HIXORInformation Security Policy
This page is a courtesy translation of the Japanese original. The Japanese version is the legally operative text.
HIXOR — Representative: Yuji Hirose
HIXOR has self-declared two stars under SECURITY ACTION.
HIXOR ("we") is a sole proprietorship based in Kuwana City, Mie, Japan, providing cybersecurity support to small and medium-sized enterprises. As a business that provides security-related services, we regard protecting the information entrusted to us by customers and our own information assets as a foundation of our business. To protect the information we handle from threats such as accidents, disasters, and crime, we establish this basic policy, and the representative personally complies with it.
1. Purpose
This policy aims to manage our information assets appropriately, prevent information security incidents, and minimize the impact if an incident occurs.
2. Scope
This policy applies to all information handled in our business activities (electronic data and paper media), including customer inquiry information, documents and project files entrusted to us in the course of work, and our own business information. It applies to the representative. Outsourcing partners and cloud service providers are not directly subject to this policy; their handling is based on contracts and terms of use, and we select, verify, and manage them in accordance with Section 8.
3. Management structure
The person responsible for information security is the representative, Yuji Hirose, who decides, implements, and reviews measures. We are operated by the representative alone, who also performs the practical work.
4. Management of information assets
Important information is managed appropriately, with storage locations, removal, and sharing methods set according to its importance. Information and media that are no longer needed are disposed of reliably by methods appropriate to the medium — paper is shredded; electronic records are deleted, and media are erased by irrecoverable methods when they are discarded or transferred.
5. Access management and authentication
- Accounts for information systems are issued per user, and sharing is avoided.
- Administrator privileges are limited to the minimum necessary and operated separately from everyday accounts.
- Passwords are sufficiently long and reuse is prohibited. For services used in our work, where two-factor authentication is offered, we use it.
- Accounts and access rights are reviewed regularly.
- When a contract with an outsourcing partner ends or the use of a service ends, accounts are promptly suspended and permissions changed.
6. Equipment and network management
Operating systems and software are kept up to date and anti-virus software is deployed. Network equipment such as routers has its default password changed and firmware updated, and unnecessary external exposure is disabled.
7. Backups
Important data is stored in cloud services with redundancy and version history, maintained in a state recoverable even if local equipment fails or is lost. Restoration procedures for stored data are confirmed and tested regularly.
8. Management of outsourcing partners
When outsourcing work that handles information, or using cloud services where information is stored or processed (hosting, document/business tools, etc.), we check the information-management status of the partner or provider and make the necessary arrangements.
9. Education
The representative studies information security regularly and strives to keep up with the latest threat techniques.
10. Incident response
If an incident such as leakage, loss, or unauthorized access occurs, we promptly work to prevent the spread of damage and investigate the cause, contact affected customers, and consult or notify the relevant authorities as necessary.
11. Compliance and review
We comply with information-security laws and contractual requirements. This policy is reviewed and improved regularly in response to changes in the business environment and threats.
Established: November 4, 2026