Risk of Business Interruption from Major ICT Incidents and Cyberattacks
First written in FY2020. 2 of 3 entries say "Advanced", first in FY2021. Latest entry: FY2023.
The whole theme swung hardest in 2020: 2 of 15 companies on the "Worse" side.
2 other companies' latest entry also says "Advanced".
- FY2023AdvancedAnnual report
「Zero major ICT incidents*1 / Strengthening ransomware countermeasures / Optimising the security incident operating process」
Measures for major ICT incidents were made concrete in an action plan including a target of zero incidents at the most severe level, ransomware countermeasures, and strengthened information-asset management and detection. - FY2021AdvancedAnnual report
「Our group’s “Rules for the Major ICT Incident Response Headquarters” and “Major ICT Incident Response Guidelines” establish common group-wide criteria for determining incident levels and response policies according to the incident level.」
The response to major ICT incident and cyberattack risks was made concrete through a response structure including group-wide decision criteria, a response headquarters, and reporting and explanations to stakeholders. - FY2020First statedAnnual report
「The businesses and operations of our group are heavily dependent on information systems. If a major ICT incident occurs, including a security or privacy breach or a decline in trust in our group caused by, or potentially caused by, an information-system failure, cyberattack, natural disaster or operational error, our group’s businesses may be significantly affected.」
Major ICT incidents caused by information-system failures, cyberattacks, natural disasters, operational errors and other factors were explicitly identified for the first time as an independent risk affecting the business, brand and reputation.