Cyberattack and Information Leakage Risk
First written in FY2017. 4 of 7 entries say "Mitigated", first in FY2021. Latest entry: FY2026.
The whole theme swung hardest in 2022: 2 of 7 companies on the "Worse" side.
2 other companies' latest entry also says "Mitigated".
- FY2026MitigatedAnnual report
「Information security Security maturity aligned with the NIST CSF Improvement of at least 15%」
In addition to the existing Cybersecurity Committee and other structures, it has set a target of improving security maturity aligned with the NIST CSF by at least 15% by fiscal 2030. - FY2025RestatedAnnual report
「The Group has established a Cybersecurity Committee. To prepare for security risks, it continuously conducts risk assessments, prepares, implements and reports on countermeasure plans as a recurring process, strengthens Group-wide and global IT governance, and provides education and training tailored to employees' security levels to improve security literacy.」
It reconfirms information security measures involving the Cybersecurity Committee, risk assessments, countermeasure plans, and education and training. - FY2024MitigatedAnnual report
「The Group has established a Cybersecurity Committee. To prepare for security risks, it continuously conducts risk assessments, prepares, implements and reports on countermeasure plans as a recurring process, strengthens Group-wide and global IT governance, and provides education and training tailored to employees' security levels to improve security literacy. It has also established PSIRT, which implements measures for the Company's network products, and CSIRT, which implements measures for internal systems, as response organizations, including for security incidents, and maintains its preparedness during normal operations.」
In addition to the Cybersecurity Committee, it has established PSIRT and CSIRT, specifying a framework covering everything from risk assessment to incident response. - FY2023MitigatedAnnual report
「The Group has established a department responsible for information security and is working to build and strengthen company-wide IT governance. When an information security incident occurs, it collects information, brings the situation under control and prevents recurrence; during normal operations, it provides employee training.」
It specifies the establishment of a department responsible for information security, IT governance, incident response and employee training as countermeasures. - FY2022RestatedAnnual report
「The Group is strengthening its information security measures by introducing robust systems to respond to cyberattacks and by minimizing damage in the event of a computer virus infection. It is also working to raise employees' awareness of information security through employee training using e-learning.」
It reconfirms information security measures, including robust systems, damage mitigation and employee training through e-learning. - FY2021MitigatedAnnual report
「The Group is strengthening its information security measures by introducing robust systems to respond to cyberattacks and by minimizing damage in the event of a computer virus infection. It is also working to raise employees' awareness of information security through employee training using e-learning.」
For the risks of cyberattacks and information leaks, it additionally specifies the introduction of robust systems, damage mitigation and e-learning-based training as countermeasures. - FY2017First statedAnnual report
「However, if cyberattacks or computer viruses result in unauthorized access or information leaks, the resulting decline in confidence in the Group and claims for damages could affect the Group's performance.」
While maintaining systems for managing customer and personal information, it newly identifies cyberattacks, unauthorized access and information leaks as risks.