Rebuilding the Information Security Framework in Response to the 7pay Incident
First written in FY2020. 3 of 4 entries say "Advanced", first in FY2021. Latest entry: FY2026.
No other company in this theme has enough history to compare yet.
- FY2026AdvancedAnnual report
「To prevent new risks such as information leaks and copyright infringement, guidelines for the use of generative AI were prepared. A generative AI office and a generative AI risk consultation desk were also established to create a response framework.」
The rebuilding of information security following 7pay expanded beyond the existing CSIRT, SOC and vulnerability assessments to include controls over the use of generative AI and a consultation framework. - FY2022AdvancedAnnual report
「The company will further strengthen security across the group under the Information Management Committee, continually review its systems in line with advances in digital technology, and ensure safety and security throughout the group.」
In addition to the oversight division, common policies, training and monitoring established after the 7pay incident, the company is proceeding with continuous group-wide reviews of information security under the Information Management Committee. - FY2021AdvancedAnnual report
「Specifically, the company established an information security division independent of business execution and directly under the Representative Director, rebuilt the “information security policies, guidelines and other measures” that serve as the group’s common foundation, and strengthened support for building security environments and monitoring at each operating company, as well as training and control evaluations.」
The rebuilding of information security following the 7pay incident progressed to the implementation phase, including an independent oversight division, common policies and guidelines, monitoring, training and control evaluations. - FY2020First statedAnnual report
「The factors behind the incident were that 7pay’s proprietary authentication system and other systems, as well as its measures to detect and prevent unauthorized access, were not necessarily adequate, and that security policy guidelines and other measures did not function sufficiently when the group was developing systems across its businesses. Taking this incident seriously, the company newly established the Group IT Strategy Promotion Headquarters, now the Group DX Strategy Headquarters, to rebuild the foundation of its digital strategy. It also established the Security Management Office as an organization directly under the President to oversee functions related to advancing the group’s digital strategy and raise the level of information security.」
Following the unauthorized access to 7pay, the company established the Group DX Strategy Headquarters and the Security Management Office directly under the President, and for the first time presented as a standalone initiative measures to rebuild the security foundation, including authentication, detection and guidelines.