Strengthening Information Security Management through FISC, SOC, ISMS and Other Frameworks
First written in FY2023. 2 of 3 entries say "Advanced", first in FY2025. Latest entry: FY2026.
The whole theme swung hardest in 2019: 2 of 20 companies on the "Worse" side.
31 other companies' latest entry also says "Advanced".
- FY2026AdvancedAnnual report
「In addition, for management of cybersecurity and data security risks, the company has appointed a Chief Information Security Officer (CISO) as the second line of defense under the three-lines model. The CISO is appointed from among the directors responsible for the administrative divisions of the group in order to provide a counterbalancing role in relation to the business divisions.」
In addition to the existing FISC, SOC, ISMS, training and drills, the company explicitly disclosed a three-lines model with the CISO positioned in the second line and company-wide oversight by the Information Risk Management Committee. - FY2025AdvancedAnnual report
「Annual security knowledge assessment participation rate 100% 100% Information Risk Management Committee meetings Held weekly 51 meetings Security incident response drills — 1 Internal communications on security training topics — 12」
The company disclosed its security management operating results, including a 100% annual security knowledge assessment participation rate, 51 Information Risk Management Committee meetings, 1 incident response drill and 12 internal communications on training topics. - FY2023First statedAnnual report
「In addition to building robust infrastructure, including resilient servers, and developing systems compliant with the Safety Measures Standards for Information Systems of Financial Institutions (FISC Safety Measures Standards) to prevent financial systemic risks, the company conducts regular or ad hoc system audits through its Internal Audit Office. It has also obtained the internal control assessment reports SOC 1 Type 2 and SOC 2 (Security) Type 2 for solutions developed and provided by Simplex Inc., and provides customers with reports in which an audit firm attests to the transparency and security of outsourced operations.」
The company newly disclosed a systematic security framework combining compliance with the FISC Safety Measures Standards, regular and ad hoc system audits, SOC 1 Type 2 and SOC 2 Security Type 2 reports, ISMS certification, monthly training and annual testing.