Cybersecurity Management Guidelines Ver 1.1

1.1. Background and positioning of Cybersecurity Management Guidelines......Page 6
1.2. Structure and use of the Guidelines......Page 9
(2) Comprehensive security measures are necessary covering the company itself, its group companies, business partners of its supply chain and IT system control outsourcing companies.......Page 10
(3) Companies need to communicate appropriately with relevant parties by, for example, disclosing information on security measures or response on regular basis or in times of emergency.......Page 11
3. Ten important items of cybersecurity management......Page 12
(1) Recognize a cybersecurity risk and develop company-wide measures.......Page 13
(2) Build a structure or process for cybersecurity risk management.......Page 14
(3) Determine goals and develop plans based on perception of a cybersecurity risk and security level that should be attained.......Page 15
(4) Publish cybersecurity measures framework (PDCA) and their actions.......Page 17
(5) Make sure as to how group companies and business partners of the company's supply chain take security measures.......Page 19
(6) Secure resource (budget, manpower etc.) to execute cybersecurity measures......Page 20
(7) Identify the scope of outsourcing for system control and ensure cybersecurity in the applicable outsourcing companies.......Page 21
(8) Collect information on cyber-attacks through participation in information sharing activities, and develop environment to utilize such information.......Page 22
(9) Develop emergency response system (emergency contacts and initial action manual, CSIRT - Computer Security Incident Response Team), and execute regular and hands-on drill.......Page 23
(10) Collect information regarding contacts after damage is confirmed, and gather information to be disclosed, and prepare materials for the management's accountability.......Page 24
Appendix A Check sheet of cybersecurity management......Page 25
Appendix B Recommended technical measures and reference documents (Note: These are examples as of now and subject to change in accordance with the change of environment or the status of each company.)......Page 28
Appendix C In relation to International Standard ISO/IEC 27001 and 27002......Page 35
Appendix D Definition of terms......Page 36