■ Management model:

• The development lifecycle of both hardware and software consists of multiple stages.
  The responsibilities and authorities for each stage are clearly defined and assigned.

• Hardware and software are developed and designed in unison and placed under integral management from the initial stage. Quality assurance and reviews are conducted to prevent hardware and software from proceeding to the next stage if defects remain unsolved.

• In the maintenance lifecycle, our service division uses the database to manage the lifecycle of products.
  Total maintenance and management is also achieved through the correction of defects by the service division.

• We undertake maintenance for as long as our products are on the market. We continue to supply parts for seven years after discontinuation of manufacture of products.

■ Skills:

• The development process is visualized and quantified by determining the procedures, tools, and skills to be used for it. To prevent unauthorized modifications, security procedures are put in place at design and manufacturing sites. Tools are used for the configuration management, etc. of interim products, which directly affects mounting. Checks are performed based on the quality assurance plan in quality checks and tests by the same division to manage the project.

■ Relationship with subcontractors:

• Security-related defects in externally procured hardware and software products are reduced by performing acceptance inspections.

■ Maintenance phase:

• We undertake maintenance for as long as our products are on the market. We continue to supply parts for seven years after discontinuation of manufacture of products.

• Our service division manages maintenance utilizing the database.
  Total maintenance and management is also achieved through the correction of defects by the service division.

■ Source code:

• The history of source code is managed and can be traced with a tool function.

■ Body firmware:

• The history of the versions of body firmware is managed based on specific rules.

■ Guidance and materials:

• Guidance and materials relating to all phases, from development to actual operation, are placed under configuration management with version codes assigned.

■ Lists of parts:

• The parts of each MFP model are placed under configuration management with part numbers assigned.

■ Drawings:

• Drawings of the parts of MFPs are placed under part-level configuration management on a drawing number basis.

■ TOE (Target of Evaluation):

• Parts are managed so that they can be identified from MFP bodies, the part number of PC boards, firmware, and guidance.

Security is strictly managed in terms of physical, procedural, human, network, and other aspects.

■ Physical aspect:

• Business offices, rooms used by people, and server rooms introduce physical management, such as access control by IC card authentication, biometric systems, etc.

■ Procedural aspect:

• Information management procedures concerning access control of ID cards and servers, the removal and disposal of documents, etc. are defined. Our plants perform not only part inspections in each manufacturing process but also finished product inspections. Inventories of parts are managed, and procedures take logistics between warehouses into consideration.

■ Human aspect:

• Konica Minolta manages staff through security training for personnel, including contractors, and security agreements with contractors.

■ Others:

• The development network and the Internet are kept separated, and measures are taken to protect PCs and servers from viruses.

■ MFPs and software:

• MFP bodies, in which software is installed at the plant, are packaged with special packing materials and delivered in such a manner that modifications can be detected and integrity can be maintained.

■ Software and guidance given separately:

• Software and guidance created by the development division are delivered with an electronic signature of the person in charge and by a method that maintains integrity.

■ Procedure for correcting defects:

• Information about possible security defects is collected from users and fed back to the sales division. The specific of causes and countermeasures are considered, and a team that includes the quality control and development divisions is set up to discuss and carry out measures against the defects. The status of taking action is compiled into a database and managed until the task is complete.