¯ã»ã¹ã以äžãæºãããŠããããšã確èªããã\n⢠ãã®ãããªã¢ã¯ã»ã¹æš©ãç¹ã«å¿ èŠãšãã圹å²ã«ã®ã¿å²ãåœãŠããã\n⢠è·åã®å®è¡ã«å¿ èŠãªæå°éã®ç¹æš©ã«å¶éãããŠãã | |
- 7.1.2.b ã¢ã¯ã»ã¹æš©ãæã€ãŠãŒã¶ ID ã®ãµã³ãã«ãéžæãã管ç責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãå²ãåœãŠãããç¹æš©ã以äžãæºããããšã確èªããã\n⢠ãã®ãŠãŒã¶ã®è·åã«å¿ èŠ\n⢠è·åã®å®è¡ã«å¿ èŠãªæå°éã®ç¹æš©ã«å¶éãããŠãã | |
- 7.1.3 å人ã®è·çš®ãšè·åã«åºã¥ãã¢ã¯ã»ã¹æš©ã®å²ãåœãŠãã: | |
- 7.1.3 ãŠãŒã¶ ID ã®ãµã³ãã«ãéžæãã管ç責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãå²ãåœãŠãããç¹æš©ããã®å人ã®è·çš®ãšè·åã«åºã¥ããŠããããšã確èªããã | |
- 7.1.4é©åãªæš©éãæã€é¢ä¿è ã«ããææžåãããå€æŽæ¿èªãå¿ èŠãšããã: | |
- 7.1.4 ãŠãŒã¶ ID ãéžæããææžåãããæ¿èªãšæ¯èŒããããšã§ã以äžã確èªããã\n⢠å²ãåœãŠãããç¹æš©ã«å¯Ÿããææžåãããæ¿èªãååšãã\n⢠ãã®æ¿èªã¯æš©éã®ããé¢ä¿è ã«ãããã®ã§ãã\n⢠æå®ãããç¹æš©ããã®å人ã«å²ãåœãŠããã圹å²ã«äžèŽããŠãã | |
- 7.2 ã·ã¹ãã ã³ã³ããŒãã³ãã§ããŠãŒã¶ã®å¿ èŠæ§ã«åºã¥ããŠã¢ã¯ã»ã¹ãå¶éãããç¹ã«èš±å¯ã®ãªãå Žåã¯ããã¹ãŠãæåŠãã«èšå®ããããã¢ã¯ã»ã¹å¶åŸ¡ã·ã¹ãã ã確ç«ããã\nã¢ã¯ã»ã¹å¶åŸ¡ã·ã¹ãã ã«ã¯ä»¥äžã®é ç®ãå«ããå¿ èŠãããã: | |
- 7.2 ã·ã¹ãã ã®èšå®ãšãã³ãã®ææžãæ€æ»ããã¢ã¯ã»ã¹å¶åŸ¡ã·ã¹ãã ã以äžã®ããã«å®è£ ãããŠããããšã確èªããã | |
- 7.2.1 ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã察象ã«å«ã: | |
- 7.2.1 ã¢ã¯ã»ã¹å¶åŸ¡ã·ã¹ãã ããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã«å®è£ ãããŠããããšã確èªããã | |
- 7.2.2 è·çš®ãšè·èœã«åºã¥ããå人ãžã®ç¹æš©ã®ä»äž: | |
- 7.2.2 ã¢ã¯ã»ã¹å¶åŸ¡ã·ã¹ãã ããè·çš®ãšè·åã«åºã¥ããŠå人ã«å²ãåœãŠãããç¹æš©ã匷å¶ããããæ§æãããŠããããšã確èªããã | |
- 7.2.3 ããã©ã«ãã§ã¯ããã¹ãŠãæåŠãã®èšå®: | |
- 7.2.3 ã¢ã¯ã»ã¹å¶åŸ¡ã·ã¹ãã ã«ããã¹ãŠãæåŠããããã©ã«ãèšå®ãããŠããããšã確èªããã | |
- 7.3 ã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ãå¶éããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 7.3 ææžã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ãå¶éããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶8ïŒã³ã³ãã¥ãŒã¿ã«ã¢ã¯ã»ã¹ã§ããåãŠãŒã¶ã«äžæã®IDãå²ãåœãŠã: | |
- 8.1 ããªã·ãŒãšæé ãå®çŸ©ããŠå®è£ ããããšã§ã次ã®ããã«ããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã§ãéæ¶è²»è ãŠãŒã¶ãšç®¡çè ã®ããã®é©åãªãŠãŒã¶èå¥ããã³èªèšŒã®ç®¡çãè¡ãããããã«ããã: | |
- 8.1.a æé ã調ã¹ãŠã以äžã® 8.1.1 ïœ 8.1.8 ã®åé ç®ã«ã€ããŠã®ããã»ã¹ãå®çŸ©ãããŠããããšã確èªããã | |
- 8.1.b 以äžãå®è¡ããããšã«ãã£ãŠããŠãŒã¶èå¥ç®¡çã®ããã®æé ãå®æœãããŠããããšã確èªããã | |
- 8.1.1 ã·ã¹ãã ã³ã³ããŒãã³ããŸãã¯ã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããåã«ããã¹ãŠã®ãŠãŒã¶ã«äžæã®IDãå²ãåœãŠãã: | |
- 8.1.1 管ç責任è ãã€ã³ã¿ãã¥ãŒããããšã§ããã¹ãŠã®ãŠãŒã¶ã«ãã·ã¹ãã ã³ã³ããŒãã³ããŸãã¯ã«ãŒãäŒå¡ããŒã¿ã«ã¢ã¯ã»ã¹ããããã®äžæã®IDãå²ãåœãŠãããŠããããšã確èªããã | |
- 8.1.2 è¿œå ãåé€ããŠãŒã¶ ID ã®å€æŽãè³æ Œæ å ±ãããã³ãã®ä»ã®èå¥ãªããžã§ã¯ãã管çããã: | |
- 8.1.2 ç¹æš©ãŠãŒã¶ ID ãšäžè¬ãŠãŒã¶ ID ã«ã€ããŠãé¢é£ä»ããããŠããæš©éã調ã¹ãã·ã¹ãã èšå®ã芳å¯ããŠãåãŠãŒã¶ ID ãšç¹æš©ãŠãŒã¶ ID ã«ãææžåãããŠããæ¿èªå 容ã§æå®ãããŠããç¹æš©ã®ã¿ãå®è£ ãããŠããããšã確èªããã | |
- 8.1.3 å¥çŽçµäºãããŠãŒã¶ã®ã¢ã¯ã»ã¹ãçŽã¡ã«åãæ¶ãã: | |
- 8.1.3.a éå» 6 ã«æéã«å¥çŽçµäºãããŠãŒã¶ã®ãµã³ãã«ãéžæããçŸåšã®ãŠãŒã¶ã¢ã¯ã»ã¹ãªã¹ãã調ã¹ãŠãâ ããŒã«ã«ãšãªã¢ãŒãã¢ã¯ã»ã¹äž¡æ¹ã«ã€ã â ãããã®ãŠãŒã¶ã® ID ãç¡å¹åãŸãã¯åé€ãããŠããããšã確èªããã | |
- 8.1.3.b ã¹ããŒãã«ãŒããããŒã¯ã³ãªã©ããã¹ãŠã®ç©ççèªèšŒæ¹æ³ãè¿éãããããç¡å¹ã«ãããããšã確èªããã | |
- 8.1.4å°ãªããšã 90 æ¥ããšã«éã¢ã¯ãã£ããªãŠãŒã¶ã¢ã«ãŠã³ããåé€/ç¡å¹ã«ããã: | |
- 8.1.4 ãŠãŒã¶ã¢ã«ãŠã³ãã芳å¯ããããšã§ã90 æ¥éãè¶ ããéã¢ã¯ãã£ããªã¢ã«ãŠã³ããåé€ãŸãã¯ç¡å¹ã«ãªã£ãŠããããšã確èªããã | |
- 8.1.5 ãã³ãããªã¢ãŒãã¢ã¯ã»ã¹çµç±ã§ã·ã¹ãã ã³ã³ããŒãã³ãã®ã¢ã¯ã»ã¹ããµããŒããã¡ã³ããã³ã¹ã«äœ¿çšãããŠãŒã¶ ID ã以äžã®ããã«ç®¡çããã\nâ¢ å¿ èŠãªæéå ã ãæå¹ã«ãªãã䜿çšãããŠããªããšãã¯ç¡å¹ã«ãªã£ãŠããã\n⢠䜿çšæã«ç£èŠãããŠããã: | |
- 8.1.5.a æ åœè ãã€ã³ã¿ãã¥ãŒãããã³ããã·ã¹ãã ã³ã³ããŒãã³ãã®ã¢ã¯ã»ã¹ããµããŒããã¡ã³ããã³ã¹ã«äœ¿çšããã¢ã«ãŠã³ãã管çããããã®ããã»ã¹ã芳å¯ããŠããã³ãããªã¢ãŒãã¢ã¯ã»ã¹ã«äœ¿çšããã¢ã«ãŠã³ãã以äžãæºãããŠããããšã確èªããã\n⢠䜿çšãããŠããªããšãã«ç¡å¹ã«ãªã£ãŠãã\n⢠ãã³ããå¿ èŠãªãšãã«ã®ã¿æå¹ã«ãªãã䜿çšãããŠããªãå Žåã¯ç¡å¹ã«ãªã | |
- 8.1.5.b æ åœè ãã€ã³ã¿ãã¥ãŒããããã»ã¹ã芳å¯ããããšã§ã䜿çšäžã«ãã³ãã®ãªã¢ãŒãã¢ã¯ã»ã¹ã¢ã«ãŠã³ããç£èŠãããŠããããšã確èªããã | |
- 8.1.6 6 å以äžã®è©Šè¡ã§ããŠãŒã¶ ID ãããã¯ã¢ãŠãããããšã«ãã£ãŠãã¢ã¯ã»ã¹ã®è©Šè¡åæ°ãå¶éããã: | |
- 8.1.6.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã§ãã·ã¹ãã æ§æèšå®ã調ã¹ã6 å以äžç¡å¹ã®ãã°ãªã³ãç¹°ãè¿ããå Žåã«ããŠãŒã¶ã®ã¢ã«ãŠã³ããããã¯ãããããšãèŠæ±ãããããèªèšŒãã©ã¡ãŒã¿ãèšå®ãããŠããããšã確èªããã | |
- 8.1.6.b ãµãŒãã¹ãããã€ãã®å Žåã®ã¿ã®è¿œå ã®æé ãå éšããã»ã¹ãšé¡§å®¢/ãŠãŒã¶ããã¥ã¢ã«ãã¬ãã¥ãŒããå®è£ ãããããã»ã¹ã芳å¯ããããšã§ã6 å以äžç¡å¹ã®ãã°ãªã³ãç¹°ãè¿ããå Žåã«ããŠãŒã¶ã®ã¢ã«ãŠã³ããäžæçã«ããã¯ããããã確èªããã | |
- 8.1.7 æäœ 30 åéããŸãã¯ç®¡çè ããŠãŒã¶ ID ãæå¹ã«ãããŸã§ã®ããã¯ã¢ãŠãæéãèšå®ããã: | |
- 8.1.7 ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã§ãã·ã¹ãã æ§æèšå®ã調ã¹ããŠãŒã¶ã¢ã«ãŠã³ããããã¯ã¢ãŠããããããæäœ 30 åéããŸãã¯ç®¡çè ããŠãŒã¶ ID ãæå¹ã«ãããŸã§ã®ããã¯ã¢ãŠãç¶æ ãç¶ãããšãèŠæ±ãããããèªèšŒãã©ã¡ãŒã¿ãèšå®ãããŠããããšã確èªããã | |
- 8.1.8 ã»ãã·ã§ã³ã®ã¢ã€ãã«ç¶æ ã 15åãè¶ ããå Žåãã¿ãŒããã«ãŸãã¯ã»ãã·ã§ã³ãå床ã¢ã¯ãã£ãã«ããããããŠãŒã¶ã®åèªèšŒãå¿ èŠãšãªãã: | |
- 8.1.8 ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã§ãã·ã¹ãã æ§æèšå®ã調ã¹ãã»ãã·ã§ã³ã®ã¢ã€ãã«ç¶æ ã 15 åãè¶ ããå Žåãã¿ãŒããã«ãŸãã¯ã»ãã·ã§ã³ãå床ã¢ã¯ãã£ãã«ããããããŠãŒã¶ã®åèªèšŒãå¿ èŠãšãªãããšã確èªããã | |
- 8.2 äžæã® ID ãå²ãåœãŠãããšã«å ãããã¹ãŠã®ãŠãŒã¶ãèªèšŒããããã次ã®æ¹æ³ã®å°ãªããšã 1 ã€ã䜿çšããããšã§ããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãäžã§ã®é¡§å®¢ä»¥å€ã®ãŠãŒã¶ãšç®¡çè ã®é©åãªãŠãŒã¶èªèšŒç®¡çã確èªããã\n⢠ãŠãŒã¶ãç¥ã£ãŠããããšïŒãã¹ã¯ãŒãããã¹ãã¬ãŒãºãªã©ïŒ\n⢠ããŒã¯ã³ããã€ã¹ãã¹ããŒãã«ãŒããªã©ããŠãŒã¶ãææããŠãããã®\n⢠ãŠãŒã¶èªèº«ã瀺ããã®ïŒçäœèªèšŒãªã©ïŒ: | |
- 8.2ãŠãŒã¶ãã«ãŒãäŒå¡ããŒã¿ç°å¢ã«ã¢ã¯ã»ã¹ããããã®äžæã® ID ãšè¿œå ã®èªèšŒïŒãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãªã©ïŒã䜿çšããŠèªèšŒãããããšã確èªããããã次ã®é ç®ãå®è¡ããã\n⢠䜿çšãããèªèšŒæ¹æ³ã«ã€ããŠèšè¿°ããææžã調ã¹ãã\n⢠䜿çšãããèªèšŒæ¹æ³ã®åçš®é¡ããã³ã·ã¹ãã ã³ã³ããŒãã³ãã®åçš®é¡ã«ã€ããŠãèªèšŒã調ã¹ãŠãææžã«èšè¿°ãããèªèšŒæ¹æ³ã«åŸã£ãŠèªèšŒãæ©èœããŠããããšã確èªããã | |
- 8.2.1 匷åãªæå·åã䜿çšããŠããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã§ãéä¿¡ãšä¿åäžã«èªèšŒæ å ±ïŒãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãªã©ïŒããã¹ãŠèªã¿åãäžèœãšããã: | |
- 8.2.1.a ãã³ãææžãšã·ã¹ãã æ§æèšå®ã調ã¹ãŠãéä¿¡ããã³ä¿åäžã«ãã¹ã¯ãŒãã匷åãªæå·åã«ãã£ãŠä¿è·ãããŠããããšã確èªããã | |
- 8.2.1.b ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«å¯ŸããŠããã¹ã¯ãŒããã¡ã€ã«ã調ã¹ãŠããã¹ã¯ãŒããä¿åäžã«èªã¿åãäžèœã§ããããšã確èªããã | |
- 8.2.1.c ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«å¯ŸããŠãããŒã¿äŒéã調ã¹ãŠããã¹ã¯ãŒããä¿åäžã«èªã¿åãäžèœã§ããããšã確èªããã | |
- 8.2.1.d ãµãŒãã¹ãããã€ãçšã®è¿œå æé ããã¹ã¯ãŒããã¡ã€ã«ã芳å¯ããŠãä¿åäžã«é¡§å®¢ã®ãã¹ã¯ãŒããèªã¿åããªãããšã確èªããã | |
- 8.2.1.e ãµãŒãã¹ãããã€ãçšã®è¿œå æé ãããŒã¿ã®éä¿¡ã芳å¯ããŠãéä¿¡äžã«é¡§å®¢ã®ãã¹ã¯ãŒããèªã¿åããªãããšã確èªããã | |
- 8.2.2 ãã¹ã¯ãŒãã®ãªã»ãããæ°ããããŒã¯ã³ã®æºåãæ°ããããŒã®çæãªã©ãèªèšŒæ å ±ãå€æŽããåã«ããŠãŒã¶ã®èº«å ã確èªããã: | |
- 8.2.2 èªèšŒæ å ±ãå€æŽããããã®èªèšŒæé ã調ã¹ãŠãã»ãã¥ãªãã£æ åœè ã芳å¯ããŠããŠãŒã¶ããé»è©±ãé»åã¡ãŒã«ãWebããŸãã¯ä»ã®é察é¢æ³ã§ãã¹ã¯ãŒãã®ãªã»ãããèŠæ±ããå Žåããã¹ã¯ãŒãããªã»ãããããåã«ããŠãŒã¶ã®èº«å ã確èªãããŠããããšã確èªããã | |
- 8.2.3 ãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºã¯ä»¥äžãæºããå¿ èŠãããã\n⢠ãã¹ã¯ãŒãã« 7 æå以äžãå«ãŸãã\n⢠æ°åãšè±æåã®äž¡æ¹ãå«ã\nãããã¯ãäžèšã®ãã©ã¡ãŒã¿ã«çããè€éããšåŒ·åºŠãæã€ãã¹ã¯ãŒã/ãã¹ãã¬ãŒãº: | |
- 8.2.3a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠãã·ã¹ãã æ§æèšå®ã調ã¹ãŠãå°ãªããšã以äžã®åŒ·åºŠ/è€éããå¿ èŠãšããããã«ãŠãŒã¶ãã¹ã¯ãŒãã®ãã©ã¡ãŒã¿ãèšå®ãããŠããããšã確èªããã\n⢠ãã¹ã¯ãŒãã« 7 æå以äžãå«ãŸãã\n⢠æ°åãšè±æåã®äž¡æ¹ãå«ã | |
- 8.2.3.b ãµãŒãã¹ãããã€ãçšã®è¿œå æé ãå éšããã»ã¹ããã³é¡§å®¢/ãŠãŒã¶ææžã確èªããŠãæ¶è²»è 以å€ã®ãŠãŒã¶ã®ãã¹ã¯ãŒããå°ãªããšã次ã®åŒ·åºŠ/è€éããæºããããšãèŠæ±ãããŠããããšã確èªããã\n⢠ãã¹ã¯ãŒãã« 7 æå以äžãå«ãŸãã\n⢠æ°åãšè±åã®äž¡æ¹ãå«ã | |
- 8.2.4 ãŠãŒã¶ãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºã¯ãå°ãªããšã90æ¥ããšå€æŽããã: | |
- 8.2.4.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠãã·ã¹ãã æ§æèšå®ã調ã¹ãŠãå°ãªããšã 90 æ¥ããšã«ãã¹ã¯ãŒããå€æŽããããšãèŠæ±ããããã«ãŠãŒã¶ãã¹ã¯ãŒãã®ãã©ã¡ãŒã¿ãèšå®ãããŠããããšã確èªããã | |
- 8.2.4.b ãµãŒãã¹ãããã€ãçšã®è¿œå æé ãå éšããã»ã¹ããã³é¡§å®¢/ãŠãŒã¶ææžã調ã¹ãŠã以äžã確èªããã\n⢠éæ¶è²»è ãŠãŒã¶ãã¹ã¯ãŒããå®æçã«å€æŽããããšãèŠæ±ãããŠãã\n⢠æ¶è²»è 以å€ã®ãŠãŒã¶ã«ããã€ã©ã®ãããªç¶æ³äžã§ãã¹ã¯ãŒããå€æŽããå¿ èŠããããã«ã€ããŠã®ã¬ã€ãã³ã¹ãäžããããŠãã | |
- 8.2.5 ãããŸã§ã«äœ¿çšããæåŸã® 4 ã€ã®ãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºã®ãããããšåãã§ããæ°ãããã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãèš±å¯ããªãã: | |
- 8.2.5.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã§ãã·ã¹ãã æ§æèšå®ãå ¥æããŠèª¿ã¹ãæ°ãããã¹ã¯ãŒããšããŠããããŸã§ã«äœ¿çšããæåŸã® 4 ã€ã®ãã¹ã¯ãŒãã®ãããããšåããã¹ã¯ãŒããæå®ã§ããªãããšãèŠæ±ãããŠãŒã¶ãã¹ã¯ãŒããã©ã¡ãŒã¿ãèšå®ãããŠããããšã確èªããã | |
- 8.2.5.b ãµãŒãã¹ãããã€ãçšã®è¿œå æé ãå éšããã»ã¹ãšé¡§å®¢/ãŠãŒã¶ããã¥ã¢ã«ã調ã¹ãŠãéæ¶è²»è ãŠãŒã¶ã®ãã¹ã¯ãŒãããããŸã§ã«äœ¿çšãã 4 ã€ã®ãã¹ã¯ãŒãã®ããããã«ããããšã¯ã§ããªããªã£ãŠããããšã確èªãã | |
- 8.2.6 åæãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãšãªã»ãããã¹ã¯ãŒã/ãã¹ãã¬ãŒãºããŠãŒã¶ããšã«äžæã®å€ã«ãªã»ããããååã®äœ¿çšåŸçŽã¡ã«å€æŽããã: | |
- 8.2.6 ãã¹ã¯ãŒãæé ã調ã¹ãŠãæ°ãããŠãŒã¶ã®åæãã¹ã¯ãŒããšæ¢åãŠãŒã¶ã®ãªã»ãããã¹ã¯ãŒãããåãŠãŒã¶ã§äžæã®å€ã«èšå®ãããååã®äœ¿çšåŸã«å€æŽãããŠããããšã確èªããã | |
- 8.3 åŸæ¥å¡ïŒãŠãŒã¶ãšç®¡çè ãå«ãïŒããã³ç¬¬äžè ïŒãµããŒããã¡ã³ããã³ã¹çšã®ãã³ãã¢ã¯ã»ã¹ãå«ãïŒã«ãããããã¯ãŒã¯ãžã®ãªã¢ãŒãã¢ã¯ã»ã¹ïŒãããã¯ãŒã¯å€éšããã®ãããã¯ãŒã¯ã¬ãã«ã¢ã¯ã»ã¹ïŒã« 2 å åèªèšŒãçµã¿èŸŒãã\næ³šïŒ 2 å åèªèšŒã§ã¯ã3 ã€ã®èªèšŒæ¹æ³ã®ãã¡ 2 ã€ãèªèšŒã«äœ¿çšããå¿ èŠãããïŒèªèšŒæ¹æ³ã«ã€ããŠã¯ãèŠä»¶ 8.2 ãåç §ïŒã1 ã€ã®å åã 2 å䜿çšããããšïŒããšãã°ã2 ã€ã®åå¥ãã¹ã¯ãŒãã䜿çšããïŒã¯ã2 å åèªèšŒãšã¯èŠãªãããªãã\n2 å åèªèšŒæ¹åŒã®äŸãšããŠã¯ãããŒã¯ã³\n䜿çšã® RADIUSïŒRemote Authentication\nand Dial-In ServiceïŒãããŒã¯ã³äœ¿çšã®\nTACACSïŒTerminal Access Controller\nAcceess Control SystemïŒãããã³ 2 å \nåèªèšŒãä¿é²ããä»ã®æ¹åŒããããŸãã: | |
- 8.3.a ãªã¢ãŒãã¢ã¯ã»ã¹ãµãŒããšã·ã¹ãã ã®ã·ã¹ãã æ§æã調ã¹ãŠã以äžã«å¯Ÿã㊠2 å åèªèšŒãèŠæ±ãããŠããããšã確èªããã\n⢠åŸæ¥å¡ã«ãããã¹ãŠã®ãªã¢ãŒãã¢ã¯ã»ã¹\n⢠ãã¹ãŠã®ç¬¬äžè /ãã³ããªã¢ãŒãã¢ã¯ã»ã¹ïŒãµããŒããã¡ã³ããã³ã¹ç®çã§ã®ã¢ããªã±ãŒã·ã§ã³ãã·ã¹ãã ã³ã³ããŒãã³ããžã®ã¢ã¯ã»ã¹ãå«ãïŒ | |
- 8.3.b ãããã¯ãŒã¯ã«ãªã¢ãŒãæ¥ç¶ããåŸæ¥å¡ïŒãŠãŒã¶ã管çè ãªã©ïŒã®ãµã³ãã«ã芳å¯ãã3 ã€ã®èªèšŒæ¹æ³ã®ãã¡ 2 ã€ã䜿çšãããŠããããšã確èªããã | |
- 8.4以äžãå«ãèªèšŒæé ããã³ããªã·ãŒãææžåãããã¹ãŠã®ãŠãŒã¶ã«ééããã\n⢠匷åãªèªèšŒæ å ±ãéžæããããã®ã¬ã€ãã³ã¹\n⢠ãŠãŒã¶ãèªåã®èªèšŒæ å ±ãä¿è·ããæ¹æ³ã«ã€ããŠã®ã¬ã€ãã³ã¹\n⢠åã«äœ¿çšããŠãããã¹ã¯ãŒããå䜿çšããªããšããæ瀺\nã»ãã¹ã¯ãŒãã䟵害ãããçããããå Žåã«ã¯ãã¹ã¯ãŒããå€æŽãããšããæ瀺: | |
- 8.4.a æé ã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãèªèšŒæé ãšããªã·ãŒããã¹ãŠã®ãŠãŒã¶ã«é åžãããŠããããšã確èªããã | |
- 8.4.b ãŠãŒã¶ã«é åžãããèªèšŒæé ãšããªã·ãŒã調ã¹ãããšã§ã以äžã確èªããã\n⢠匷åãªèªèšŒæ å ±ãéžæããããã®ã¬ã€ãã³ã¹\n⢠ãŠãŒã¶ãèªåã®èªèšŒæ å ±ãä¿è·ããæ³æ¹ã«ã€ããŠã®ã¬ã€ãã³ã¹\n⢠åã«äœ¿çšããŠãããã¹ã¯ãŒããå䜿çšããªããšããæ瀺\n⢠ãã¹ã¯ãŒãã䟵害ãããçããããå Žåã«ã¯ãã¹ã¯ãŒããå€æŽãããšããæ瀺 | |
- 8.4.c ãŠãŒã¶ã®ãµã³ãã«ã®ã€ã³ã¿ãã¥ãŒãè¡ããèªèšŒæé ããã³ããªã·ãŒã«ç²ŸéããŠããããšã確èªããã | |
- 8.5 次ã®ããã«ãã°ã«ãŒããå ±æããŸãã¯æ±çšã® ID ããã¹ã¯ãŒãããŸãã¯ä»ã®èªèšŒæ¹æ³ã䜿çšãããŠããªãã\n⢠æ±çšãŠãŒã¶ ID ããã³ã¢ã«ãŠã³ããç¡å¹åãŸãã¯åé€ãããŠãã\n⢠ã·ã¹ãã 管çäœæ¥ããã³ãã®ä»ã®éèŠãªæ©èœã«å¯Ÿããå ±æãŠãŒã¶ ID ãååšããªã\n⢠ã·ã¹ãã ã³ã³ããŒãã³ãã®ç®¡çã«å ±æããã³æ±çšãŠãŒã¶ ID ã䜿çšãããŠããªã: | |
- 8.5.a ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«ã€ããŠããŠãŒã¶ ID ãªã¹ãã調ã¹ãŠã以äžã確èªããã\n⢠æ±çšãŠãŒã¶ ID ãç¡å¹åãŸãã¯åé€ãããŠãã\n⢠ã·ã¹ãã 管çäœæ¥ããã³ãã®ä»ã®éèŠãªæ©èœã®ããã®å ±æãŠãŒã¶ ID ãååšããªã\n⢠ã·ã¹ãã ã³ã³ããŒãã³ãã®ç®¡çã«å ±æããã³æ±çšãŠãŒã¶ ID ã䜿çšãããŠããªã | |
- 8.5.b èªèšŒããªã·ãŒ/æé ã調ã¹ãŠãã°ã«ãŒãããã³å ±æ ID ããã¹ã¯ãŒããŸãã¯ä»ã®èªèšŒæ¹æ³ãæ瀺çã«çŠæ¢ãããŠããããšã確èªããã | |
- 8.5.c ã·ã¹ãã 管çè ã®ã€ã³ã¿ãã¥ãŒãè¡ããã°ã«ãŒãããã³å ±æ ID ããã¹ã¯ãŒãããŸãã¯ä»ã®èªèšŒæ¹æ³ããèŠæ±ããã£ãŠãé åžãããªãããšã確èªããã | |
- 8.5.1 ãµãŒãã¹ãããã€ããžã®è¿œå èŠä»¶ïŒé¡§å®¢ç°å¢ãžã®ã¢ã¯ã»ã¹æš©ãæã€ãµãŒãã¹ãããã€ãã¯ãå顧客ã«äžæãªèªèšŒæ å ±ïŒãã¹ã¯ãŒã/ãã¹ãã¬ãŒãºãªã©ïŒã䜿çšããå¿ èŠãããã\næ³šïŒ ãã®èŠä»¶ã¯ãè€æ°ã®é¡§å®¢ç°å¢ããã¹ããããŠãããç¬èªã®ãã¹ãã£ã³ã°ç°å¢ã«ã¢ã¯ã»ã¹ããå ±æãã¹ãã£ã³ã°ãããã€ãã«é©çšããããšãæå³ããŠããŸããã\næ³šïŒ èŠä»¶ 8.5.1 ã¯ã2015 幎 6 æ 30 æ¥ãŸã§ã¯ãã¹ããã©ã¯ãã£ã¹ãšã¿ãªããããã以éã¯èŠä»¶ã«ãªãã: | |
- 8.5.1 ãµãŒãã¹ãããã€ãçšã®è¿œå æç¶ã: èªèšŒããªã·ãŒãšæé ã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãå顧客ç°å¢ã«ã¢ã¯ã»ã¹ããããã«ç°ãªãèªèšŒã䜿çšãããŠããããšã確èªããã | |
- 8.6 ãã®ä»ã®èªèšŒã¡ã«ããºã ã䜿çšãããŠããïŒããšãã°ãç©ççãŸãã¯è«ççã»ãã¥ãªãã£ããŒã¯ã³ãã¹ããŒãã«ãŒãã蚌ææžãªã©ïŒãããã®ã¡ã«ããºã ã®äœ¿çšã¯ã以äžã®ããã«å²ãåœãŠãå¿ èŠãããã\n⢠èªèšŒã¡ã«ããºã ã¯ãåã ã®ã¢ã«ãŠã³ãã«å²ãåœãŠãªããã°ãªãããè€æ°ã¢ã«ãŠã³ãã§å ±æããããšã¯ã§ããªã\n⢠ç©ç/è«çå¶åŸ¡ã«ãããæå³ãããã¢ã«ãŠã³ãã®ã¿ãã¢ã¯ã»ã¹ã§ããããã«ããå¿ èŠããã: | |
- 8.6.a èªèšŒããªã·ãŒãšæé ã調ã¹ãç©çã»ãã¥ãªãã£ããŒã¯ã³ãã¹ããŒãã«ãŒãã蚌ææžãªã©ã䜿çšããæé ãå®çŸ©ãããŠãã以äžãå«ãããšã確èªããã\n⢠èªèšŒã¡ã«ããºã ããåã ã®ã¢ã«ãŠã³ãã«å²ãåœãŠãããŠãããè€æ°ã¢ã«ãŠã³ãã§å ±æãããŠããªã\n⢠ç©ç/è«çå¶åŸ¡ã«ãããæå³ãããã¢ã«ãŠã³ãã®ã¿ãã¢ã¯ã»ã¹ã§ããããã«ãªã£ãŠãã | |
- 8.6.b ã»ãã¥ãªãã£æ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãèªèšŒã¡ã«ããºã ããåã ã®ã¢ã«ãŠã³ãã«å²ãåœãŠãããŠãããè€æ°ã¢ã«ãŠã³ãã§å ±æãããŠããªãããšã確èªããã | |
- 8.6.c ã·ã¹ãã æ§æèšå®ã該åœããå Žåã¯ç©çå¶åŸ¡ã調ã¹ãŠãç©ç/è«çå¶åŸ¡ã«ãããæå³ãããã¢ã«ãŠã³ãã®ã¿ããã®ã¡ã«ããºã ã䜿ã£ãŠã¢ã¯ã»ã¹ã§ããããã«ããå¶åŸ¡ãå®è£ ãããŠããããšã確èªããã | |
- 8.7 ã«ãŒãäŒå¡ããŒã¿ãå«ãããŒã¿ããŒã¹ãžã®ãã¹ãŠã®ã¢ã¯ã»ã¹ïŒã¢ããªã±ãŒã·ã§ã³ã管çè ãããã³ãã®ä»ã®ãã¹ãŠã®ãŠãŒã¶ã«ããã¢ã¯ã»ã¹ãå«ãïŒã以äžã®ããã«å¶éãããŠããã\n⢠ããŒã¿ããŒã¹ãžã®ãŠãŒã¶ã¢ã¯ã»ã¹ãããŒã¿ããŒã¹ã®ãŠãŒã¶ã¯ãšãªãããŒã¿ããŒã¹ã«å¯ŸãããŠãŒã¶ã¢ã¯ã·ã§ã³ã¯ãã¹ãŠãããã°ã©ã ã«ããæ¹æ³ã«ãã£ãŠã®ã¿è¡ãããã\nã» ããŒã¿ããŒã¹ãžã®çŽæ¥ã¢ã¯ã»ã¹ãŸãã¯ã¯ãšãªã¯ããŒã¿ããŒã¹ç®¡çè ã®ã¿ã«å¶éãããã\nã» ããŒã¿ããŒã¹ã¢ããªã±ãŒã·ã§ã³çšã®ã¢ããªã±ãŒã·ã§ã³ ID ã䜿çšã§ããã®ã¯ãã®ã¢ããªã±ãŒã·ã§ã³ã®ã¿ã§ãã\nïŒåã ã®ãŠãŒã¶ããã®ä»ã®éã¢ããªã±ãŒã·ã§ã³ããã»ã¹ã¯äœ¿çšã§ããªãïŒã: | |
- 8.7.a ããŒã¿ããŒã¹ããã³ã¢ããªã±ãŒã·ã§ã³ã®æ§æèšå®ã調ã¹ããã¹ãŠã®ãŠãŒã¶ãã¢ã¯ã»ã¹ããåã«èªèšŒãããŠããããšã確èªããã | |
- 8.7.b ããŒã¿ããŒã¹ããã³ã¢ããªã±ãŒã·ã§ã³ã®æ§æèšå®ã調ã¹ãŠãããŒã¿ããŒã¹ã§ã®ãã¹ãŠã®ãŠãŒã¶ã¢ã¯ã»ã¹ããŠãŒã¶ã®ã¯ãšãªãããã³ãŠãŒã¶ã®ã¢ã¯ã·ã§ã³ïŒããšãã°ã移åãã³ããŒãåé€ïŒããããã°ã©ã ã䜿çšããæ¹æ³ïŒã¹ãã¢ãããã·ãŒãžã£ãä»ããŠãªã©ïŒã«ãã£ãŠã®ã¿å®è¡ãããããšã確èªããã | |
- 8.7.c ããŒã¿ããŒã¹ã¢ã¯ã»ã¹å¶åŸ¡èšå®ãšããŒã¿ããŒã¹ã¢ããªã±ãŒã·ã§ã³æ§æèšå®ã調ã¹ãŠããŠãŒã¶ã®çŽæ¥ã¢ã¯ã»ã¹ãŸãã¯ããŒã¿ããŒã¹ãžã®ã¯ãšãªãããŒã¿ããŒã¹ç®¡çè ã«å¶éãããŠããããšã確èªããã | |
- 8.7.d ããŒã¿ããŒã¹ã¢ã¯ã»ã¹å¶åŸ¡èšå®ãããŒã¿ããŒã¹ã¢ããªã±ãŒã·ã§ã³èšå®ãããã³é¢é£ã¢ããªã±ãŒã·ã§ã³ ID ã調ã¹ãŠãã¢ããªã±ãŒã·ã§ã³ ID ãã¢ããªã±ãŒã·ã§ã³ã«ãã£ãŠã®ã¿äœ¿çšã§ããããšã確èªããïŒåã ã®ãŠãŒã¶ãŸãã¯ãã®ä»ã®ããã»ã¹ã§ã¯äœ¿çšã§ããªãïŒã | |
- 8.8 èå¥ãšèªèšŒã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 8.8 ææžã調ã¹ãé¢ä¿è ãã€ã³ã¿ãã¥ãŒããããšã§ãèå¥ãšèªèšŒã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶9ïŒã«ãŒãäŒå¡ããŒã¿ãžã®ç©çã¢ã¯ã»ã¹ãå¶éãã: | |
- 9.1 é©åãªæœèšå ¥é€šç®¡çã䜿çšããŠãã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®ã·ã¹ãã ãžã®ç©çã¢ã¯ã»ã¹ãå¶éããã³ç£èŠããã: | |
- 9.1 åã³ã³ãã¥ãŒã¿ã«ãŒã ãããŒã¿ã»ã³ã¿ãŒãããã³ã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®ã·ã¹ãã ãåããç©ççãªãšãªã¢ã§ãç©ççãªã»ãã¥ãªãã£ã³ã³ãããŒã«ãååšããããšã確èªããã\nã»ãããžèªã¿åãæ©ãŸãã¯æ¿èªæžã¿ãããžãæœé ãéµãªã©ã®ãã®ä»ã®ããã€ã¹ã«ãã£ãŠã¢ã¯ã»ã¹ã管çãããŠããããšã確èªããã\nã»ã·ã¹ãã 管çè ãã«ãŒãäŒå¡ç°å¢å ã®ã©ã³ãã ã«éžæããã·ã¹ãã ã®ã³ã³ãœãŒã«ã«ãã°ã€ã³ããã®ã芳å¯ããŠãã³ã³ãœãŒã«ãäžæ£äœ¿çšãé²æ¢ããããã«ãããã¯ããããŠããããšã確èªããã | |
- 9.1.1 ãããªã«ã¡ã©ãã¢ã¯ã»ã¹ç®¡çã¡ã«ããºã ã䜿çšããŠãæ©å¯ãšãªã¢ãžã®åã ã®ç©çã¢ã¯ã»ã¹ãç£èŠãããåéãããããŒã¿ã確èªãããã®ä»ã®ãšã³ããªãšçžé¢ä»ãããæ³åŸã«ãã£ãŠå¥éå®ããããŠããªãéããå°ãªããšã3ã«æéä¿ç®¡ããã\n泚ïŒãæ©å¯ãšãªã¢ããšã¯ãããŒã¿ã»ã³ã¿ããµãŒãã«ãŒã ããŸãã¯ã«ãŒãäŒå¡ããŒã¿ãä¿åãåŠçããŸãã¯äŒéããã·ã¹ãã ãèšçœ®ãããŠãããšãªã¢ã®ããšãããã«ã¯ãå°å£²åºã®ã¬ãžãªã©ãPOS端æ«ã®ã¿ãååšãããšãªã¢ã¯å«ãŸããªãã: | |
- 9.1.1.a ãããªã«ã¡ã©ãã¢ã¯ã»ã¹å¶åŸ¡ã¡ã«ããºã ã䜿çšããŠãæ©å¯ãšãªã¢ãžã®å ¥éå Žãã€ã³ããç£èŠããã | |
- 9.1.1.b ãããªã«ã¡ã©ãã¢ã¯ã»ã¹å¶åŸ¡ã¡ã«ããºã ãæ¹ãããç¡å¹åããä¿è·ãããŠããããšã確èªããã | |
- 9.1.1.c ãããªã«ã¡ã©ãã¢ã¯ã»ã¹ç®¡çã¡ã«ããºã ãç£èŠãããŠããŠãã«ã¡ã©ãŸãã¯ãã®ä»ã®ã¡ã«ããºã ããã®ããŒã¿ãå°ãªããšã3ã«æéä¿ç®¡ãããŠããããšã確èªããã | |
- 9.1.2 ç©ç/è«çå¶åŸ¡ãå®æœããããšã§ã誰ã§ãã¢ã¯ã»ã¹å¯èœãªãããã¯ãŒã¯ãžã£ãã¯ãžã®ã¢ã¯ã»ã¹ãå¶éããã\nããšãã°ãå ¬å ±ã®å Žã蚪åè ãã¢ã¯ã»ã¹å¯èœãªãšãªã¢ã«ãããããã¯ãŒã¯ãžã£ãã¯ã¯ãç¡å¹ã«ããŠããããããã¯ãŒã¯ãžã®ã¢ã¯ã»ã¹ãæ瀺çã«æ¿èªãããŠããå Žåã«ã®ã¿æå¹ã«ããããšãã§ããããŸãã¯ãã¢ã¯ãã£ããªãããã¯ãŒã¯ãžã£ãã¯ããããšãªã¢ã§ã¯èšªåè ã«åžžã«åè¡è ãã€ããããã»ã¹ãå®æœã§ããã: | |
- 9.1.2 責任è ãã€ã³ã¿ãã¥ãŒãã誰ã§ãã¢ã¯ã»ã¹ã§ããå Žæã«ãããããã¯ãŒã¯ãžã£ãã¯ã®å Žæã芳å¯ããŠãç©ç/è«çå¶åŸ¡ãåãã£ãŠããã誰ã§ãã¢ã¯ã»ã¹ã§ããå Žæã«ãããããã¯ãŒã¯ãžã£ãã¯ãžã®ã¢ã¯ã»ã¹ãå¶éããŠããããšã確èªããã | |
- 9.1.3 ã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããã²ãŒããŠã§ã€ããã³ããã«ãããã€ã¹ããããã¯ãŒã¯/éä¿¡ããŒããŠã§ã¢ãããã³é»æ°éä¿¡åç·ãžã®ç©çã¢ã¯ã»ã¹ãå¶éããã: | |
- 9.1.3 ã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããã²ãŒããŠã§ã€ããã³ããã«ãããã€ã¹ããããã¯ãŒã¯/éä¿¡ããŒããŠã§ã¢ãããã³é»æ°éä¿¡åç·ãžã®ç©ççãªã¢ã¯ã»ã¹ãé©åã«å¶éãããŠããããšã確èªããã | |
- 9.2 次ã®ããã«ãªã³ãµã€ãèŠå¡ãšèšªåè ã容æã«åºå¥ã§ãããããªæé ãéçºããã\nã»æ°ãããªã³ãµã€ãèŠå ã蚪åè ãèå¥ãã\nïŒãããžã®äœ¿çšãªã©ïŒ\nã»ã¢ã¯ã»ã¹èŠä»¶ãå€æŽãã\nã»å¥çŽãçµäºãããªã³ãµã€ãèŠå¡ãæéåãã®èšªåè ã® IDïŒãããžãªã©ïŒãç¡å¹ã«ãã: | |
- 9.2.a ãªã³ãµã€ãèŠå¡ããã³èšªåè ã«ãããžãå²ãåœãŠãããã®ããã»ã¹ãšæé ã確èªããŠããããã®ããã»ã¹ã«ä»¥äžãå«ãŸããŠããããšã確èªããã\n⢠æ°ãããããžãä»äžããããš\n⢠ã¢ã¯ã»ã¹èŠä»¶ãå€æŽããããš\n⢠å¥çŽãçµäºãããªã³ãµã€ãèŠå¡ãšæéåãã®èšªåè ãããžãåãæ¶ãããš | |
- 9.2.b ãªã³ãµã€ãæ åœè ãšèšªåè ãèå¥ããåºå¥ããããã»ã¹ã芳å¯ãã以äžã確èªããã\n⢠蚪åè ãæ確ã«èå¥ããã\n⢠ãªã³ãµã€ãèŠå¡ãšèšªåè ã容æã«åºå¥ã§ãã | |
- 9.2.c èå¥ããã»ã¹ïŒãããžã·ã¹ãã ãªã©ïŒãžã®ã¢ã¯ã»ã¹ããèš±å¯ãããæ åœè ã«å¶éãããŠããããšã確èªããã | |
- 9.2.d 䜿çšãããŠããèå¥æ¹æ³ïŒID ãããžãªã©ïŒã調ã¹ãŠã蚪åè ãæ確ã«èå¥ãããªã³ãµã€ãæ åœè ãšèšªåè ãç°¡åã«åºå¥ã§ããããšã確èªããã | |
- 9.3 ãªã³ãµã€ãèŠå¡ã®æ©å¯ãšãªã¢ãžã®ç©çã¢ã¯ã»ã¹ã次ã®ããã«å¶åŸ¡ããã\n⢠ã¢ã¯ã»ã¹ãåã ã®è·åã«åºã¥ããŠèš±å¯ããã\n⢠è·åã®çµäºåŸçŽã¡ã«ã¢ã¯ã»ã¹ãç¡å¹ãšããéµãã¢ã¯ã»ã¹ã«ãŒããªã©ãã¹ãŠã®ç©çã¢ã¯ã»ã¹ã¡ã«ããºã ãè¿éãããç¡å¹ã«ãã: | |
- 9.3.a CDE ãžã®ç©çã¢ã¯ã»ã¹æš©ãæã€ãªã³ãµã€ãèŠå¡ã®ãµã³ãã«ã«å¯ŸããŠã責任è ãã€ã³ã¿ãã¥ãŒããã¢ã¯ã»ã¹å¶åŸ¡ãªã¹ããèŠãŠã以äžã確èªããã\n⢠CDE ãžã®ã¢ã¯ã»ã¹ãèš±å¯ãããŠãã\n⢠ã¢ã¯ã»ã¹ããã®å人ã®è·åã«å¿ èŠ | |
- 9.3.b é¢ä¿è ã«ãã CDE ãžã®ã¢ã¯ã»ã¹ã芳å¯ããŠããã¹ãŠã®é¢ä¿è ã¯ãã¢ã¯ã»ã¹ãèš±å¯ãããåã«ãæ¿èªãå¿ èŠã§ããããšã確èªããã | |
- 9.3.c æè¿éè·ããåŸæ¥å¡ã®ãµã³ãã«ãéžæããã¢ã¯ã»ã¹å¶åŸ¡ãªã¹ãã調ã¹ããã®åŸæ¥å¡ã CDE ãžã®ç©çã¢ã¯ã»ã¹ãæããªãããšã確èªããã | |
- 9.4 蚪åè ãèå¥ããæ¿èªããæé ãå®æœããã\næé ã«ã¯ã以äžãå«ããå¿ èŠãããã: | |
- 9.4 蚪åè ã®æ¿èªãšã¢ã¯ã»ã¹å¶åŸ¡ã次ã®ããã«è¡ãããŠããããšã確èªããã | |
- 9.4.1 蚪åè ã¯ãã«ãŒãäŒå¡ããŒã¿ãåŠçãŸãã¯ä¿å®ãããŠãããšãªã¢ã«å ¥ãåã«æ¿èªãè¡ããããã®ãšãªã¢ã«ããéãã£ãšåè¡è ã«ä»ãæ·»ãããŠãã: | |
- 9.4.1.a æé ã芳å¯ããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ã蚪åè ã¯ãã«ãŒãäŒå¡ããŒã¿ãåŠçãŸãã¯ä¿å®ãããŠãããšãªã¢ã«å ¥ãããšãèš±å¯ãããåã«æ¿èªãè¡ããããã®ãšãªã¢ã«ããéãã£ãšåè¡è ã«ä»ãæ·»ãããŠããããšã確èªããã | |
- 9.4.1.b 蚪åè ID ãããžãŸãã¯ä»ã®ID ã®äœ¿çšã芳å¯ããŠãç©çããŒã¯ã³ã®ãããžãã«ãŒãäŒå¡ããŒã¿ã®åŠçãŸãã¯ä¿å®ããããŠããç©çãšãªã¢ã«åè¡è ãªãã§ã¢ã¯ã»ã¹ã§ããªãããšã確èªããã | |
- 9.4.2 蚪åè ãèå¥ããããªã³ãµã€ãæ åœè ããæ確ã«åºå¥ããããã®æå¹æéä»ããããžãã®ä»ã® ID ãäžããããã: | |
- 9.4.2.a æœèšå ã«ãã人ã芳å¯ãã蚪åè ãããžã䜿çšãããŠããŠã蚪åè ãšãªã³ãµã€ãæ åœè ãæ確ã«åºå¥ã§ããããšã確èªããã | |
- 9.4.2.b 蚪åè ã®ãããžãã®ä»ã® ID ãæå¹æéãéãããšç¡å¹ã«ãªãããšã確èªããã | |
- 9.4.3 æœèšãåºãåããŸãã¯æéãåããæ¥ã«ãããžãã®ä»ã® ID ã®è¿éãæ±ãããã: | |
- 9.4.3 æœèšããåºã蚪åè ã芳å¯ããŠã蚪åè ãéå»æãŸãã¯æéåãã®ãšãã«ãããžãã®ä»ã® ID ã®è¿éãæ±ããããŠããããšã確èªããã | |
- 9.4.4 蚪åè ãã°ã䜿çšããŠãã«ãŒãäŒå¡ããŒã¿ã®ä¿åãŸãã¯éä¿¡ãè¡ãããŠããã³ã³ãã¥ãŒã¿ã«ãŒã ãããŒã¿ã»ã³ã¿ãŒãªã©ã®æœèšãžã®èšªåè ã®è¡åã®ç©ççç£æ»èšŒè·¡ãä¿æããã\n蚪åè ã®ååãæå±äŒç€Ÿãç©çã¢ã¯ã»ã¹ãæ¿èªãããªã³ãµã€ãèŠå¡ããã°ã«èšé²ããã\næ³åŸã«ãã£ãŠå¥éå®ããããŠããªãéãããã®ãã°ãå°ãªããšã3ã«æéä¿ç®¡ããã: | |
- 9.4.4.a ã«ãŒãäŒå¡ããŒã¿ãä¿åãŸãã¯äŒéãããã³ã³ãã¥ãŒã¿ã«ãŒã ãããŒã¿ã»ã³ã¿ãŒã ãã§ãªããæœèšãžã®ç©çã¢ã¯ã»ã¹ã®èšé²ã«ã蚪åè ãã°ã䜿çšãããŠããããšã確èªããã | |
- 9.4.4.b ãã°ã«ä»¥äžãå«ãŸããŠããããšã確èªããã\n⢠蚪åè å\n⢠æå±äŒç€Ÿ\n⢠ç©çã¢ã¯ã»ã¹ãæ¿èªãããªã³ãµã€ãæ åœè | |
- 9.4.4.c ãã°ã 3 ã«æ以äžä¿æãããããšã確èªããã | |
- 9.5 ãã¹ãŠã®åªäœãç©ççã«ã»ãã¥ãªãã£ä¿è·ããã: | |
- 9.5 ã«ãŒãäŒå¡ããŒã¿ãä¿è·ããæé ã«ããã¹ãŠã®åªäœïŒã³ã³ãã¥ãŒã¿ããªã ãŒããã«é»ååªäœãçŽã®åé æžãçŽã®ã¬ããŒããFAX ãå«ãããããã«éå®ãããªãïŒã®ã»ãã¥ãªãã£ãç©ççã«ä¿è·ããããã®ç®¡çãå«ãŸããŠããããšã確èªããã | |
- 9.5.1 ããã¯ã¢ããã®å ¥ã£ãåªäœãå®å šãªå Žæã«ä¿ç®¡ããïŒä»£æ¿ãŸãã¯ããã¯ã¢ãããµã€ããåçšã¹ãã¬ãŒãžæœèšãªã©ã®ãªããµã€ãæœèšãæãŸããïŒãä¿ç®¡å Žæã®ã»ãã¥ãªãã£ãå°ãªããšã幎ã«äžåºŠç¢ºèªãã: | |
- 9.5.1.a ä¿ç®¡å Žæã®ç©ççãªã»ãã¥ãªãã£ã芳å¯ããŠãããã¯ã¢ããã¡ãã£ã¢ã®ä¿ç®¡ãå®å šã§ããããšã確èªããã | |
- 9.5.1.b ä¿ç®¡å Žæã®ã»ãã¥ãªãã£ãå°ãªããšã幎ã«äžåºŠã¬ãã¥ãŒããŠããããšã確èªããã | |
- 9.6 次ã®é ç®ãå«ããããããã¿ã€ãã®åªäœãå éšãŸãã¯å€éšã«é åžããéã®å³æ Œãªç®¡çãç¶æããã: | |
- 9.6 åªäœã®é åžã管çããããã®ããªã·ãŒãååšãããã®ããªã·ãŒããå人ã«é åžããããã®ãå«ãããã¹ãŠã®é åžåªäœã«å¯Ÿå¿ããŠããããšã確èªããã | |
- 9.6.1 ããŒã¿ã®æ©å¯æ§ãèå¥ã§ããããã«ãåªäœãåé¡ããã: | |
- 9.6.1 ããŒã¿ã®æ床ã決å®ããããšãã§ããããã«ããã¹ãŠã®åªäœãåé¡ãããŠããããšã確èªããã | |
- 9.6.2 å®å šãªé éæ¥è ãŸãã¯æ£ç¢ºã«è¿œè·¡ããããšãã§ãããã®ä»ã®æ¹æ³ã«ãã£ãŠåªäœãéä»ããã: | |
- 9.6.2.a æ åœè ãã€ã³ã¿ãã¥ãŒããèšé²ã調ã¹ãŠãæœèšã®å€éšã«éä»ããããã¹ãŠã®åªäœããã°ã«èšé²ãããå®å šãªé éæ¥è ãŸãã¯è¿œè·¡å¯èœãªãã®ä»ã®é éæ¹æ³ã«ãã£ãŠéä»ãããããšã確èªããã | |
- 9.6.2.b ãã¹ãŠã®åªäœã®æ°æ¥åã®ãªããµã€ã远跡ãã°ã®ææ°ãµã³ãã«ãéžæãã远跡ã®è©³çŽ°ããã°ã«èšé²ãããŠããããšã確èªããã | |
- 9.6.3 å®å šãªãšãªã¢ãã移åããããã¹ãŠã®åªäœã管çè ãæ¿èªããŠããããšã確èªãã\nïŒåªäœãå人ã«é åžãããå Žåãå«ãïŒã: | |
- 9.6.3 ãã¹ãŠã®åªäœã®æ°æ¥åã®ãªããµã€ã远跡ãã°ã®ææ°ãµã³ãã«ãéžæããããã°ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãåªäœãå®å šãªãšãªã¢ãã移åãããïŒåªäœãå人ã«é éãããå Žåãå«ãïŒãã³ã«é©åãªç®¡çè ã®æ¿èªãåŸãããŠããããšã確èªããã | |
- 9.7 åªäœã®ä¿ç®¡ããã³ã¢ã¯ã»ã¹ã«ã€ããŠãå³å¯ãªç®¡çãç¶æããã: | |
- 9.7 ãã¹ãŠã®åªäœã®ä¿ç®¡ãšç¶æã管çããããã®ããªã·ãŒãå ¥æããŠèª¿ã¹ãããªã·ãŒã§å®æçãªåªäœã®åšåº«èª¿æ»ãèŠæ±ãããŠããããšã確èªãã | |
- 9.7.1 ãã¹ãŠã®åªäœã®åšåº«ãã°ãä¿æããå°ãªããšã幎ã«äžåºŠãåªäœã®åšåº«èª¿æ»ãå®æœãã: | |
- 9.7.1 åªäœã®åšåº«ãã°ã調ã¹ãŠãåªäœã®åšåº«èª¿æ»ãå°ãªããšã幎ã«äžåºŠè¡ãããŠããããšã確èªããã | |
- 9.8 次ã®ããã«ãããžãã¹ãŸãã¯æ³åŸäžäžèŠã«ãªã£ãåªäœãç Žæ£ããã: | |
- 9.8 å®æçãªåªäœç Žæ£ããªã·ãŒã調ã¹ãŠããã¹ãŠã®åªäœã察象ã«ãªã£ãŠããã以äžã®èŠä»¶ãå®çŸ©ãããŠããããšã確èªããã\n⢠ããŒãã³ããŒè³æã¯åçŸã§ããªãããšã®åççãªä¿èšŒãåŸãããããã«ãã¯ãã¹ã«ããè£æãçŒåŽããŸãã¯ãã«ãåããå¿ èŠãããã\nâ¢ ç Žæ£ããè³æãä¿ç®¡ãã容åšã¯å®å šã§ãªããã°ãªããªãã\n⢠é»ååªäœäžã®ã«ãŒãäŒå¡ããŒã¿ããå®å šãªåé€ã«é¢ããŠæ¥çãæ¿èªããæšæºã«åŸã£ãå®å šãªã¯ã€ãããã°ã©ã ã«ãã£ãŠããŸãã¯ãã以å€ã®å Žåã¯åªäœã®ç©ççãªç Žå£ã«ãã£ãŠãå埩äžèœã«ãªã£ãŠããå¿ èŠãããã | |
- 9.8.1 ã«ãŒãäŒå¡ããŒã¿ãåçŸã§ããªããããããŒãã³ããŒè³æãè£æãçŒåŽããŸãã¯ãã«ãåãããç Žæ£ããè³æãä¿ç®¡ãã容åšãå®å šã«ä¿è·ããã: | |
- 9.8.1.a æ åœè ãã€ã³ã¿ãã¥ãŒããæé ã調ã¹ãŠãããŒãã³ããŒã®è³æãåçŸã§ããªãããšã®åççãªä¿èšŒãåŸãããããã«ãã¯ãã¹ã«ããè£æãçŒåŽããŸãã¯ãã«ãåãããŠããããšã確èªããã | |
- 9.8.1.b ç Žæ£ãããæ å ±ãå«ãè³æã®ä¿ç®¡ã«äœ¿çšãããã³ã³ããã調ã¹ãŠãã³ã³ãããå®å šã«ä¿è·ãããŠããããšã確èªããã | |
- 9.8.2 ã«ãŒãäŒå¡ããŒã¿ãåçŸã§ããªããããé»ååªäœäžã®ã«ãŒãäŒå¡ããŒã¿ãå埩äžèœã«ããã: | |
- 9.8.2 é»ååªäœäžã®ã«ãŒãäŒå¡ããŒã¿ããå®å šãªåé€ã«é¢ããŠæ¥çãæ¿èªããæšæºã«åŸã£ãå®å šãªã¯ã€ãããã°ã©ã ã«ãã£ãŠããŸãã¯ãã以å€ã®å Žåã¯åªäœã®ç©ççãªç Žå£ã«ãã£ãŠãå埩äžèœã«ãªã£ãŠããããšã確èªããã | |
- 9.9 ã«ãŒãã®ç©ççãªèªã¿åãã«ãã£ãŠãã€ã¡ã³ãã«ãŒãããŒã¿ãåã蟌ãè£ çœ®ãæ¹ãããäžæ£çœ®æããä¿è·ããã\næ³šïŒ ããã«ã¯ãã«ãŒãïŒã«ãŒãã®ã¹ã¯ã€ãããã£ããïŒã«ãããã©ã³ã¶ã¯ã·ã§ã³ã«äœ¿çšãããã«ãŒãèªã¿åãè£ çœ®ãå«ãŸããããã®èŠä»¶ã¯ãã³ã³ãã¥ãŒã¿ã®ããŒããŒãã POS ã®ããŒãããã®ãããªæåããŒå ¥åã³ã³ããŒãã³ãã«ã¯é©çšãããªãã\næ³šïŒ ãã®èŠä»¶ã¯ã2015 幎 6 æ 30 æ¥ãŸã§ã¯ãã¹ããã©ã¯ãã£ã¹ãšã¿ãªããããã以éã¯èŠä»¶ã«ãªãã: | |
- 9.9 ææžåãããããªã·ãŒãšæé ã調ã¹ã以äžãå«ãŸããŠããããšã確èªããã\n⢠ããã€ã¹ã®ãªã¹ãã®ç®¡ç\n⢠ããã€ã¹ãå®æçã«æ€æ»ããŠæ¹ãããäžæ£çœ®æããªãã調ã¹ã\n⢠é¢ä¿è ã«ãã¬ãŒãã³ã°ãåããããŠãæªããè¡åãèå¥ããããã€ã¹ã®æ¹ãããäžæ£çœ®æãå ±åã§ããããã«ãã | |
- 9.9.1 è£ çœ®ã®ãªã¹ããä¿æããããªã¹ãã«ã¯ä»¥äžãå«ããå¿ èŠãããã\nâ¢ è£ çœ®ã®ã¡ãŒã«ãŒãšååŒ\nâ¢ è£ çœ®ã®å ŽæïŒè£ 眮ãèšçœ®ãããŠããåºèã®äœæãªã©ïŒ\nâ¢ è£ çœ®ã®é£çªãä»ã®äžæèå¥æ¹æ³: | |
- 9.9.1.a è£ çœ®ã®ãªã¹ããèŠãŠã以äžãå«ãŸããŠããããšã確èªããã\nâ¢ è£ çœ®ã®ã¡ãŒã«ãŒãšååŒ\nâ¢ è£ çœ®ã®å ŽæïŒè£ 眮ãèšçœ®ãããŠããåºèã®äœæãªã©ïŒ\nâ¢ è£ çœ®ã®é£çªãä»ã®äžæèå¥æ¹æ³ | |
- 9.9.1.b ãªã¹ãããè£ çœ®ã®ãµã³ãã«ãéžæããŠãè£ çœ®ã®å Žæã芳å¯ãããªã¹ããæ£ç¢ºã§ææ°ã®ãã®ã§ããããšã確èªããã | |
- 9.9.1.c æ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãè£ çœ®ãè¿œå ã移åãå»æ£ãããå Žåã«è£ 眮ã®ãªã¹ããæŽæ°ãããããšã確èªããã | |
- 9.9.2 å®æçã«è£ 眮ã®è¡šé¢ãæ€æ»ããŠæ¹ããïŒã«ãŒãã¹ãããŒã®åãä»ããªã©ïŒãäžæ£çœ®æïŒé£çªãªã©è£ 眮ã®ç¹æ§ã調ã¹ãŠåœã®è£ 眮ã«å·®ãæ¿ããããŠããªãããšã確èªããïŒãæ€åºããã\næ³šïŒ è£ çœ®ãæ¹ããããããäžæ£çœ®æããããããå åã®äŸãšããŠã¯ãäºæããŠããªãä»çç©ãã±ãŒãã«ãè£ çœ®ã«å·®ã蟌ãŸããŠãããã»ãã¥ãªãã£ã©ãã«ãç¡ããªã£ãŠããããå€æŽãããŠãããã±ãŒã¹ãå£ããŠãããè²ãå€ãã£ãŠããããããã¯é£çªãã®ä»ã®å€éšããŒãã³ã°ãå€æŽãããŠãããªã©ããã: | |
- 9.9.2.a ææžåãããæé ã調ã¹ãŠãããã»ã¹ã«ä»¥äžãå«ãŸããããã«å®çŸ©ãããŠããããšã確èªããã\nâ¢ è£ çœ®ãæ€æ»ããæé \n⢠æ€æ»ã®é »åºŠ | |
- 9.9.2.b 責任è ãã€ã³ã¿ãã¥ãŒããæ€æ»ããã»ã¹ã芳å¯ããŠã以äžã確èªããã\n⢠é¢ä¿è ãè£ çœ®ãæ€æ»ããæé ãç¥ã£ãŠãã\n⢠ãã¹ãŠã®è£ 眮ãæ¹ãããäžæ£çœ®æã®åœ¢è·¡ããªãããšãå®æçã«æ€æ»ãããŠãã | |
- 9.9.3 é¢ä¿è ãè£ çœ®ã®æ¹ãããäžæ£çœ®æã®è©Šã¿ãèªèã§ããããã«ãã¬ãŒãã³ã°ãå®æœããããã¬ãŒãã³ã°ã«ã¯ä»¥äžãå«ããå¿ èŠããã\nã»ä¿å®èŠå¡ãåä¹ã£ãŠããè ã«è£ 眮ãžã®ã¢ã¯ã»ã¹ãèš±å¯ããåã«ã身å ã確èªããã\n⢠æ€èšŒãªãã§è£ 眮ãèšçœ®ã亀æãè¿åããªãã\nâ¢ è£ çœ®ã®åšèŸºã§ã®æªããè¡åïŒç¥ããªã人ãè£ çœ®ã®ãã©ã°ãæãããè£ çœ®ãéãããããïŒã«æ³šæãã\n⢠æªããè¡åãè£ çœ®ãæ¹ãããäžæ£çœ®æããã圢跡ãããå Žåã«ã¯é©åãªé¢ä¿è ïŒãããŒãžã£ãŒãã»ãã¥ãªãã£èŠå¡ãªã©ïŒã«å ±åãã: | |
- 9.9.3.a è²©å£²å Žæã®é¢ä¿è çšãã¬ãŒãã³ã°ææã調ã¹ãŠã以äžã®ãã¬ãŒãã³ã°ãå«ãŸããŠããããšã確èªããã\nã»ä¿å®èŠå¡ãåä¹ã£ãŠããè ã«è£ 眮ãžã®å€æŽããã©ãã«ã·ã¥ãŒãã£ã³ã°ã®ããã®ã¢ã¯ã»ã¹ãèš±å¯ããåã«ã身å ã確èªããã\n⢠æ€èšŒãªãã§è£ 眮ãèšçœ®ã亀æãè¿åããªã\nâ¢ è£ çœ®ã®åšèŸºã§ã®æªããè¡åïŒç¥ããªã人ãè£ çœ®ã®ãã©ã°ãæãããè£ çœ®ãéãããããïŒã«æ³šæãã\n⢠ãã¹ãŠã®æªããè¡åãé©åãªé¢ä¿è ïŒãããŒãžã£ãŒãã»ãã¥ãªãã£èŠå¡ãªã©ïŒã«å ±åãã\n⢠æªããè¡åãè£ çœ®ãæ¹ãããäžæ£çœ®æããã圢跡ãããå Žåã«ã¯é©åãªé¢ä¿è ïŒãããŒãžã£ãŒãã»ãã¥ãªãã£èŠå¡ãªã©ïŒã«å ±åãã | |
- 9.9.3.b è²©å£²å Žæã®é¢ä¿è ã®ãµã³ãã«ãã€ã³ã¿ãã¥ãŒããããšã§ã圌ãããã¬ãŒãã³ã°ãåããŠããã以äžã®æé ãç¥ã£ãŠããããšã確èªããŸãã\nã»ä¿å®èŠå¡ãåä¹ã£ãŠããè ã« POS è£ çœ®ãžã®å€æŽããã©ãã«ã·ã¥ãŒãã£ã³ã°ã®ããã®ã¢ã¯ã»ã¹ãèš±å¯ããåã«ã身å ã確èªããã\n⢠æ€èšŒãªãã§è£ 眮ãèšçœ®ã亀æãè¿åããªã\n⢠POS è£ çœ®ã®åšèŸºã§ã®æªããè¡åïŒç¥ããªã人ãè£ çœ®ã®ãã©ã°ãæãããè£ çœ®ãéãããããïŒã«æ³šæãã\n⢠æªããè¡åã POS è£ çœ®ãæ¹ãããäžæ£çœ®æããã圢跡ãããå Žåã«ã¯é©åãªé¢ä¿è ïŒãããŒãžã£ãŒãã»ãã¥ãªãã£èŠå¡ãªã©ïŒã«å ±åãã | |
- 9.10 ã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ãå¶éããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 9.10 ææžã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ãå¶éããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ããããŠãã | |
- èŠä»¶10ïŒãããã¯ãŒã¯ãªãœãŒã¹ããã³ã«ãŒãäŒå¡ããŒã¿ãžã®ãã¹ãŠã®ã¢ã¯ã»ã¹ã远跡ããã³ç£èŠãã: | |
- 10.1 ã·ã¹ãã ã³ã³ããŒãã³ããžã®ãã¹ãŠã®ã¢ã¯ã»ã¹ãåãŠãŒã¶ã«ãªã³ã¯ããç£æ»èšŒè·¡ã確ç«ãã: | |
- 10.1 ã·ã¹ãã 管çè ã®èŠ³å¯ãšã€ã³ã¿ãã¥ãŒãéããŠã\n⢠ã·ã¹ãã ã³ã³ããŒãã³ãã«å¯Ÿããç£æ»èšŒè·¡ãæå¹ã«ãªã£ãŠããŠã¢ã¯ãã£ãã§ããããšã確ãã\n⢠ã·ã¹ãã ã³ã³ããŒãã³ããžã®ã¢ã¯ã»ã¹ãåãŠãŒã¶ã«ãªã³ã¯ãã | |
- 10.2 次ã®ã€ãã³ããåçŸããããã«ããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã®èªåç£æ»èšŒè·¡ãå®è£ ããã: | |
- 10.2 責任è ã®ã€ã³ã¿ãã¥ãŒãç£æ»ãã°ã®èª¿æ»ãããã³ç£æ»ãã°èšå®ã®èª¿æ»ãéããŠã以äžãå®è¡ããã | |
- 10.2.1 ã«ãŒãäŒå¡ããŒã¿ãžã®ãã¹ãŠã®å人ã¢ã¯ã»ã¹: | |
- 10.2.1 ã«ãŒãäŒå¡ããŒã¿ãžã®ãã¹ãŠã®ã¢ã¯ã»ã¹ããã°ã«èšé²ãããããšã確èªããã | |
- 10.2.2 ã«ãŒãæš©éãŸãã¯ç®¡çæš©éãæã€å人ã«ãã£ãŠè¡ããããã¹ãŠã®ã¢ã¯ã·ã§ã³: | |
- 10.2.2 ã«ãŒããŸãã¯ç®¡çè æš©éãæã€å人ã«ãã£ãŠå®æœããããã¹ãŠã®ã¢ã¯ã·ã§ã³ãèšé²ãããŠããããšã確èªããã | |
- 10.2.3 ãã¹ãŠã®ç£æ»èšŒè·¡ãžã®ã¢ã¯ã»ã¹: | |
- 10.2.3 ãã¹ãŠã®ç£æ»èšŒè·¡ãžã®ã¢ã¯ã»ã¹ããã°èšé²ãããããšã確èªããã | |
- 10.2.4 ç¡å¹ãªè«çã¢ã¯ã»ã¹è©Šè¡: | |
- 10.2.4 ç¡å¹ãªè«çã¢ã¯ã»ã¹è©Šè¡ãèšé²ãããŠããããšã確èªããã | |
- 10.2 5 èå¥ãšèªèšŒã¡ã«ããºã ã®äœ¿çšããã³å€æŽïŒæ°ããã¢ã«ãŠã³ãã®äœæãç¹æš©ã®äžæãå«ãããããã«éå®ãããªãïŒãããã³ã«ãŒããŸãã¯ç®¡çè æš©éãæã€ã¢ã«ãŠã³ãã®å€æŽãè¿œå ãåé€ã®ãã¹ãŠ: | |
- 10.2.5.a èå¥ããã³èªèšŒã¡ã«ããºã ã®äœ¿çšããã°ã«èšé²ãããããšã確èªããã | |
- 10.2.5.b ç¹æš©ã®äžæããã¹ãŠãã°ã«èšé²ãããããšã確èªãã | |
- 10.2.5.c ã«ãŒããŸãã¯ç®¡çè æš©éãæã€ã¢ã«ãŠã³ãã®å€æŽãè¿œå ããŸãã¯åé€ããã¹ãŠãã°ã«èšé²ãããŠããããšã確èªãã | |
- 10.2.6 ç£æ»ãã°ã®åæåãåæ¢ãäžæåæ¢: | |
- 10.2.6 以äžããã°ã«èšé²ãããŠããããšã確èªããã\n⢠ç£æ»ãã°ã®åæå\n⢠ç£æ»ãã°ã®åæ¢ãšäžæåæ¢ | |
- 10.2.7 ã·ã¹ãã ã¬ãã«ãªããžã§ã¯ãã®äœæããã³åé€: | |
- 10.2.7 ã·ã¹ãã ã¬ãã«ãªããžã§ã¯ãã®äœæããã³åé€ããã°èšé²ãããããšã確èªããã | |
- 10.3 ã€ãã³ãããšã«ããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã«ã€ããŠå°ãªããšã以äžã®ç£æ»èšŒè·¡ãšã³ããªãèšé²ããã: | |
- 10.3 ã€ã³ã¿ãã¥ãŒãšèŠ³å¯ãéããŠãç£æ»å¯èœãªã€ãã³ã(10.2ã«èšèŒ)ããšã«ã以äžãå®è¡ããã | |
- 10.3.1 ãŠãŒã¶èå¥: | |
- 10.3.1 ãŠãŒã¶èå¥ããã°ãšã³ããªã«å«ãŸããããšã確èªããã | |
- 10.3.2 ã€ãã³ãã®çš®é¡: | |
- 10.3.2 ãã°ãšã³ããªã«ã€ãã³ãã®çš®é¡ãå«ãŸããŠããããšã確ãã | |
- 10.3.3 æ¥ä»ãšæå»: | |
- 10.3.3 ãã°ãšã³ããªã«æ¥ä»ãšæå»ãå«ãŸããŠããããšã確èªããã | |
- 10.3.4 æåãŸãã¯å€±æã瀺ãæ å ±: | |
- 10.3.4 ãã°ãšã³ããªã«æåãŸãã¯å€±æã瀺ãæ å ±ãå«ãŸããããšã確èªããã | |
- 10.3.5 ã€ãã³ãã®çºçå : | |
- 10.3.5 ãã°ãšã³ããªã«ã€ãã³ãã®çºçå ãå«ãŸããŠããããšã確èªããã | |
- 10.3.6 圱é¿ãåããããŒã¿ãã·ã¹ãã ã³ã³ããŒãã³ãããŸãã¯ãªãœãŒã¹ã®IDãŸãã¯åå: | |
- 10.3.6 圱é¿ãåããããŒã¿ãã·ã¹ãã ã³ã³ããŒãã³ãããŸãã¯ãªãœãŒã¹ã®IDãŸãã¯ååããã°ãšã³ããªã«å«ãŸããããšã確èªããã | |
- 10.4 æå»åææè¡ã䜿çšããŠãã¹ãŠã®éèŠãªã·ã¹ãã ã¯ããã¯ããã³æéãåæããæéãååŸãé åžãä¿åããããã«ä»¥äžã®èŠä»¶ãå®æœãããŠããããšã確èªããã\næ³šïŒ ãããã¯ãŒã¯ã¿ã€ã ãããã³ã«ïŒNTPïŒã¯ãæå»åææè¡ã®äžäŸã§ããã: | |
- 10.4 æ§æåºæºãšããã»ã¹ã調ã¹ãããšã§ãæå»åææè¡ãå®è£ ãããPCI DSS ã®èŠä»¶ 6.1 ãš 6.2 ã«åŸã£ãŠææ°ç¶æ ã«ä¿ãããŠããããšã確èªããã | |
- 10.4.1 éèŠãªã·ã¹ãã ãæ£ç¢ºã§äžè²«æ§ã®ããæå»ãæã£ãŠããã: | |
- 10.4.1.a çµç¹å ã§æ£ããæå»ãååŸãé åžãä¿åããããã»ã¹ã調ã¹ãŠã以äžã確èªããã\n⢠æå®ããäžå€®ã¿ã€ã ãµãŒãããå€éšãœãŒã¹ããæå»ä¿¡å·ãåä¿¡ããå€éšãœãŒã¹ããã®æå»ä¿¡å·ã¯åœéååæãŸã㯠UTC ã«åºã¥ããŠããã\n⢠è€æ°ã®ã¿ã€ã ãµãŒããããå Žåããããã®ã¿ã€ã ãµãŒããæ£ç¢ºãªæå»ãä¿ã€ããã«ãäºãã«éä¿¡ããã\n⢠ã·ã¹ãã ã¯æå»æ å ±ãæå®ããäžå€®ã¿ã€ã ãµãŒãããã®ã¿åä¿¡ããã | |
- 10.4.1.b ã·ã¹ãã ã³ã³ããŒãã³ãã®ãµã³ãã«ã«å¯ŸããŠãæå»é¢ä¿ã®ã·ã¹ãã ãã©ã¡ãŒã¿èšå®ã芳å¯ããŠã以äžã確èªããã\n⢠æå®ããäžå€®ã¿ã€ã ãµãŒãããå€éšãœãŒã¹ããæå»ä¿¡å·ãåä¿¡ããå€éšãœãŒã¹ããã®æå»ä¿¡å·ã¯åœéååæãŸã㯠UTC ã«åºã¥ããŠãã\n⢠è€æ°ã®ã¿ã€ã ãµãŒããæå®ãããŠããå Žåãæå®ããäžå€®ã¿ã€ã ãµãŒããæ£ç¢ºãªæå»ãä¿ã€ããã«ãäºãã«éä¿¡ãã\n⢠ã·ã¹ãã ã¯æå»æ å ±ãæå®ããäžå€®ã¿ã€ã ãµãŒãããã®ã¿åä¿¡ãã | |
- 10.4.2 æå»ããŒã¿ãä¿è·ãããŠããã: | |
- 10.4.2.a ã·ã¹ãã æ§æããã³æå»åæèšå®ã調ã¹ãŠãæå»ããŒã¿ãžã®ã¢ã¯ã»ã¹ã¯ãæ¥åäžæå»ããŒã¿ã«ã¢ã¯ã»ã¹ããå¿ èŠã®ããæ åœè ã®ã¿ã«å¶éãããŠããããšã確èªããã | |
- 10.4.2.b ã·ã¹ãã æ§æããã³æå»åæèšå®ãšããã»ã¹ã調ã¹ãŠãéèŠãªã·ã¹ãã ã®æå»èšå®ãžã®å€æŽãããã°èšé²ãç£èŠãããã³ã¬ãã¥ãŒãããŠããããšã確èªããã | |
- 10.4.3 æå»èšå®ã¯ãæ¥çã§èªç¥ãããŠããæå»ãœãŒã¹ããåä¿¡ãããŠããã: | |
- 10.4.3 ã·ã¹ãã æ§æã調ã¹ãŠãã¿ã€ã ãµãŒããïŒæªæã®ããå人ãæèšãå€æŽããã®ãé²ãããã«ïŒæ¥çã§èªç¥ãããŠããç¹å®ã®å€éšãœãŒã¹ããæå»æŽæ°ãåãä»ããããšã確èªãããïŒå éšã¿ã€ã ãµãŒãã®äžæ£äœ¿çšãé²ãããã«ïŒãããã®æŽæ°ã察称ããŒã§æå·åããæå»æŽæ°ãæäŸãããã¯ã©ã€ã¢ã³ããã·ã³ã® IP ã¢ãã¬ã¹ãæå®ããã¢ã¯ã»ã¹å¶åŸ¡ãªã¹ããäœæããããšãã§ããã | |
- 10.5 å€æŽã§ããªããããç£æ»èšŒè·¡ãã»ãã¥ãªãã£ã§ä¿è·ããã: | |
- 10.5 ã·ã¹ãã 管çè ãã€ã³ã¿ãã¥ãŒããã·ã¹ãã æ§æãšã¢ã¯ã»ã¹æš©éã調ã¹ãŠã次ã®ããã«ãç£æ»èšŒè·¡ãå€æŽã§ããªãããã«ã»ãã¥ãªãã£ã§ä¿è·ãããŠããããšã確èªããã | |
- 10.5.1 ç£æ»èšŒè·¡ã®è¡šç€ºããæ¥åäžã®å¿ èŠããã人ç©ã®ã¿ã«å¶éããã: | |
- 10.5.1 æ¥åäžã®å¿ èŠãããå人ã®ã¿ãç£æ»èšŒè·¡ãã¡ã€ã«ã衚瀺ã§ããããšã確èªããã | |
- 10.5.2 ç£æ»èšŒè·¡ãã¡ã€ã«ãäžæ£ãªå€æŽããä¿è·ããã: | |
- 10.5.2 ã¢ã¯ã»ã¹å¶åŸ¡ã¡ã«ããºã ãç©ççãªåé¢ããããã¯ãŒã¯ã®åé¢ãªã©ã«ãã£ãŠãçŸåšã®ç£æ»èšŒè·¡ãã¡ã€ã«ãäžæ£ãªå€æŽããä¿è·ãããŠããããšã確èªããã | |
- 10.5.3 ç£æ»èšŒè·¡ãã¡ã€ã«ããå€æŽãå°é£ãªäžå 管çãã°ãµãŒããŸãã¯åªäœã«å³åº§ã«ããã¯ã¢ããããã: | |
- 10.5.3 çŸåšã®ç£æ»èšŒè·¡ãã¡ã€ã«ãå€æŽãå°é£ãªäžå 管çãã°ãµãŒããŸãã¯åªäœã«å³åº§ã«ããã¯ã¢ãããããããšã確èªããã | |
- 10.5.4 å€éšã«å ¬éãããŠãããã¯ãããžã®ãã°ããå®å šãªäžå 管çã®å éšãã°ãµãŒããŸãã¯åªäœããã€ã¹äžã«æžã蟌ãã: | |
- 10.5.4 å€éšã«å ¬éãããŠãããã¯ãããžïŒã¯ã€ã€ã¬ã¹ããã¡ã€ã¢ãŠã©ãŒã«ãDNSãã¡ãŒã«ãªã©ïŒã®ãã°ãå®å šãªäžå 管çãããå éšãã°ãµãŒããŸãã¯åªäœã«æžã蟌ãŸããããšã確èªããã | |
- 10.5.5 ãã°ã«å¯ŸããŠãã¡ã€ã«æŽåæ§ç£èŠãŸãã¯å€æŽæ€åºãœãããŠã§ã¢ã䜿çšããŠãæ¢åã®ãã°ããŒã¿ãå€æŽãããšèŠåãçæãããããã«ãã(ãã ããæ°ããããŒã¿ãè¿œå ããå Žåã¯èŠåãçºçãããªã)ã: | |
- 10.5.5 ã·ã¹ãã èšå®ãç£èŠå¯Ÿè±¡ãã¡ã€ã«ãããã³ç£èŠäœæ¥ããã®çµæã調æ»ããŠããã°ã«å¯ŸããŠãã¡ã€ã«æŽåæ§ç£èŠãŸãã¯å€æŽæ€åºãœãããŠã§ã¢ã䜿çšãããŠããããšã確èªããã | |
- 10.6 ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°ãšã»ãã¥ãªãã£ã€ãã³ãã調ã¹ãç°åžžãæªãã掻åãç¹å®ããã\n æ³šïŒ ãã®èŠä»¶ã«æºæ ããããã«ããã°ã®åéã解æãããã³èŠåããŒã«ã䜿çšããããšãã§ããŸãã: | |
- 10.6 以äžã®ããšãå®è¡ããŸã | |
- 10.6.1 æ¯æ¥äžåºŠä»¥äžä»¥äžãã¬ãã¥ãŒã\n⢠ãã¹ãŠã®ã»ãã¥ãªãã£ã€ãã³\n⢠CHD ã SAD ãä¿åãåŠçããŸãã¯éä¿¡ããããŸã㯠CHD ã SAD ã®ã»ãã¥ãªãã£ã«åœ±é¿ãåãŒãå¯èœæ§ã®ãããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°\n⢠ãã¹ãŠã®éèŠãªã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°\n⢠ãã¹ãŠã®ãµãŒããšã»ãã¥ãªãã£æ©èœãå®è¡ããã·ã¹ãã ã³ã³ããŒãã³ãïŒãã¡ã€ã¢ãŠã©ãŒã«ãäŸµå ¥æ€åºã·ã¹ãã /äŸµå ¥é²æ¢ã·ã¹ãã ïŒIDS/IPSïŒãèªèšŒãµãŒããé»ååååŒãªãã€ã¬ã¯ã·ã§ã³ãµãŒããªã©ïŒã®ãã°: | |
- 10.6.1.a ã»ãã¥ãªãã£ããªã·ãŒãšæé ã調ã¹ãŠãæåãŸãã¯ãã°ããŒã«ãçšããŠã以äžãå°ãªããšãæ¯æ¥äžåºŠã¬ãã¥ãŒããæé ãå®çŸ©ãããŠããããšã確èªããã\n⢠ãã¹ãŠã®ã»ãã¥ãªãã£ã€ãã³\n⢠CHD ã SAD ãä¿åãåŠçããŸãã¯éä¿¡ããããŸã㯠CHD ãSAD ã®ã»ãã¥ãªãã£ã«åœ±é¿ãåãŒãå¯èœæ§ã®ãããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°\n⢠ãã¹ãŠã®éèŠãªã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°\n⢠ãã¹ãŠã®ãµãŒããšã»ãã¥ãªãã£æ©èœãå®è¡ããã·ã¹ãã ã³ã³ããŒãã³ãïŒãã¡ã€ã¢ãŠã©ãŒã«ãäŸµå ¥æ€åºã·ã¹ãã /äŸµå ¥é²æ¢ã·ã¹ãã ïŒIDS/IPSïŒãèªèšŒãµãŒããé»ååååŒãªãã€ã¬ã¯ã·ã§ã³ãµãŒããªã©ïŒã®ãã° | |
- 10.6.1.b ããã»ã¹ã芳å¯ããæ åœè ãã€ã³ã¿ã¥ãŒããããšã§ã以äžãå°ãªããšãæ¯æ¥äžåºŠã¬ãã¥ãŒãããŠããããšã確èªããã\n⢠ãã¹ãŠã®ã»ãã¥ãªãã£ã€ãã³ã\n⢠CHD ã SAD ãä¿åãåŠçããŸãã¯éä¿¡ããããŸã㯠CHD ãSAD ã®ã»ãã¥ãªãã£ã«åœ±é¿ãåãŒãå¯èœæ§ã®ãããã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°\n⢠ãã¹ãŠã®éèŠãªã·ã¹ãã ã³ã³ããŒãã³ãã®ãã°\n⢠ãã¹ãŠã®ãµãŒããšã»ãã¥ãªãã£æ©èœãå®è¡ããã·ã¹ãã ã³ã³ããŒãã³ãïŒãã¡ã€ã¢ãŠã©ãŒã«ãäŸµå ¥æ€åºã·ã¹ãã /äŸµå ¥é²æ¢ã·ã¹ãã ïŒIDS/IPSïŒãèªèšŒãµãŒããé»ååååŒãªãã€ã¬ã¯ã·ã§ã³ãµãŒããªã©ïŒã®ãã° | |
- 10.6.2 çµç¹ã®ããªã·ãŒãããã³å¹Žéãªã¹ã¯è©äŸ¡ã«ãã£ãŠæ±ºå®ããããªã¹ã¯ç®¡çæŠç¥ã«åºã¥ããŠä»ã®ã·ã¹ãã ã³ã³ããŒãã³ããã¹ãŠã®ãã°ãå®æçã«ã¬ãã¥ãŒãã: | |
- 10.6.2.a ã»ãã¥ãªãã£ããªã·ãŒãšæé ã調ã¹ãŠãçµç¹ã®ããªã·ãŒãšãªã¹ã¯ç®¡çæŠç¥ã«åºã¥ãå®æçã«ãæåãŸãã¯ãã°ããŒã«ãçšããŠãä»ã®ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ããã¬ãã¥ãŒããæé ãå®çŸ©ãããŠããããšã確èªããã | |
- 10.6.2.b çµç¹ã®ãªã¹ã¯è©äŸ¡ææžã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããŠãã¬ãã¥ãŒãçµç¹ã®ããªã·ãŒãšãªã¹ã¯ç®¡çæŠç¥ã«åŸã£ãŠå®æœãããŠããããšã確èªããã | |
- 10.6.3 ã¬ãã¥ãŒããã»ã¹ã§ç¹å®ãããäŸå€ãšç°åžžããã©ããŒã¢ããããã: | |
- 10.6.3.a ã»ãã¥ãªãã£ããªã·ãŒãšæé ã調ã¹ãŠãã¬ãã¥ãŒããã»ã¹ã§ç¹å®ãããäŸå€ãšç°åžžããã©ããŒã¢ããããæé ãå®çŸ©ãããŠããããšã確èªããã | |
- 10.6.3.b ããã»ã¹ã芳å¯ããæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãäŸå€ãšç°åžžã®ãã©ããŒã¢ãããå®æœãããŠããããšã確èªããã | |
- 10.7 ç£æ»èšŒè·¡ã®å±¥æŽãå°ãªããšã1幎éä¿æãããå°ãªããšã3ã«æã¯ããã«åæã§ããç¶æ ã«ããŠãã(ãªã³ã©ã€ã³ãã¢ãŒã«ã€ããããã¯ã¢ãããã埩å å¯èœãªã©)ã: | |
- 10.7.a ã»ãã¥ãªãã£ããªã·ãŒãšæé ã調ã¹ã以äžãå®çŸ©ãããŠããããšã確èªããã\n⢠ç£æ»ãã°ä¿åããªã·ãŒ\n⢠ç£æ»ãã°ãå°ãªããšã 1 幎éä¿æããæäœ 3 ã«æã¯ããã«äœ¿çšã§ããç¶æ ã«ããŠããããã®æé ã | |
- 10.7.b æ åœè ãã€ã³ã¿ãã¥ãŒããç£æ»ãã°ã調ã¹ãããšã§ãç£æ»ãã°ãå°ãªããšã1幎éå©çšå¯èœã§ããããšã確èªããã | |
- 10.7.c æ åœè ãã€ã³ã¿ãã¥ãŒããããã»ã¹ã芳å¯ããããšã§ã解æçšã«ãå°ãªããšãéå»3ã«æåã®ãã°ãå³åº§ã«åŸ©å ã§ããããšã確èªãã | |
- 10.8 ãããã¯ãŒã¯ãªãœãŒã¹ãšã«ãŒãäŒå¡ããŒã¿ãžã®ãã¹ãŠã®ã¢ã¯ã»ã¹ãç£èŠããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåããã䜿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 10.8 ææžã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ããããã¯ãŒã¯ãªãœãŒã¹ãšã«ãŒãäŒå¡ããŒã¿ãžã®ãã¹ãŠã®ã¢ã¯ã»ã¹ãç£èŠããããã®ã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠãã | |
- èŠä»¶11ïŒã»ãã¥ãªãã£ã·ã¹ãã ããã³ããã»ã¹ãå®æçã«ãã¹ããã: | |
- 11.1 ååæããšã«ã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ãã®ååšããã¹ããïŒ802.11ïŒããã¹ãŠã®æ¿èªãããŠããã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããšæ¿èªãããŠããªãã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããæ€åºãèå¥ããããã»ã¹ãå®æœãã\n æ³šïŒ ããã»ã¹ã§äœ¿çšãããæ¹æ³ã«ã¯ãã¯ã€ã€ã¬ã¹ãããã¯ãŒã¯ã®ã¹ãã£ã³ãã·ã¹ãã ã³ã³ããŒãã³ãããã³ã€ã³ãã©ã¹ãã©ã¯ãã£ã®è«çç/ç©ççãªæ€æ»ããããã¯ãŒã¯ã¢ã¯ã»ã¹å¶åŸ¡ïŒNACïŒãç¡ç· IDS/IPS ãå«ãŸããããããã«éå®ãããããã§ã¯ãªãã\nãããã®æ¹æ³ã䜿çšããå Žåããæ¿èªãããŠãããã€ã¹ãšæ¿èªãããŠããªãããã€ã¹ãäž¡æ¹æ€åºããã³èå¥ã§ããæ©èœãååã«åããŠããå¿ èŠãããã: | |
- 11.1.a ããªã·ãŒãšæé ã調ã¹ãååæããšã«æ¿èªãããŠããã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããšæ¿èªãããŠããªãã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããäž¡æ¹æ€åºãèå¥ããããã»ã¹ãå®çŸ©ãããŠããããšã確èªããã | |
- 11.1.b æ¹æ³ããå°ãªããšã以äžãå«ããã¹ãŠã®äžæ£ãªã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããæ€åºããŠèå¥ããã®ã«ååã§ããããšã確èªããã\nã» ã·ã¹ãã ã³ã³ããŒãã³ãã«æ¿å ¥ããã WLAN ã«ãŒã\nã» ã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããäœæããããã«ã·ã¹ãã ã³ã³ããŒãã³ãã«ïŒUSB ãªã©ã§ïŒæ¥ç¶ããããŒã¿ãã«ãã¢ãã€ã«ããã€ã¹\nã»ãããã¯ãŒã¯ããŒããŸãã¯ãããã¯ãŒã¯ããã€ã¹ã«æ¥ç¶ãããã¯ã€ã€ã¬ã¹ããã€ã¹ | |
- 11.1.c æè¿ã®ã¯ã€ã€ã¬ã¹ã¹ãã£ã³ã®åºåã調ã¹ãŠã以äžã確èªããã\n⢠æ¿èªãããŠããã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããšæ¿èªãããŠããªãã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããèå¥ããã\n⢠ãã¹ãŠã®ã·ã¹ãã ã³ã³ããŒãã³ãããã³æœèšã«å¯Ÿãããã®ã¹ãã£ã³ãå°ãªããšãååæããšã«å®æœãããŠãã | |
- 11.1.d èªåç£èŠïŒã¯ã€ã€ã¬ã¹ IDS/IPS ã NAC ãªã©ïŒã䜿çšãããŠããå Žåã¯ãæ åœè ã«éç¥ããããã®èŠåãçæãããããã«æ§æãããŠããããšã確èªããã | |
- 11.1.1 ææžåãããŠããæ¥åäžã®çç±ãå«ããæ¿èªãããŠããã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ãã®ã€ã³ãã³ããªãç¶æããã: | |
- 11.1.1 ææžåãããŠããèšé²ã調ã¹ãŠãæ¿èªãããŠããã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ãã®ã€ã³ãã³ããªãç¶æãããŠããããã¹ãŠã®æ¿èªãããŠããã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ãã«å¯ŸããŠæ¥åäžã®çç±ãææžåãããŠããããšã確èªã | |
- 11.1.2 äžæ£ãªã¯ã€ã€ã¬ã¹ããã€ã¹ãæ€åºãããå Žåã®ã€ã³ã·ãã³ã察å¿èšç»ãå®è£ ããã: | |
- 11.1.2.a çµç¹ã®ã€ã³ã·ãã³ãèšç»ã調ã¹ãŠïŒèŠä»¶ 12.9ïŒãæ¿èªãããŠããªãã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããæ€åºãããå Žåã«ããã®å¿çãå®çŸ©ããèŠæ±ããŠããããšã確èªãããnull | |
- 11.1.2.b 責任è ãã€ã³ã¿ãã¥ãŒããæè¿ã®ã¯ã€ã€ã¬ã¹ã¹ãã£ã³ãšé¢é£å¿çã調ã¹ãŠãæ¿èªãããŠããªãã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ããèŠã€ãã£ãå Žåã«å¯ŸåŠãããŠããããšã確èªããã | |
- 11.2 å éšãšå€éšãããã¯ãŒã¯ã®è匱æ§ã¹ãã£ã³ãå°ãªããšãååæã«äžåºŠããã³ãããã¯ãŒã¯ã§ã®å€§å¹ ãªå€æŽïŒæ°ããã·ã¹ãã ã³ã³ããŒãã³ãã®ã€ã³ã¹ããŒã«ããããã¯ãŒã¯ããããžã®å€æŽããã¡ã€ã¢ãŠã©ãŒã«èŠåã®å€æŽã補åã¢ããã°ã¬ãŒããªã©ïŒåŸã«å®è¡ããã\næ³šïŒ ååæããšã®ã¹ãã£ã³ããã»ã¹ã®è€æ°ã®ã¹ãã£ã³ã¬ããŒãããŸãšããŠããã¹ãŠã®ã·ã¹ãã ãã¹ãã£ã³ããããã¹ãŠã®è匱æ§ã«å¯ŸåŠãããããšã瀺ãããšãã§ãããæªä¿®æ£ã®è匱æ§ã察åŠäžã§ããããšã確èªããããã«ãè¿œå ã®ææžãèŠæ±ãããå Žåãããã\nåæã® PCI DSS æºæ ã§ã¯ãè©äŸ¡è ã 1ïŒææ°ã®ã¹ãã£ã³çµæãåæ Œã¹ãã£ã³ã§ãã£ãããšã2ïŒäºæ¥äœã§ååæã«äžåºŠã®ã¹ãã£ã³ãèŠæ±ããããªã·ãŒãšæé ãææžåãããŠããããšãããã³ 3ïŒã¹ãã£ã³çµæã§å€æããè匱æ§ãåã¹ãã£ã³ã«ãããŠç€ºãããŠãããšããã«ä¿®æ£ãããããšã確èªããå Žåãååã®PCI DSS æºæ ã®ããã«ãååæã«äžåºŠã®ã¹ãã£ã³ã« 4 ååæ Œããããšã¯èŠæ±ãããªãã\nåå PCI DSS ã¬ãã¥ãŒä»¥éã¯æ¯å¹Žãååæããšã®ã¹ãã£ã³ã« 4 ååæ Œããªããã°ãªããªãã: | |
- 11.2 ã¹ãã£ã³ã¬ããŒããšé¢é£ææžã調ã¹ãŠãå éšããã³å€éšè匱æ§ã¹ãã£ã³ãã次ã®ããã«å®è¡ãããŠããããšã確èªããã | |
- 11.2.1 ãã¹ãŠã®ãé«ãªã¹ã¯ãè匱æ§ïŒèŠä»¶6.1 ã§èå¥ïŒã解決ããããŸã§ãå¿ èŠã«å¿ããŠååæããšã®å éšè匱æ§ã¹ãã£ã³ãç¹°ãè¿ããã¹ãã£ã³ã¯æè³æ Œè ãå®æœããå¿ èŠãããã: | |
- 11.2.1.a ã¹ãã£ã³ã¬ããŒããã¬ãã¥ãŒããååæããšã®å éšã¹ãã£ã³ãéå» 12 ã«æé㧠4 åè¡ãããããšã確èªããã | |
- 11.2.1.b ã¹ãã£ã³ã¬ããŒããã¬ãã¥ãŒããã¹ãã£ã³ããã»ã¹ã§åã¹ãã£ã³ãè¡ã£ãããšããŸã㯠PCI DSS èŠä»¶ 6.1 ã§å®çŸ©ããããã¹ãŠã®ãé«ãªã¹ã¯ãã®è匱æ§ã解決ããããŸã§åã¹ãã£ã³ãè¡ã£ãããšã確èªããã | |
- 11.2.1.c æ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã¹ãã£ã³ãå éšãªãœãŒã¹ãŸãã¯è³æ Œã®ããå€éšã®ç¬¬äžè ã«ãã£ãŠè¡ãããããšã該åœããå Žåã¯ããã¹ã¿ãŒã®çµç¹ã®ç¬ç«æ§ïŒQSA ã ASV ã§ããå¿ èŠã¯ãªãïŒãååšããããšã確èªããã | |
- 11.2.2 ååæã«äžåºŠã®å€éšã®è匱æ§ã¹ãã£ã³ã¯ãPCIïŒPayment Card IndustryïŒã»ãã¥ãªãã£åºæºå¯©è°äŒïŒPCI SSCïŒã«ãã£ãŠè³æ Œãäžããããèªå®ã¹ãã£ãã³ã°ãã³ãïŒASVïŒã«ãã£ãŠå®è¡ãããå¿ èŠããããã¹ãã£ã³ã«åæ ŒãããŸã§ãå¿ èŠã«å¿ããŠåã¹ãã£ã³ããã\næ³šïŒ ååæã«äžåºŠã®å€éšã®è匱æ§ã¹ãã£ã³ã¯ãPCIïŒPayment Card IndustryïŒã»ãã¥ãªãã£åºæºå¯©è°ïŒPCI SSCïŒã«ãã£ãŠè³æ Œãäžããããèªå®ã¹ãã£ãã³ã°ãã³ãïŒASVïŒã«ãã£ãŠå®è¡ãããå¿ èŠãããã\nã¹ãã£ã³ã«ããã顧客ã®è²¬ä»»ãã¹ãã£ã³ã®æºåãªã©ã«ã€ããŠã¯ãPCI SSC Web ãµã€ãã§å ¬éãããŠãããASV ããã°ã©ã ã¬ã€ãããåç §ããŠãã ããã: | |
- 11.2.2.a ååæããšã«è¡ãããææ°ã® 4 åã®å éšã¹ãã£ã³ããã®çµæãã¬ãã¥ãŒããéå» 12 ã«æéã§ååæããšã®ã¹ãã£ã³ã 4åè¡ãããããšã確èªããã | |
- 11.2.2.b ååæããšã®åã¹ãã£ã³ã®çµæãã¬ãã¥ãŒãããASV ããã°ã©ã ã¬ã€ããã®èŠä»¶ïŒããšãã°ãCVSS ã«ãã 4.0 以äžã®ã¬ãŒãã®è匱æ§ããªããèªåãšã©ãŒããªãïŒãæºããããšã確èªããã | |
- 11.2.2.c ã¹ãã£ã³ã¬ããŒããã¬ãã¥ãŒããPCI SSCèªå®ã¹ãã£ãã³ã°ãã³ãïŒASVïŒãã¹ãã£ã³ãå®äºããããšã確èªããã | |
- 11.2.3 æåã®å€æŽããã£ãåŸã®å éšãšå€éšè匱æ§ã¹ãã£ã³ãå¿ èŠã«å¿ããŠç¹°ãè¿ãã\nã¹ãã£ã³ã¯æè³æ Œè ãå®æœããå¿ èŠãããã: | |
- 11.2.3.a å€æŽç®¡çææžãšã¹ãã£ã³ã¬ããŒãã調ã¹ãŠçžé¢ãããå€§å¹ ãªå€æŽã®å¯Ÿè±¡ãšãªãã·ã¹ãã ã³ã³ããŒãã³ããã¹ãã£ã³ãããããšã確èªããã | |
- 11.2.3.b ã¹ãã£ã³ã¬ããŒããã¬ãã¥ãŒããã¹ãã£ã³ããã»ã¹ã«ã以äžã®èŠä»¶ãæºãããŸã§åã¹ãã£ã³ãå®è¡ããããšãå«ãŸããŠããããšã確èªããã\nã» å€éšã¹ãã£ã³ã®å ŽåãCVSS ã¹ã³ã¢ã§ 4.0 以äžã®è匱æ§ããªãããšã\nã» å éšã¹ãã£ã³ã®å Žåãåæ ŒçµæãååŸãããããšããŸãã¯PCI DSS èŠä»¶ 6.1 ã§å®çŸ©ããããã¹ãŠã®ãé«ãªã¹ã¯ãè匱æ§ã解æ¶ãããããšã | |
- 11.2.3.c ã¹ãã£ã³ãè³æ Œã®ããå éšãªãœãŒã¹ãŸãã¯è³æ Œã®ããå€éšã®ç¬¬äžè ã«ãã£ãŠè¡ãããããšã該åœããå Žåã¯ããã¹ã¿ãŒã®çµç¹ã®ç¬ç«æ§ïŒ QSA ã ASV ã§ããå¿ èŠã¯ãªãïŒãååšããããšã確èªããã | |
- 11.3 å°ãªããšã以äžãå«ããããã¬ãŒã·ã§ã³ãã¹ãæ¹æ³ãéçºããå®è£ ããã\n⢠æ¥çæ¿èªã®ãããã¬ãŒã·ã§ã³ãã¹ãæ¹æ³ïŒNISTSP800-115 ãªã©ïŒã«åºã¥ããŠãã\n⢠CDE å¢çãšéèŠã·ã¹ãã å šäœã察象ãšãã察å¿ãå«ãã\n⢠ãããã¯ãŒã¯ã®å éšãšå€éšããã®äŸµå ¥ãã¹ã\n⢠ã»ã°ã¡ã³ããŒã·ã§ã³ãšç¯å²æžå°å¶åŸ¡ã®æå¹æ§ãã¹ããå«ãã\n⢠ã¢ããªã±ãŒã·ã§ã³å±€ã®ãããã¬ãŒã·ã§ã³ãã¹ãã¯ãå°ãªããšãèŠä»¶ 6.5 ã«èšèŒãããŠããè匱æ§ãå«ããå¿ èŠããã\n⢠ãããã¯ãŒã¯å±€ã®ãããã¬ãŒã·ã§ã³ãã¹ãã«ã¯ããããã¯ãŒã¯æ©èœãšãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ããµããŒãããã³ã³ããŒãã³ããå«ããå¿ èŠããã\n⢠éå» 12 ã«æã«ãã£ãè åšãšè匱æ§ã®ã¬ãã¥ãŒãšèæ ®ãå«ãã\nãããã¬ãŒã·ã§ã³ãã¹ãçµæãšä¿®æ£å®æœçµæã®ä¿æãæå®ãã\næ³šïŒ èŠä»¶ 11.3 ãžã®ãã®æŽæ°ã¯ã2015 幎 6 æ30 æ¥ãŸã§ã¯ãã¹ããã©ã¯ãã£ã¹ãšã¿ãªããããã以éã¯èŠä»¶ã«ãªãããããã¬ãŒã·ã§ã³ãã¹ãã® PCI DSS v2.0 èŠä»¶ã¯ãv3.0 ã§æŽæ°ããããŸã§é å®ããå¿ èŠãããã: | |
- 11.3 ãããã¬ãŒã·ã§ã³ãã¹ãæ¹æ³ã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ããã®æ¹æ³ãå®è£ ãããŠããå°ãªããšã以äžãå«ãããšã確èªããã\n⢠æ¥çæ¿èªã®ãããã¬ãŒã·ã§ã³ãã¹ãæ¹æ³ã«åºã¥ããŠãã\n⢠CDE å¢çãšéèŠã·ã¹ãã å šäœã察象ãšãã察å¿\n⢠ãããã¯ãŒã¯ã®å éšãšå€éšããã®äŸµå ¥ãã¹ã\n⢠ã»ã°ã¡ã³ããŒã·ã§ã³ãšç¯å²æžå°å¶åŸ¡ã®æå¹æ§ãã¹ã\n⢠ã¢ããªã±ãŒã·ã§ã³å±€ã®ãããã¬ãŒã·ã§ã³ãã¹ãã¯ãå°ãªããšãèŠä»¶ 6.5 ã«èšèŒãããŠããè匱æ§ãå«ããå¿ èŠããã\n⢠ãããã¯ãŒã¯å±€ã®ãããã¬ãŒã·ã§ã³ãã¹ãã«ã¯ããããã¯ãŒã¯æ©èœãšãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ããµããŒãããã³ã³ããŒãã³ããå«ããå¿ èŠããã\n⢠éå» 12 ã«æã«ãã£ãè åšãšè匱æ§ã®ã¬ãã¥ãŒãšèæ ®\n⢠ãããã¬ãŒã·ã§ã³ãã¹ãçµæãšä¿®æ£å®æœçµæã®ä¿æãæå®ãã | |
- 11.3.1 å€éšã®ãããã¬ãŒã·ã§ã³ãã¹ããå°ãªããšã幎ã«äžåºŠããã³å€§å¹ ãªã€ã³ãã©ã¹ãã©ã¯ãã£ãŸãã¯ã¢ããªã±ãŒã·ã§ã³ã®ã¢ããã°ã¬ãŒããå€æŽïŒãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®ã¢ããã°ã¬ãŒããç°å¢ãžã®ãµããããã¯ãŒã¯ã®è¿œå ãç°å¢ãžã® Web ãµãŒãã®è¿œå ãªã©ïŒåŸã«å®è¡ããã: | |
- 11.3.1.a ææ°ã®å€éšãããã¬ãŒã·ã§ã³ãã¹ãã®å¯Ÿè±¡ç¯å²ãšçµæã調ã¹ãŠããããã¬ãŒã·ã§ã³ãã¹ãã以äžãæºãããŠããããšã確èªããã\n⢠å®çŸ©ãããæ¹æ³ã«åŸã£ãŠãã\n⢠å°ãªããšã幎ã«äžåºŠå®æœãã\n⢠ç°å¢ã«å¯ŸããŠé倧ãªå€æŽãè¡ãããåŸå®æœãã | |
- 11.3.1.b ãã¹ããèªå®ãããå éšãªãœãŒã¹ãŸãã¯èªå®ãããå€éšã®ç¬¬äžè ã«ãã£ãŠå®è¡ãããããšãããã³è©²åœããå Žåã¯ãã¹ã¿ãŒãçµç¹çã«ç¬ç«ããç«å Žã§ããããšïŒQSA ãŸã㯠ASV ã§ããå¿ èŠã¯ãªãïŒã確èªããã | |
- 11.3.2 å éšãããã¬ãŒã·ã§ã³ãã¹ããå°ãªããšã幎ã«äžåºŠããã³å€§å¹ ãªã€ã³ãã©ã¹ãã©ã¯ãã£ãŸãã¯ã¢ããªã±ãŒã·ã§ã³ã®ã¢ããã°ã¬ãŒããå€æŽïŒãªãã¬ãŒãã£ã³ã°ã·ã¹ãã ã®ã¢ããã°ã¬ãŒããç°å¢ãžã®ãµããããã¯ãŒã¯ã®è¿œå ãç°å¢ãžã® Web ãµãŒãã®è¿œå ãªã©ïŒåŸã«å®è¡ããã: | |
- 11.3.2.a ææ°ã®å éšãããã¬ãŒã·ã§ã³ãã¹ãã®çµæã調ã¹ãŠããããã¬ãŒã·ã§ã³ãã¹ããå°ãªããšã幎ã«äžåºŠããã³ç°å¢ãžã®å€§å¹ ãªå€æŽåŸã«å®è¡ãããŠããããšã確èªããã\n⢠å®çŸ©ãããæ¹æ³ã«åŸã£ãŠãã\n⢠å°ãªããšã幎ã«äžåºŠå®æœãã\n⢠ç°å¢ã«å¯ŸããŠé倧ãªå€æŽãè¡ãããåŸã«å®æœãã | |
- 11.3.2.b ãã¹ããèªå®ãããå éšãªãœãŒã¹ãŸãã¯èªå®ãããå€éšã®ç¬¬äžè ã«ãã£ãŠå®è¡ãããããšãããã³è©²åœããå Žåã¯ãã¹ã¿ãŒãçµç¹çã«ç¬ç«ããç«å Žã§ããããšïŒQSA ãŸã㯠ASV ã§ããå¿ èŠã¯ãªãïŒã確èªããã | |
- 11.3.3 ãããã¬ãŒã·ã§ã³ãã¹ãã§æ€åºãããæªçšå¯èœãªè匱æ§ãä¿®æ£ããããã¹ããç¹°ãè¿ãããŠä¿®æ£ã確èªãããã: | |
- 11.3.3 ãããã¬ãŒã·ã§ã³ãã¹ãçµæã調ã¹ãŠãæ¢ç¥ã®æªçšå¯èœãªè匱æ§ãä¿®æ£ããããã¹ããç¹°ãè¿ãããŠè匱æ§ãä¿®æ£ãããããšã確èªããã | |
- 11.3.4 ã»ã°ã¡ã³ããŒã·ã§ã³ãçšã㊠CDE ãä»ã®ãããã¯ãŒã¯ããåé¢ããå Žåãå°ãªããšã幎ã«äžåºŠãšã»ã°ã¡ã³ããŒã·ã§ã³ã®å¶åŸ¡/æ¹æ³ãå€æŽãããåŸã«ãããã¬ãŒã·ã§ã³ãã¹ããè¡ã£ãŠãã»ã°ã¡ã³ããŒã·ã§ã³æ¹æ³ãéçšå¯èœã§å¹æçã§ãããé©çšç¯å²å ã®ã·ã¹ãã ããé©çšç¯å²å€ã®ã·ã¹ãã ããã¹ãŠåé¢ããããšã確èªãã: | |
- 11.3.4.a ã»ã°ã¡ã³ããŒã·ã§ã³å¶åŸ¡ã調ã¹ããããã¬ãŒã·ã§ã³ãã¹ãæ¹æ³ãã¬ãã¥ãŒããŠããããã¬ãŒã·ã§ã³ãã¹ãæé ã§ãã¹ãŠã®ã»ã°ã¡ã³ããŒã·ã§ã³æ¹æ³ããã¹ããããããã¬ãŒã·ã§ã³ãã¹ããè¡ã£ãŠãã»ã°ã¡ã³ããŒã·ã§ã³æ¹æ³ãéçšå¯èœã§å¹æçã§ãããé©çšç¯å²å ã®ã·ã¹ãã ããé©çšç¯å²å€ã®ã·ã¹ãã ããã¹ãŠåé¢ããããšã確èªããã | |
- 11.3.4.b ææ°ã®ãããã¬ãŒã·ã§ã³ãã¹ãããã®çµæã調ã¹ãŠãã»ã°ã¡ã³ããŒã·ã§ã³å¶åŸ¡ã確èªãããããã¬ãŒã·ã§ã³ãã¹ãã以äžãæºãããŠããããšã確èªããã\n⢠å°ãªããšã幎 1 åããã³ã»ã°ã¡ã³ããŒã·ã§ã³å¶åŸ¡/æ¹æ³ã«äœããã®å€æŽãå ããåŸã«å®æœããã\n⢠䜿çšãããŠãããã¹ãŠã®ã»ã°ã¡ã³ããŒã·ã§ã³å¶åŸ¡/æ¹æ³ã察象ãšãã\n⢠ã»ã°ã¡ã³ããŒã·ã§ã³æ¹æ³ãéçšå¯èœã§å¹æçã§ããã察象ç¯å²å ã·ã¹ãã ãã察象ç¯å²å€ã·ã¹ãã ãåé¢ãã | |
- 11.4äŸµå ¥æ€ç¥ã·ã¹ãã ãäŸµå ¥é²æ¢ææ³ã䜿çšããŠããããã¯ãŒã¯ãžã®äŸµå ¥ãæ€ç¥ããã³/ãŸãã¯é²æ¢ãããã«ãŒãäŒå¡ããŒã¿ç°å¢ãšã®å¢çããã³ã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®éèŠãªãã€ã³ããééãããã¹ãŠã®ãã©ãã£ãã¯ãç£èŠãã䟵害ã®çããããå Žåã¯æ åœè ã«èŠåããã\nãã¹ãŠã®äŸµå ¥æ€ç¥ããã³é²æ¢ãšã³ãžã³ãããŒã¹ã©ã€ã³ãã·ã°ããã£ãææ°ç¶æ ã«ä¿ã€ã: | |
- 11.4.a ã·ã¹ãã æ§æãšãããã¯ãŒã¯å³ã調ã¹ãŠãïŒäŸµå ¥æ€ç¥ã·ã¹ãã ãäŸµå ¥é²æ¢ãªã©ã®ïŒææ³ã䜿çšãããŠããŠããã¹ãŠã®ãã©ãã£ãã¯ãç£èŠãããŠããããšã確èªããã\n⢠ã«ãŒãäŒå¡ããŒã¿ç°å¢ã®å¢çã§\n⢠ã«ãŒãäŒå¡ããŒã¿ç°å¢å ã®éèŠãªãã€ã³ã㧠| |
- 11.4.b ã·ã¹ãã æ§æã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãäŸµå ¥æ€ç¥ãäŸµå ¥é²æ¢ã䟵害ã®çããæ åœè ã«èŠåããããšã確èªããã | |
- 11.4.c äŸµå ¥æ€ç¥ãäŸµå ¥é²æ¢ææ³ã®æ§æãšãã³ãææžã調ã¹ãŠãäŸµå ¥æ€ç¥ãäŸµå ¥é²æ¢ææ³ããã€ã¹ãæé©ãªä¿è·ãå®çŸããããã®ãã³ãã®æ瀺ã«åŸã£ãŠæ§æãä¿å®ãæŽæ°ãããŠããããšã確èªããã | |
- 11.5 å€æŽæ€åºã¡ã«ããºã ïŒãã¡ã€ã«æŽåæ§ç£èŠããŒã«ãªã©ïŒãå°å ¥ããŠéèŠãªã·ã¹ãã ãã¡ã€ã«ãæ§æãã¡ã€ã«ããŸãã¯ã³ã³ãã³ããã¡ã€ã«ã®äžæ£ãªå€æŽãæ åœè ã«èŠåããéèŠãªãã¡ã€ã«ã®æ¯èŒãå°ãªããšãé±ã«äžåºŠå®è¡ããããã«ãœãããŠã§ã¢ãæ§æããã\n泚ïŒå€æŽæ€åºç®çã§ãéèŠãªãã¡ã€ã«ãšã¯éåžžãå®æçã«å€æŽãããªããããã®å€æŽãã·ã¹ãã ã®äŸµå®³ã䟵害ã®ãªã¹ã¯ã瀺ãå¯èœæ§ããããã¡ã€ã«ã瀺ãããã¡ã€ã«æŽåæ§ç£èŠè£œåãªã©ã®å€æŽæ€åºã¡ã«ããºã ã§ã¯éåžžãé¢é£ãªãã¬ãŒãã£ã³ã°ã·ã¹ãã çšã®éèŠãªãã¡ã€ã«ããããããæ§æãããŠãããã«ã¹ã¿ã ã¢ããªã±ãŒã·ã§ã³çšã®ãã¡ã€ã«ãªã©ããã®ä»ã®éèŠãªãã¡ã€ã«ã¯ãäºæ¥äœïŒã€ãŸããå çåºãŸãã¯ãµãŒãã¹ãããã€ãïŒã«ããè©äŸ¡ããã³å®çŸ©ãå¿ èŠã§ããã: | |
- 11.5.a ã·ã¹ãã èšå®ãšç£èŠããããã¡ã€ã«ã芳å¯ããç£èŠæŽ»åã®çµæãã¬ãã¥ãŒããããšã§ãã«ãŒãäŒå¡ããŒã¿ç°å¢ã§ãå€æŽæ€åºã¡ã«ããºã ã䜿çšãããŠããããšã確èªããã\nç£èŠããå¿ èŠããããã¡ã€ã«ã®äŸ:\nã» ã·ã¹ãã å®è¡å¯èœãã¡ã€ã«\nã» ã¢ããªã±ãŒã·ã§ã³å®è¡å¯èœãã¡ã€ã«\nã» æ§æããã³ãã©ã¡ãŒã¿ãã¡ã€ã«\nã» éäžçã«ä¿åãããŠãããå±¥æŽãŸãã¯ã¢ãŒã«ã€ããããããã°ããã³ç£æ»ãã¡ã€ã«\nã» äºæ¥äœãæå®ããè¿œå ã®éèŠãã¡ã€ã«ïŒãªã¹ã¯è©äŸ¡ãã®ä»ã®æ¹æ³ã§ïŒ | |
- 11.5.b éèŠãªãã¡ã€ã«ã®äžæ£ãªå€æŽãæ åœè ã«èŠåããéèŠãªãã¡ã€ã«ã®æ¯èŒãå°ãªããšãé±ã« 1 åå®è¡ããããã«ã¡ã«ããºã ãæ§æãããŠããããšã確èªããã | |
- 11.5.1 å€æŽæ€åºãœãªã¥ãŒã·ã§ã³ã«ãã£ãŠçæãããèŠåã«å¯Ÿå¿ããããã»ã¹ãå®è£ ããã: | |
- 11.5.1 æ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ããã¹ãŠã®èŠåã調æ»ãã解決ãããããšã確èªããã | |
- 11.6 ã»ãã¥ãªãã£ç£èŠãšãã¹ãã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ãææžåãããŠäœ¿çšãããŠããã圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠããããšã確èªããã: | |
- 11.6 ææžã調ã¹ãæ åœè ãã€ã³ã¿ãã¥ãŒããããšã§ãã»ãã¥ãªãã£ç£èŠãšãã¹ãã«é¢ããã»ãã¥ãªãã£ããªã·ãŒãšæäœæé ã以äžã®èŠä»¶ãæºãããŠããããšã確èªããã\n⢠ææžåãããŠãã\n⢠䜿çšãããŠãã\n⢠圱é¿ãåããé¢ä¿è å šå¡ã«ç¥ãããŠãã | |
- èŠä»¶12ïŒåŸæ¥å¡ããã³æŽŸé£ç€Ÿå¡åãã®æ å ±ã»ãã¥ãªãã£ããªã·ãŒãæŽåãã: | |
- 12.1 ã»ãã¥ãªãã£ããªã·ãŒã確ç«ãå ¬éãç¶æãæ®åããã: | |
- 12.1 æ å ±ã»ãã¥ãªãã£ããªã·ãŒã調ã¹ãŠãããªã·ãŒãå ¬éããããã¹ãŠã®é¢ä¿è ïŒãã³ããããžãã¹ããŒãããŒãå«ãïŒã«æ®åãããŠããããšã確èªããã | |
- 12.1.1 å°ãªããšã幎ã«äžåºŠã¬ãã¥ãŒããç°å¢ãå€æŽãããå Žåã«ããªã·ãŒãæŽæ°ããã: | |
- 12.1.1 æ å ±ã»ãã¥ãªãã£ããªã·ãŒãå°ãªããšã幎ã«äžåºŠã¬ãã¥ãŒããããžãã¹ç®æšãŸãã¯ãªã¹ã¯ç°å¢ãžã®å€æŽãåæ ãããããå¿ èŠã«å¿ããŠæŽæ°ãããŠããããšã確èªããã | |
- 12.2 以äžã®ãªã¹ã¯è©äŸ¡ããã»ã¹ãå®è£ ããã\n⢠å°ãªããšã幎ã«äžåºŠãšç°å¢ã«å€§ããªå€æŽããã£ãå ŽåïŒè²·åãå䜵ã移転ãªã©ïŒã«å®æœããã\n⢠éèŠãªã¢ã»ãããè åšãè匱æ§ãèå¥ãã\n⢠æ£åŒãªãªã¹ã¯è©äŸ¡ã«è³ã\nïŒãªã¹ã¯è©äŸ¡æ¹æ³ã®äŸãšããŠã¯ãOCTAVEãISO 27005ãããã³ NIST SP800-30 ãæããããŸããããããã«éå®ãããŸãããïŒ: | |
- 12.2.a æ£åŒãªãªã¹ã¯è©äŸ¡ã§ãè åšãè匱æ§ãçµæãèå¥ããã幎ã«äžåºŠã®ãªã¹ã¯è©äŸ¡ããã»ã¹ãææžåãããŠããããšã確èªããã | |
- 12.2.b ãªã¹ã¯è©äŸ¡ææžãã¬ãã¥ãŒãããªã¹ã¯è©äŸ¡ããã»ã¹ãå°ãªããšã幎ã«äžåºŠãšå€§ããªå€æŽããã£ãå Žåã«å®æœãããŠããããšã確èªããã | |
- 12.3 éèŠãªãã¯ãããžã«é¢ãã䜿çšããªã·ãŒãäœæããŠããããã®ãã¯ãããžã®é©åãªäœ¿çšãå®çŸ©ãã\næ³šïŒ éèŠãªãã¯ãããžã®äŸã«ã¯ããªã¢ãŒãã¢ã¯ã»ã¹ããã³ã¯ã€ã€ã¬ã¹ãã¯ãããžãããŒãããœã³ã³ãã¿ãã¬ããããªã ãŒããã«é»åã¡ãã£ã¢ãé»åã¡ãŒã«ã®äœ¿çšãã€ã³ã¿ãŒãããã®äœ¿çšããããŸããããããã«éå®ãããŸãã\nãããã®äœ¿çšããªã·ãŒã§ä»¥äžãèŠæ±ããããšã確èªããã | |
- 12.3 éèŠãªãã¯ãããžã«é¢ãã䜿çšããªã·ãŒã調ã¹ã責任è ãã€ã³ã¿ãã¥ãŒããããšã§ãããªã·ãŒãå®è£ ã»é å®ãããŠããããšã確èªããã | |
- 12.3.1 æš©éãæã€é¢ä¿è ã«ããæ瀺çãªæ¿èª: | |
- 12.3.1 䜿çšããªã·ãŒãããã¯ãããžã䜿çšããããã«ãèš±å¯ãããåœäºè ããã®æ瀺çãªæ¿èªãèŠæ±ããŠããããšã確èªããã | |
- 12.3.2 ãã¯ãããžã®äœ¿çšã«å¯ŸããèªèšŒ: | |
- 12.3.2 䜿çšããªã·ãŒãããã¹ãŠã®ãã¯ãããžã®äœ¿çšã«ããŠãŒã¶ ID ãšãã¹ã¯ãŒããŸãã¯ãã®ä»ã®èªèšŒé ç®ïŒããŒã¯ã³ãªã©ïŒã«ããèªèšŒãèŠæ±ããããã»ã¹ãå«ãã§ããããšã確èªããã | |
- 12.3.3 ãã®ãããªãã¹ãŠã®ããã€ã¹ããã³ã¢ã¯ã»ã¹ã§ããæ åœè ã®ãªã¹ã: | |
- 12.3.3 䜿çšããªã·ãŒãããã¹ãŠã®ããã€ã¹ããã³ããã€ã¹ã®äœ¿çšãèš±å¯ãããæ åœè ã®ãªã¹ããå®çŸ©ããŠããããšã確èªããã | |
- 12.3.4 ããã€ã¹ã®ææè ãé£çµ¡å æ å ±ãç®çãæ£ç¢ºã«ãã®å Žã§èå¥ã§ããæ¹æ³ïŒã©ãã«ä»ããã³ãŒãã£ã³ã°ãããã€ã¹ã®ã€ã³ãã³ããªïŒ: | |
- 12.3.4 䜿çšããªã·ãŒãããã€ã¹ã®ææè ãé£çµ¡å æ å ±ãç®çãæ£ç¢ºã«ãã®å Žã§èå¥ã§ããæ¹æ³ïŒã©ãã«ä»ããã³ãŒãã£ã³ã°ãããã€ã¹ã®ã€ã³ãã³ããªïŒãå®çŸ©ããããšã確èªããã | |
- 12.3.5 ãã¯ãããžã®èš±å®¹ãããå©çšæ³: | |
- 12.3.5 䜿çšããªã·ãŒãããã¯ãããžã®èš±å®¹ãããå©çšæ³ãå®çŸ©ããŠããããšã確èªããã | |
- 12.3.6 ãã¯ãããžã®èš±å®¹ããããããã¯ãŒã¯äžã®å Žæ: | |
- 12.3.6 䜿çšããªã·ãŒãããã¯ãããžã®èš±å®¹ããããããã¯ãŒã¯äžã®å Žæãå®çŸ©ããŠããããšã確èªããã | |
- 12.3.7 äŒç€Ÿãæ¿èªãã補åã®ãªã¹ã: | |
- 12.3.7 䜿çšããªã·ãŒããäŒç€Ÿãæ¿èªãã補åã®ãªã¹ããå«ãããšã確èªããã | |
- 12.3.8 éã¢ã¯ãã£ãç¶æ ãç¹å®ã®æéç¶ããåŸã®ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžã®ã»ãã·ã§ã³ã®èªååæ: | |
- 12.3.8.a 䜿çšããªã·ãŒããéã¢ã¯ãã£ãç¶æ ãäžå®æéç¶ããåŸã®ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžã®ã»ãã·ã§ã³ã®èªååæãèŠæ±ããŠããããšã確èªããã | |
- 12.3.8.b ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžã®æ§æã調ã¹ãŠãéã¢ã¯ãã£ãç¶æ ãäžå®æéç¶ããåŸã«ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžã®ã»ãã·ã§ã³ãèªååæãããããšã確èªããã | |
- 12.3.9 ãã³ãããã³ããžãã¹ããŒãããŒã«ã¯å¿ èŠãšããå Žåã«ã®ã¿ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžãã¢ã¯ãã£ãåãã䜿çšåŸçŽã¡ã«éã¢ã¯ãã£ãåãã: | |
- 12.3.9 䜿çšããªã·ãŒã§ããã³ããããžãã¹ããŒãããŒãå¿ èŠãšããå Žåã«ã®ã¿ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžãã¢ã¯ãã£ãåãã䜿çšåŸçŽã¡ã«éã¢ã¯ãã£ãåããããšãèŠæ±ãããŠããããšã確èªããã | |
- 12.3.10 ãªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžçµç±ã§ã«ãŒãäŒå¡ããŒã¿ã«ã¢ã¯ã»ã¹ããæ åœè ã«ã€ããŠã¯ãå®çŸ©ãããããžãã¹ããŒãºã®ããã«æ瀺çã«æ¿èªãããŠããªãéããããŒã«ã«ããŒããã©ã€ãããã³ãªã ãŒããã«é»åã¡ãã£ã¢ãžã®ã«ãŒãäŒå¡ããŒã¿ã®ã³ããŒã移åãä¿åãçŠæ¢ããããæ¿èªãããããžãã¹ããŒãºãããå Žåã䜿çšããªã·ãŒã¯ããŒã¿ãé©çšããã PCI DSS èŠä»¶ãã¹ãŠã«åŸã£ãŠä¿è·ãããããšãèŠæ±ããå¿ èŠãããã: | |
- 12.3.10.a 䜿çšããªã·ãŒã§ããªã¢ãŒãã¢ã¯ã»ã¹ãã¯ãããžãä»ããŠã«ãŒãäŒå¡ããŒã¿ã«ã¢ã¯ã»ã¹ããå Žåããã®ãããªããŒã¿ãããŒã«ã«ããŒããã©ã€ãããªã ãŒããã«é»ååªäœã«ã³ããŒã移åãä¿åããããšã¯çŠæ¢ãããŠããããšã確èªããã | |
- 12.3.10.b é©åãªæ¿èªãæã€æ åœè ã«ã€ããŠã䜿çšããªã·ãŒã PCI DSS èŠä»¶ã«åŸã£ãŠãã«ãŒãäŒå¡ããŒã¿ã®ä¿è·ãèŠæ±ããŠããããšã確èªããã | |
- 12.4 ã»ãã¥ãªãã£ããªã·ãŒãšæé ãããã¹ãŠã®æ åœè ã«é¢ããæ å ±ã»ãã¥ãªãã£è²¬ä»»ãæ確ã«å®çŸ©ããŠããããšã確èªããã: | |
- 12.4.a ãã¹ãŠã®æ åœè ã«ã€ããŠãæ å ±ã»ãã¥ãªãã£ãæ確ã«å®çŸ©ããæ å ±ã»ãã¥ãªãã£ããªã·ãŒã確èªããã | |
- 12.4.b 責任è ã®ãµã³ãã«ãã€ã³ã¿ãã¥ãŒããŠãã»ãã¥ãªãã£ããªã·ãŒãç解ããŠããããšã確èªããã | |
- 12.5 å人ãŸãã¯ããŒã ã«ä»¥äžã®æ å ±ã»ãã¥ãªãã£ç®¡ç責任ãå²ãåœãŠãã: | |
- 12.5 æ å ±ã»ãã¥ãªãã£ããªã·ãŒãšæé ã調ã¹ã以äžã確èªããã\n⢠æ å ±ã»ãã¥ãªãã£ãæé«ã»ãã¥ãªãã£è²¬ä»»è ãŸãã¯ãããŒãžã¡ã³ãã®ãã®ä»ã®ã»ãã¥ãªãã£ã«è©³ããã¡ã³ããŒã«æ£åŒã«å²ãåœãŠãããŠããã\n⢠以äžã®æ å ±ã»ãã¥ãªãã£è²¬ä»»ãæ確ãã€æ£åŒã«å²ãåœãŠãããŠããïŒ | |
- 12.5.1 ã»ãã¥ãªãã£ããªã·ãŒããã³æç¶ãã確ç«ãææžåãé åžããã: | |
- 12.5.1 ã»ãã¥ãªãã£ããªã·ãŒãšæé ã確ç«ãææžåãããã³é åžãã責任ããæ£åŒã«å²ãåœãŠãããŠããããšã確èªããã | |
- 12.5.2 ã»ãã¥ãªãã£ã®èŠåãæ å ±ãç£èŠããã³åæããé©åãªæ åœè ã«é åžããã: | |
- 12.5.2 ã»ãã¥ãªãã£ã®èŠåãç£èŠããã³åæããæ å ±ãé©åãªæ å ±ã»ãã¥ãªãã£ããã³éšçœ²ç®¡çæ åœè ã«é åžãã責任ããæ£åŒã«å²ãåœãŠãããŠããããšã確èªããã | |
- 12.5.3 ã»ãã¥ãªãã£ã€ã³ã·ãã³ãã®å¯Ÿå¿ããã³ãšã¹ã«ã¬ãŒã·ã§ã³æé ã確ç«ãææžåãé åžãããã¹ãŠã®ç¶æ³ã«ã¿ã€ã ãªãŒãã€å¹ççã«å¯ŸåŠããããšã確èªããã: | |
- 12.5.3 ã»ãã¥ãªãã£ã€ã³ã·ãã³ãã®å¯Ÿå¿ããã³ãšã¹ã«ã¬ãŒã·ã§ã³æé ã確ç«ãææžåãããã³é åžãã責任ããæ£åŒã«å²ãåœãŠãããŠããããšã確èªããã | |
- 12.5.4 è¿œå ãåé€ãå€æŽãå«ãããŠãŒã¶ã¢ã«ãŠã³ãã管çãã: | |
- 12.5.4 ãŠãŒã¶ã¢ã«ãŠã³ãã®ç®¡çïŒè¿œå ãåé€ãå€æŽïŒã®è²¬ä»»ãšèªèšŒç®¡çã®è²¬ä»»ãæ£åŒã«å²ãåœãŠãããŠããããšã確èªããã | |
- 12.5.5 ãã¹ãŠã®ããŒã¿ãžã®ã¢ã¯ã»ã¹ãç£èŠããã³ç®¡çããã: | |
- 12.5.5 ãã¹ãŠã®ããŒã¿ãžã®ã¢ã¯ã»ã¹ãç£èŠããã³ç®¡çãã責任ãæ£åŒã«å²ãåœãŠãããŠããããšã確èªããã | |
- 12.6 ã«ãŒãäŒå¡ããŒã¿ã»ãã¥ãªãã£ã®éèŠæ§ãå šæ åœè ãèªèã§ããããã«æ£åŒãªã»ãã¥ãªãã£æèåäžããã°ã©ã ãå®è£ ãã: | |
- 12.6.a æ£åŒãªã»ãã¥ãªãã£æèåäžããã°ã©ã ã調ã¹ãŠããã®ããã°ã©ã ãã«ãŒãäŒå¡ããŒã¿ã»ãã¥ãªãã£ã®éèŠæ§ãå šæ åœè ã«èªèãããããšãã§ããããšã確èªããã | |
- 12.6.b ã»ãã¥ãªãã£æèåäžããã°ã©ã æé ãšææžã調ã¹ãŠã以äžãå®æœããã | |
- 12.6.1 æ åœè ã®æè²ãæ¡çšæããã³å°ãªããšã幎ã«äžåºŠè¡ãã\næ³šïŒ æ¹æ³ã¯ãæ åœè ã®åœ¹å²ãšã«ãŒãäŒå¡ããŒã¿ãžã®ã¢ã¯ã»ã¹ã¬ãã«ã«å¿ããŠç°ãªãã: | |
- 12.6.1.a ã»ãã¥ãªãã£æèåäžããã°ã©ã ããæ åœè ã®æèåäžãšæè²ãå³ããããè€æ°ã®æ¹æ³ïŒããšãã°ããã¹ã¿ãŒãæçŽãã¡ã¢ãWebããŒã¹ã®ãã¬ãŒãã³ã°ãäŒè°ãããã¢ãŒã·ã§ã³ãªã©ïŒã§æäŸãããŠããããšã確èªããã | |
- 12.6.1.b æ åœè ããæ¡çšæããã³å°ãªããšã幎ã«äžåºŠãã»ãã¥ãªãã£æèåäžãã¬ãŒãã³ã°ã«åå ããŠããããšã確èªããã | |
- 12.6.1.c æ åœè ã®ãµã³ãã«ãã€ã³ã¿ãã¥ãŒããããšã§ãæèåäžãã¬ãŒãã³ã°ãå®äºããŠãããã«ãŒãäŒå¡ããŒã¿ã»ãã¥ãªãã£ã®éèŠããèªèããŠããããšã確èªããã | |
- 12.6.2 æ åœè ã¯ãå°ãªããšã幎ã«äžåºŠã»ãã¥ãªãã£ããªã·ãŒããã³æé ãèªã¿ãç解ããããšãèªããå¿ èŠãããã: | |
- 12.6.2 æ åœè ããå°ãªããšã幎ã«äžåºŠã»ãã¥ãªãã£ããªã·ãŒããã³æé ãèªã¿ãç解ããããšãæžé¢ãŸãã¯é»åçã«èªããå¿ èŠãããããšããã»ãã¥ãªãã£æèåäžããã°ã©ã ãèŠæ±ããŠããããšã確èªããã | |
- 12.7 éçšããåã«ãå¯èœæ§ã®ããæ åœè ãéžå¥ããŠãå éšãœãŒã¹ããã®æ»æãªã¹ã¯ãæå°éã«æãããïŒããã¯ã°ã©ãŠã³ããã§ãã¯ã®äŸã«ã¯ãè·æŽãç¯çœªæŽãä¿¡çšå±¥æŽãçµæŽç §äŒããããïŒ\næ³šïŒ ãã®ãããªå¯èœæ§ã®ããæ åœè ãããã©ã³ã¶ã¯ã·ã§ã³ã®å®æœã§äžåºŠã« 1 ã€ã®ã«ãŒãçªå·ã«ããã¢ã¯ã»ã¹ã§ããªããããªã¬ãžä¿ãªã©ãç¹å®ã®åœ¹è·ã«æ¡çšããå Žåã¯ããã®èŠä»¶ã¯æšå¥šã®ã¿ã§ãã: | |
- 12.7 人äºéšéã®ç®¡çè ã«åãåãããŠãã«ãŒãäŒå¡ããŒã¿ãŸãã¯ã«ãŒãäŒå¡ããŒã¿ç°å¢ã«ã¢ã¯ã»ã¹ããå¯èœæ§ã®ããæ åœè ã«ã€ããŠã¯ãéçšã®åã«ããã¯ã°ã©ãŠã³ããã§ãã¯ãïŒå°åæ³ã®å¶çŽå ã§ïŒå®æœãããããšã確èªããã | |
- 12.8 ã«ãŒãäŒå¡ããŒã¿ããµãŒãã¹ãããã€ããšå ±æãããå Žåã¯ã次ã®é ç®ãå«ãããµãŒãã¹ãããã€ãã管çããããªã·ãŒãšæé ãç¶æããã³å®è£ ããã: | |
- 12.8 ããªã·ãŒãšæé ã®èŠ³å¯ãšã¬ãã¥ãŒãé¢é£ææžã®ã¬ãã¥ãŒãéããŠãã«ãŒãäŒå¡ããŒã¿ãå ±æããããã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«åœ±é¿ãåãŒãå¯èœæ§ã®ãããµãŒãã¹ãããã€ãïŒããšãã°ãããã¯ã¢ããããŒãä¿ç®¡æœèšãWeb ãã¹ãã£ã³ã°äŒæ¥ãã»ãã¥ãªãã£ãµãŒãã¹ãããã€ããªã©ã®ç®¡ç察象ãµãŒãã¹ãããã€ãããŸãã¯äžæ£ã¢ããªã³ã°ç®çã§ããŒã¿ãåä¿¡ãããµãŒãã¹ãããã€ããªã©ïŒã次ã®ããã«ç®¡çããããã»ã¹ãå®è£ ãããŠããããšã確èªããã | |
- 12.8.1 ãµãŒãã¹ãããã€ãã®ãªã¹ããç¶æããã: | |
- 12.8.1 ãµãŒãã¹ãããã€ãã®ãªã¹ããç¶æãããŠããããšã確èªããã | |
- 12.8.2ãµãŒãã¹ãããã€ãã¯ããããã€ããã顧客ã«ä»£ãã£ãŠææãä¿åãåŠçãéä¿¡ããã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«ã€ããŠããŸãã¯é¡§å®¢ã®ã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«åœ±é¿ãäžããç¯å²ã«ã€ããŠè²¬ä»»ãæã€ããšãèªããå 容ã®æžé¢ã«ããå¥çŽæžãç¶æããã\næ³šïŒ åæã®æ£ç¢ºãªèšèã¥ããã¯ãæäŸããããµãŒãã¹ã®è©³çŽ°ãåäºæ¥äœã«å²ãåœãŠããã責任ãªã©ã2 ã€ã®äºæ¥äœéã®åæãã£ãŠç°ãªããŸããåæã®æ£ç¢ºãªèšèã¥ããã«ããã®èŠä»¶ã§æäŸãããŠããã®ãšåããã®ãå«ããå¿ èŠã¯ãããŸããã: | |
- 12.8.2 æžé¢ã«ããå¥çŽã調ã¹ãŠããµãŒãã¹ãããã€ããã顧客ã«ä»£ãã£ãŠææãä¿åãåŠçãéä¿¡ããã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«ã€ããŠããŸãã¯é¡§å®¢ã®ã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«åœ±é¿ãäžããç¯å²ã«ã€ããŠè²¬ä»»ãæã€ããšãèªããå 容ã®æžé¢ã«ããå¥çŽæžãç¶æããŠããããšã確èªããã | |
- 12.8.3 å¥çŽåã®é©åãªãã¥ãŒãã£ãªãžã§ã³ã¹ãå«ãããµãŒãã¹ãããã€ããšã®å¥çŽã«é¢ããããã»ã¹ã確ç«ãããŠããã: | |
- 12.8.3 ãµãŒãã¹ãããã€ããšã®å¥çŽåã®é©åãªãã¥ãŒãã£ãªãžã§ã³ã¹ãå«ããããªã·ãŒãšæé ãææžåãããŠãå®æœãããŠããããšã確èªããã | |
- 12.8.4 å°ãªããšã幎ã«äžåºŠããµãŒãã¹ãããã€ãã®PCI DSSæºæ ã¹ããŒã¿ã¹ãç£èŠããããã°ã©ã ãç¶æããã: | |
- 12.8.4 äºæ¥äœããå°ãªããšã幎ã«äžåºŠãã®ãµãŒãã¹ãããã€ãã®PCI DSSæºæ ã¹ããŒã¿ã¹ãç£èŠããããã®ããã°ã©ã ãç¶æããŠããããšã確èªããã | |
- 12.8.5 åãµãŒãã¹ãããã€ãã«å¯Ÿããã©ã®PCI DSS èŠä»¶ããµãŒãã¹ãããã€ãã«ãã£ãŠç®¡çãããã©ã® PCI DSS ãäºæ¥äœã«ãã£ãŠç®¡çããããã«ã€ããŠã®æ å ±ãç¶æããã: | |
- 12.8.5 åãµãŒãã¹ãããã€ãã«å¯Ÿããã©ã® PCI DSS èŠä»¶ããµãŒãã¹ãããã€ãã«ãã£ãŠç®¡çãããã©ã® PCI DSS ãäºæ¥äœã«ãã£ãŠç®¡çããããã«ã€ããŠã®æ å ±ãäºæ¥äœãç¶æããŠããããšã確èªããã | |
- 12.9 ãµãŒãã¹ãããã€ãçšã®è¿œå èŠä»¶:顧客ã«ä»£ãã£ãŠææãä¿åãåŠçãéä¿¡ããã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«ã€ããŠããŸãã¯é¡§å®¢ã®ã«ãŒãäŒå¡ããŒã¿ã®ã»ãã¥ãªãã£ã«åœ±é¿ãäžããç¯å²ã«ã€ããŠè²¬ä»»ãæã€ããšãèªããå 容ã®æžé¢ã«ããå¥çŽæžãç¶æããã\næ³šïŒ ãã®èŠä»¶ã¯ã2015 幎 6 æ 30 æ¥ãŸã§ã¯ãã¹ããã©ã¯ãã£ã¹ãšã¿ãªããããã以éã¯èŠä»¶ã«ãªãã\næ³šïŒ åæã®æ£ç¢ºãªèšèã¥ããã¯ãæäŸããããµãŒãã¹ã®è©³çŽ°ãåäºæ¥äœã«å²ãåœãŠããã責任ãªã©ã2 ã€ã®äºæ¥äœéã®åæãã£ãŠç°ãªããŸããåæã®æ£ç¢ºãªèšèã¥ããã«ããã®èŠä»¶ã§æäŸãããŠããã®ãšåããã®ãå«ããå¿ èŠã¯ãããŸããã: | |
- 12.9.1 ãµãŒãã¹ãããã€ãã®ããªã·ãŒãšæé ãã¬ãã¥ãŒããæžé¢ã«ããå¥çŽã®ãã³ãã¬ãŒããèªãã§ããµãŒãã¹ãããã€ããã顧客ã®ã«ãŒãäŒå¡ããŒã¿ãæ©å¯ã®èªèšŒããŒã¿ãåãæ±ããã¢ã¯ã»ã¹ããããŸãã¯ä»ã®æ¹æ³ã§ä¿åãåŠçãéä¿¡ãããã顧客ã®ã«ãŒãäŒå¡ããŒã¿ç°å¢ã顧客ã«å§èšãããŠç®¡çãããšããæ¥åç¯å²ã«ãããŠè©²åœãããã¹ãŠã® PCI DSS èŠä»¶ãé å®ãããšããåæãæžé¢ã«ãŠé¡§å®¢ã«æ瀺ããããšã確èªããã | |
- 12.10 ã€ã³ã·ãã³ã察å¿èšç»ãå®æœãããã·ã¹ãã éåã«çŽã¡ã«å¯Ÿå¿ã§ããããæºåããã: | |
- 12.10 ã€ã³ã·ãã³ã察å¿èšç»ãšé¢é£æé ã調ã¹ãŠãäºæ¥äœãã·ã¹ãã éåã«å¯ŸããŠä»¥äžãå®æœããããšã§å³æ察å¿ããçšæãããããšã確èªããã | |
- 12.10.1 ã·ã¹ãã éåãçºçããå Žåã«å®æœãããã€ã³ã·ãã³ã察å¿èšç»ãäœæãããèšç»ã§ã¯ãæäœéã以äžã«å¯Ÿå¿ããã\nã»ãã€ã¡ã³ããã©ã³ããžã®éç¥ãæäœéå«ãã䟵害ãçºçããå Žåã®åœ¹å²ã責任ãããã³äŒéãšé£çµ¡ã«é¢ããæŠç¥\nã»å ·äœçãªã€ã³ã·ãã³ã察å¿æé \nã»ããžãã¹ã®åŸ©æ§ããã³ç¶ç¶æé \nã»ããŒã¿ããã¯ã¢ããããã»ã¹\nã»äŸµå®³ã®å ±åã«é¢ããæ³çèŠä»¶ã®åæ\nã»ãã¹ãŠã®éèŠãªã·ã¹ãã ã³ã³ããŒãã³ãã察象ãšãã察å¿\nã»ãã€ã¡ã³ããã©ã³ãã«ããã€ã³ã·ãã³ã察å¿æé ã®åç §ãŸãã¯å å«: | |
- 12.10.1.a ã€ã³ã·ãã³ã察å¿èšç»ã«ä»¥äžãå«ãŸããŠããããšã確èªããã\nã»ãã€ã¡ã³ããã©ã³ããžã®éç¥ãæäœéå«ãã䟵害ãçºçããå Žåã®åœ¹å²ã責任ãããã³äŒéã«é¢ããæŠç¥\nã»å ·äœçãªã€ã³ã·ãã³ã察å¿æé \nã»ããžãã¹ã®åŸ©æ§ããã³ç¶ç¶æé \nã»ããŒã¿ããã¯ã¢ããããã»ã¹\nã»äŸµå®³ã®å ±åã«é¢ããæ³çèŠä»¶ã®åæïŒããŒã¿ããŒã¹ã«ã«ãªãã©ã«ãã¢åšäœè ãå«ãŸããŠããäŒæ¥ã«å¯Ÿããå®éã®äŸµå®³ãŸãã¯äŸµå®³ã®å¯èœæ§ãçºçããå Žåã«ã圱é¿ãåããæ¶è²»è ãžã®éç¥ãèŠæ±ããCalifornia Bill 1386 ãªã©ïŒ\nã»ãã¹ãŠã®éèŠãªã·ã¹ãã ã³ã³ããŒãã³ãã察象ãšãã察å¿\nã»ãã€ã¡ã³ããã©ã³ãã«ããã€ã³ã·ãã³ã察å¿æé ã®åç §ãŸãã¯å å« | |
- 12.10.1.b æ åœè ãã€ã³ã¿ãã¥ãŒãã以åã«å ±åãããã€ã³ã·ãã³ããèŠåãã¬ãã¥ãŒããŠãææžåãããã€ã³ã·ãã³ãã¬ã¹ãã³ã¹èšç»ãšæé ã«åŸã£ãŠããããšã確èªããã | |
- 12.10.2 å°ãªããšã幎ã«äžåºŠãèšç»ããã¹ãããã: | |
- 12.10.2 å°ãªããšã幎ã«äžåºŠãèšç»ããã¹ããããŠããããšã確èªããã | |
- 12.10.3 èŠåã« 24 æé 365 æ¥äœå¶ã§å¯Ÿå¿ã§ããæ åœè ãæå®ããã: | |
- 12.10.3 ããªã·ãŒã®èŠ³å¯ãšã¬ãã¥ãŒãããã³è²¬ä»»è ã®ã€ã³ã¿ãã¥ãŒãéããŠãæ¿èªãããŠããªã掻åãæ¿èªãããŠããªãã¯ã€ã€ã¬ã¹ã¢ã¯ã»ã¹ãã€ã³ãã®æ€åºãéèŠãª IDS èŠåãéèŠãªã·ã¹ãã ãŸãã¯ã³ã³ãã³ããã¡ã€ã«ã®æ¿èªãããŠããªãå€æŽã®çè·¡ããªããã©ããã調æ»ããããã«ãã€ã³ã·ãã³ã察å¿ããã³ç£èŠã 24 æéäœå¶ã§è¡ãããŠããããšã確èªããã | |
- 12.10.4 ã»ãã¥ãªãã£éåãžã®å¯Ÿå¿ãæ åœããã¹ã¿ããã«é©åãªãã¬ãŒãã³ã°ãæäŸããã: | |
- 12.10.4 ããªã·ãŒã®èŠ³å¯ãšã¬ãã¥ãŒãããã³è²¬ä»»è ã®ã€ã³ã¿ãã¥ãŒãéããŠãã»ãã¥ãªãã£éåãžã®å¯Ÿå¿ã«è²¬ä»»ãæã€ã¹ã¿ãããå®æçã«ãã¬ãŒãã³ã°ãããŠããããšã確èªããã | |
- 12.10.5 äŸµå ¥æ€ç¥ãäŸµå ¥é²æ¢ããã¡ã€ã¢ãŠã©ãŒã«ããã¡ã€ã«æŽåæ§ç£èŠã·ã¹ãã ãå«ãããããã«éå®ãããªããã»ãã¥ãªãã£ç£èŠã·ã¹ãã ããã®èŠåãå«ããã: | |
- 12.10.5 ããªã·ãŒã®èŠ³å¯ãšã¬ãã¥ãŒãéããŠãæ¿èªãããŠããªãç¡ç·ã¢ã¯ã»ã¹ãã€ã³ãã®æ€åºãå«ããã»ãã¥ãªãã£ç£èŠã·ã¹ãã ããã®èŠåã®ç£èŠããã³å¯Ÿå¿ãã€ã³ã·ãã³ã察å¿èšç»ã«å«ãŸããŠããããšã確èªããã | |
- 12.10.6 åŸãããæèšãèžãŸããŠã€ã³ã·ãã³ã察å¿èšç»ãå€æŽããã³æ¹åããæ¥çã®çºå±ãçµã¿èŸŒãããã»ã¹ãäœæããã: | |
- 12.10.6 ããªã·ãŒã®èŠ³å¯ãšã¬ãã¥ãŒãããã³è²¬ä»»è ã®ã€ã³ã¿ãã¥ãŒãéããŠãåŸãããæèšãèžãŸããŠã€ã³ã·ãã³ã察å¿èšç»ãå€æŽããã³æ¹åããæ¥çã®çºå±ãçµã¿èŸŒãããã»ã¹ãããããšã確èªããã |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment