Cybersecurity Attack and Information Leakage Risk
First written in FY2023. 2 of 4 entries say "Mitigated", first in FY2024. Latest entry: FY2026.
The whole theme swung hardest in 2024: 12 of 87 companies on the "Worse" side.
- FY2026MitigatedAnnual report
「We are also advancing measures to address the latest security threats, including completing the implementation of a zero-trust architecture as a security measure to block attackers' activities within the network.」
In addition to completing the implementation of a zero-trust architecture, we continue 24-hour, 365-day monitoring through CSIRT and SOC, as well as training and education. - FY2025AdvancedAnnual report
「We have also established a CSIRT (Computer Security Incident Response Team) as an organization responsible for responding to security incidents. We have established a 24-hour, 365-day monitoring framework through a SOC (Security Operation Center) and are strengthening our measures by working to enhance our resilience framework through virus analysis and multilayered defenses. To address the growing threats associated with cloud use and increasingly diverse working arrangements, we are promoting the implementation of a zero-trust architecture as a security measure designed to restrict attackers' freedom of movement within our network, while advancing other measures to address the latest security threats.」
Our response framework was made more specific, including a basic cybersecurity policy, CSIRT, SOC monitoring 24 hours a day, 365 days a year, zero trust and phishing email training. - FY2024MitigatedAnnual report
「As an organization responsible for responding to such incidents, we have established a CSIRT (Computer Security Incident Response Team). We have established a 24-hour, 365-day monitoring framework through a SOC (Security Operation Center) and are strengthening our measures by working to enhance our resilience framework through virus analysis and multilayered defenses.」
Cybersecurity measures were made more specific, including CSIRT and SOC monitoring 24 hours a day, 365 days a year, virus analysis, multilayered defenses and the promotion of zero-trust implementation. - FY2023First statedAnnual report
「Our Group uses various information systems to manage its business activities, as well as external connection tools such as email, and these information systems are exposed to the risk of cyberattacks, including computer viruses and unauthorized external access. If this results in system outages or failures, information leaks or unauthorized use, our Group's performance could be affected by costs associated with compensation claims, reputational damage and economic losses caused by disruption to business activities.」
Cyberattacks, unauthorized access, information leakage and unauthorized use were explicitly identified for the first time as separate key risks, with personnel and technical controls, education, training and assessments listed as response measures.