[Case Study] How to comply with the Toyota Group's security standard 'ATSG'? Aichi Information System's choice for supply chain security

In recent years, with the sophistication of cyberattacks, security measures across the entire supply chain are strongly required. Compliance with the 'All Toyota Security Guidelines (ATSG)' is one such requirement, posing a significant challenge for group companies and suppliers. While external devices like USB flash drives offer convenience, they also pose risks of information leakage, raising the question of 'how to control them through systems, not just rules.' Amidst this, Aichi Information System Co., Ltd., which supports the IT infrastructure of the Aichi Steel Group and provides services to Toyota Group companies and suppliers, has been supporting group companies in their ATSG compliance. As part of this, they proceeded with the deployment of the device control software 'RunDX.' At Asdex Co., Ltd., one of the implementation sites, a trial was conducted as part of their efforts to strengthen security measures. Following verification in a real environment, it was fully implemented. During the initial consideration, asset management tools were also candidates, but they were deemed excessive for the requirement of 'only wanting device control' and presented cost issues. RunDX was selected for its simple design specialized in device control, the ease of implementation without a server, and the ability to operate at a low cost. By introducing RunDX, they achieved an operation that restricts external device connections in principle while allowing only company-issued USB drives. This meets the requirements of ATSG and leads to the improvement and homogenization of security levels across the entire supply chain. Furthermore, because it can be operated serverless, it is highly regarded for being manageable even with limited budgets and personnel.