Ensuring information security

Promoting information security management

As a leader of Japan's information and telecommunications industry, the NTT Group recognizes its responsibility to protect any and all personal information, especially that of our customers. With the full implementation of the Act on the Protection of Personal Information in April 2005, the NTT Group renewed its commitment to the protection of personal information by undertaking a complete overhaul of its organization and policies on information security. This process included the formulation and publication of the NTT Group's Information Security Policy as well as privacy policies by individual group companies to define our position on information security issues. A systematic review of existing rules and regulations was also conducted, and the importance of these and other security measures was conveyed to management and employees alike through programs utilizing e-learning and other educational technologies.
Regrettably, incidents involving the loss of personal information provided by customers have occurred in some NTT Group companies. At each of these companies, extensive efforts have been made to clarify the contributing factors and to ensure even stricter protection of confidential information through organizational, personal, technological, and physical countermeasures. Measures have been taken throughout the entire NTT Group to share expertise and to continuously inspect and review data management systems to ensure that all personal information, whether provided by our customers or another thirdparty, is subject to the strictest protection. The NTT Group remains fully committed to ensuring the strictest security for confidential personal information through the implementation of the latest security technology and continuing education of all its employees.

NTT Group's Information Security Policy

In order to continue supplying safe, secure services at all times and remain to be a company relied on by customers forever, the NTT Group, as one of the responsible companies that shoulder the information communication industry, shall strive to maintain the security of information and contribute to the sound development of ubiquitous broadband society in accordance with the following policy.

(1) With a strong recognition of the importance of information security in ubiquitous broadband society, the Group shall strive to create a safe, secure, convenient communication environment and maintain information security.

(2) All the board members and employees of the NTT Group shall fully recognize that protecting information is the base of the Group's business activities and an important social responsibility of any company, and the Group shall strictly observe the secrecy of communications and comply with the relevant laws and regulations, including the Personal Information Protection Act.

(3) The Group shall reinforce its organization for maintaining information security, take thoroughgoing measures to prevent illegal access to information and loss, alteration, leak, etc. of information and implement activities necessary for protection of information, including thoroughgoing employee education and proper supervision of contractors, on a continual basis.

Initiatives

Information security and the protection of personal information

To ensure that every employee properly manages customers' personal information, NTT EAST has prepared a guidebook called Guidelines for Customer Information Protection, and NTT WEST has created a Customer Information Protection Manual. These guides have been distributed to employees and used in seminars to further promote sound personal information management.
DoCoMo Shops operated by NTT DoCoMo protect personal information through means such as paperless storage of application forms and rigorous checking of the identity of each new subscriber. DoCoMo Shops also make very sure that no personal data can be retrieved from mobile phones returned to them by destroying them using specially designed equipment. Another personal information protection initiative is a system developed by NTT LOGISCO for the recycling of confidential documents through the use of locked security boxes, known as SS�]BOX, which are periodically collected in secure vehicles for recycling. This system allows the secure disposal of confidential information without the bother of shredding; and because it is environmentally friendly, the system has been adopted both by NTT Group companies and many other companies. Furthermore, by the end of fiscal 2005, eight major NTT Group companies^* had earned Information Security Management System (ISMS) certification for 129 oftheir sites and Privacy Mark (P-Mark) certification for another 50.

* NTT EAST, NTT WEST, NTT Communications, NTT DATA, NTT DoCoMo, NTT COMWARE, NTT FACILITIES, and NTT Urban Development

(left)NTT EAST and NTT WEST manuals
(right)An SS-BOX from NTT LOGISCO

Security guidelines for contractors

The NTT Group also endeavors to raise awareness regarding the protection of customer information among contractor personnel. For example, in April 2005, NTT WEST drafted its Security Guidelines for the Protection of Customer Information by Contractors, and implements measures such as information management training for contractor employees covering a wide range of issues from compliance with laws and regulations, confidentiality, and secure operations in handling customer information, to access management and the stationing and responsibilities of information management personnel.