Business Interruption Risks Caused by Information Security Incidents and Natural Disasters
First written in FY2016. 3 of 7 entries say "Advanced", first in FY2023. Latest entry: FY2026.
Sojitz moved to the "Worse" side of this theme in 2019, 1 year before the typical company in this theme (2020).
The whole theme swung hardest in 2020: 25 of 59 companies on the "Worse" side.
8 other companies' latest entry also says "Advanced".
- FY2026AdvancedAnnual report
「Management recognizes cybersecurity risk as a material management risk and has established a management framework under which officers responsible for these matters, including the CISO (Chief Information Security Officer), are appointed.」
We established a management framework integrating information security and digital transformation, including coordination among the CISO, CDO and CIO, a policy for data connectivity across the supply chain, and Group-wide management of IT assets and vulnerabilities. - FY2025AdvancedAnnual report
「In fiscal 2025, we will also revise the IT Security Regulations, strengthen password complexity requirements and enhance account protection.」
In addition to rolling out security measures across the Group, we plan to revise the IT Security Regulations and strengthen password requirements. - FY2023AdvancedAnnual report
「From the current period, we have focused on strengthening security governance across the Group, rolling out throughout the Group security measures previously centered at headquarters, including centralized management of the Group's IT assets and vulnerabilities, software to detect cyberattacks at an early stage and contain their impact, and suspicious-email training.」
We rolled out information security measures previously centered at headquarters across the Group and advanced centralized management of IT assets and vulnerabilities, early-detection software and suspicious-email training. - FY2022MitigatedAnnual report
「From the current period, we established the position of Chief Information Security Officer (CISO) and strengthened our information security framework. In particular, during the current period, when remote work became established to a certain extent, we focused on security measures, including introducing software to detect cyberattacks at an early stage and contain their impact, and expanding suspicious-email training to domestic and overseas subsidiaries.」
We strengthened measures by appointing a CISO, introducing software for early detection, expanding suspicious-email training to domestic and overseas subsidiaries, and conducting security risk assessments. - FY2020MaterialisedAnnual report
「Natural disasters such as earthquakes, wind and flood damage, and large-scale outbreaks of infectious diseases could cause damage to offices, facilities, employees and their families, potentially affecting the Group directly or indirectly. With regard to the novel coronavirus disease, which spread globally, we have taken various measures based on government policies, action plans and requests, prioritizing the prevention of infection and its spread both inside and outside the company and the safety of Group employees and stakeholders.」
The infectious disease risk materialized in the form of COVID-19, requiring responses for the business, employees and stakeholders. - FY2019-Q3MaterialisedAnnual report
「Japan experienced temporary effects from natural disasters such as typhoons and earthquakes, but personal consumption remained firm and the economy achieved generally stable growth.」
The temporary effects of typhoons and earthquakes were reflected in actual economic conditions, demonstrating the emergence of business and economic impacts from natural disasters. - FY2016First statedAnnual report
「For critical information systems and network equipment, we have implemented measures to address failures, including equipment redundancy, and are working to strengthen measures against information leaks through measures such as preventing unauthorized external access with firewalls, implementing antivirus protection and adopting encryption technologies.」
Measures include system redundancy, firewalls, antivirus protection, encryption, BCP and disaster preparedness training.