Guidelines establishing security measures for critical infrastructure have been published and will take effect on 1 October 2026. The standards for the 16 sectors covered and future implementation trends are explained.
Based on the amended 2025 Basic Act on Cybersecurity, the government published the Guidelines for Establishing Safety Standards, etc. Relating to Cybersecurity of Critical Infrastructure on 11 September 2026. Although the guidelines are not legally binding, they reportedly set out specific measures, relevant laws and regulations, and management responsibilities for each of the 16 critical infrastructure sectors covered.
The guidelines cover 16 sectors: information and communications, finance, aviation, airports, railways, electricity, gas, administrative services, healthcare, water supply, logistics, chemicals, credit cards, petroleum, ports and postal services. They reportedly emphasize defense in depth based on external connectivity and the concept of cyber resilience.
They also set out a policy to begin operating the SCS assessment system around the end of fiscal 2026. Requirements for visibility into supply chain management, including critical infrastructure operators, as well as contractual and audit requirements, are expected.
The guidelines also introduce specific measures such as adopting phishing-resistant authentication methods and Cybertrust’s Device ID to strengthen device authentication. Authentication measures for critical infrastructure are expected to advance.