I wrote a book to read before your business partners ask, 'Are you taking security measures?'

Good evening, this is Cardy.
I started writing this book about the SCS evaluation system after Tech Book Fes 20 began, and since it is now complete, I have published it on BOOTH today👏

I had notebookLM draw an infographic for me🙌

Who should read this

This book is not for security experts.

I wrote it for those who, when they receive a security checklist from a business partner,
want to be able to explain, "We have done this much, but we are considering this for the future," instead of saying, "I think it's probably fine" or "Everything is perfect (just guessing)."
That is because it is the most trustworthy behavior as a person in charge of security.
Also, I want solo IT staff, general affairs staff who also handle IT, DX promotion staff, and management to read this content as well.

I hope you will use the SCS evaluation system as a starting point to first understand where your company currently stands.
I would be happy if you picked it up as that first step.

To begin with, what is the SCS evaluation system...

Attackers infiltrate companies with low security literacy and use them as a stepping stone to infiltrate large corporations.

In other words, from now on, it is not that "we are small so we won't be targeted," but rather that it has become an era where "you are targeted precisely because you are small." And large corporations, as always, will continue to be targeted ( ；∀；)

Do you ever experience things like this?

Requests from business partners to submit a "security confirmation sheet"

Doesn't it happen that one day, you suddenly receive a security checklist from a business partner?

"Do you have antivirus measures in place?"
"Are you taking backups?"
"Is administrator access being managed?"

I understand that each one is important, and I think we are doing them somehow.
But when you try to answer as a company,

"I think we are doing it"
"I don't know unless I ask the person in charge"
"There should be rules decided a long time ago"

Sometimes you end up in that state.

Such confirmations come from multiple business partners, and each one has different items. Repeating the process of investigating and answering each time is useless work that produces no real benefit.

The SCS evaluation system clarifies the criteria

I feel like many people think that if it's led by METI or IPA, it will just increase troublesome work.

But actually, it is a "chance."

As I wrote earlier, security checks have existed until now. In various formats from each company.

However, from now on, the SCS evaluation system will be the standard, so you can just say, 'We are a 3-star company.'
That settles it.
Of course, there are many conditions that must be met to achieve a 3-star rating. But that is not an impossible challenge.

These are all items that are necessary as a general rule.
That is precisely why you should see this as an opportunity and start by reviewing your security, beginning with understanding your company's current state.

Security is infrastructure

Security is infrastructure.
Because it is infrastructure, if it is weak, it places a burden on the systems that run on top of it.

The following is an example using water supply.
If the water pipes are thin and only a trickle of water comes out, it takes a wasteful amount of time to fill a glass, and just waiting is frustrating. And wasted time becomes a cost.
If the water pipes are thick, the water fills up in an instant, so there is no need to wait. You can move smoothly to your next action.

Security is the same. With weak security, unnecessary options are added to the systems running on it, and operations require extra steps, resulting in wasted costs that ultimately come back to the company.
Since it is infrastructure, it is important to build a solid security foundation that is right for your company.

The SCS evaluation system serves as a guide

And the SCS evaluation system serves as a guide for building that security foundation. That said, there is no need to blindly introduce security measure mechanisms.

First, it is important to know where your company stands. As a result of the security measures you have taken so far, what are your current security strengths? And where are your weaknesses?

In this book, I list the first steps you can take in five days. I have also prepared check sheets for each.
Let's start by taking five days to visualize your company's state.

Security measures come next

Once you know those things, you can prioritize and implement measures.
And the evaluation you receive after taking those measures will be a 3-star or 4-star rating.

This leads to protecting not only your own company but also your business partners.
And that trust will lead to future work.

If you have heard of the SCS evaluation system but don't know how to approach it, please take a look at this book.