Contents

Introduction

Management

Social (S)Environment (E)Governance (G)Recognition / Assurance

Corporate Governance | Risk Management | BCP / BCM | Strict Compliance | Information Security | Tax Governance

Information Security
Basic Approach
Approach

PolicyWe control information security and cyber security across theGroup in the recognition that the appropriate and safe
management of information and systems necessary for ourbusiness is a significant managerial challenge for TOPPAN as
we grow as a leader in providing solutions to global social issues.
The threat of cyber-attacks has been mounting with theadvancement of the IoT and rapid digital transformation. These
attacks can result in the leakage of information assets, including
personal information or confidential information, and endanger
business continuity per se.
In keeping with the TOPPAN Group Basic Policy on
Information Security and the Personal Information Protection
Policy, we apply secure technologies and rigorous control in
operations throughout the Group to reciprocate the trust ofcustomers and society and drive a digital transformation thatenhances our corporate value. We have been introducing various
systems and tools to counter cyber-attacks and reinforcing
safeguards across the tightly secured areas designated for thehandling of personal information throughout Japan.

TOPPAN Group Basic Policy on Information
Security
As a group of companies operating in the information

communication industry, each of us at the TOPPAN Group
carries out Groupwide information security management in

the recognition that the management of information necessary
for business is a significant managerial challenge for us as ameans to reciprocate our customers’ trust and promote theongoing growth of the TOPPAN Group.

More details on the Personal Information Protection Policy

Promotion framework

The Director in charge of the Information Security Division has
been appointed as the Chief Information Security Officer(CISO) of the Group. The Information Security Division
practices information security governance on the technicalfront, while cross-functional specialist teams control cybersecurity by overseeing Group companies in cooperation with

1. We manage information necessary for our businessappropriately in observance of our in-house rules, the law,and the principles of social order.

outside expert organizations.

2. We collect information for appropriate purposes using
appropriate methods.

according to the instructions issued by the Information Security

3. We safely manage the information entrusted to us bycustomers in order to reciprocate our customers’ trust.
4. We are deeply aware of the risks to the information assets
we handle, such as illegal access, loss, damage, falsification/
manipulation, and leakage of information, and takenecessary and reasonable safety measures against theserisks. We deal with and rectify any problems that occur
promptly and in an appropriate manner.
5. We establish, operate, maintain, and continuously improveinformation security management systems.
Established on April 1, 2001
Revised on June 27, 2019 ore details on the TOPPAN Group Basic Policy on Information
M
Security
https://www.holdings.toppan.com/en/about-us/our-corporate-approach/securityinformation.html

Promotion Framework

Hideharu Maro
President & Representative Director
Toppan Inc.

In parallel, information security managers in Group
companies work to manage the safety of their organizations
Division.

Organizational Structure for Information Security
Management
President & Representative Director
Chief Information Security Officer (CISO)
Information Security Division
TOPPAN-CERT

SOC(Computer Emergency
Response Team)(Security Operation
Center)Meetings of information security representatives
Information security meetings for related companies

Advisory body
Information Security Council

Group companies

https://www.holdings.toppan.com/en/privacy.html

Information security managers
Support members

148

Sustainability Report 2023

Outsideorganizations

Contents

Introduction

Management

Social (S)Environment (E)Governance (G)Recognition / Assurance

Corporate Governance | Risk Management | BCP / BCM | Strict Compliance | Information Security | Tax Governance

Information Security Management
Structure
Promotion framework

Information Security Management

established based on the ISO/IEC 27000 standard for
information security management systems (ISMS) and comply
with the JIS Q 15000 standard for personal information
protection management systems (PMS).
We strive to enhance security governance throughout theJapan’s Amended Act on Personal Information
Protection
Our rules on information security management related to thehandling of personal information have been revised to ensure

global Group by better responding to emerging requirements incompliance with the amended Act on the Protection of Personal

Under the Chief Information Security Officer (CISO), theareas such as cyber security, the use of data, the IoT, andInformation enforced in Japan in April 2022. We have also set

Information Security Division formulates a Groupwide information

globalization. We are upgrading the quality of security control atup procedures for handling personal information andsecurity plan, sets up rules and regulations, and disseminates andGroup companies by assessing the levels of control once a year

anonymously processed information, notifying individuals whenreviews them. The division convenes regular meetings with

with a set of baseline standards for evaluating conformance with

their information is provided to third parties outside of Japan,

members from Group companies to share the details of our

the TOPPAN Group Basic Rules on Information Security.

and submitting incident reports whenever necessary. The

information security policies and measures underway.

Improvement plans in place at Group companies, as well asprocedures are closely modeled after the guidelines announced

their implementation, are duly monitored.

by the Personal Information Protection Commission of Japan.

The Information Security Division also carries out regular
audits of Group companies to check the quality of their security
control and recommend corrective measures as necessary.
The results of these activities are regularly reported to the
CISO. When a security incident arises, the division promptly
initiates a response to the incident and reports the present status
to the CISO, as required.

Arranging Remote Working Environments

Information Security Policies and Rules
Policy andRules atthe TOPPAN
Group
Policies andRules atGroup
Companies

TOPPAN Group Basic Policy on Information Security
TOPPAN Group Basic Rules on Information Security+ Baseline standards
Personal information protection policies at Group companies
Rules and bylaws on information security at Group companies

Overseas Legislation on Privacy and Personal
Information
With the growing awareness of the importance of privacy andpersonal information, laws and regulations to protect them havebeen introduced around the world. We are taking appropriate
measures to comply with these laws and regulations bycollecting information and conducting surveys on the relevant

We have reviewed our information security rules for remotelegislation in the countries and regions where Group companies

working and formulated standards for the use of communication

do business.

tools to ensure safe working environments outside of the office.
A system has been introduced to enable employees to promptly
report suspicious incoming emails and virus-infection incidents
while working from remote locations.

Complying with Laws andRegulations

PrivacyMark Accreditation and ISMS Certificationin Japan

Activity results, performance data

Information security systems within domestic Group companies

audits and audits of various other types to confirm information

We comply with laws and regulations related to privacy,

have received PrivacyMark accreditation and information

security management throughout the Group.

confidentiality, and the protection of personal information notsecurity management system (ISMS) certification.

Remote approaches have also been adopted for internal

only in Japan, but in all of the countries where Group companies

Enhancing Security Governance

We are formulating in-house rules, building environments,
and training personnel in charge of information security tooperate.

secure the handling of important information received from
customers, personal or otherwise.

Our rules on information security governance have been

149

Sustainability Report 2023

Contents

Introduction

Management

Social (S)Environment (E)Governance (G)Recognition / Assurance

Corporate Governance | Risk Management | BCP / BCM | Strict Compliance | Information Security | Tax GovernanceJapan’s Individual Identification Number System

We found no instances of unauthorized information
removal or other personal information-related incidents in fiscal

New requirements for security control measures have been

2022. Strict efforts to maintain our record of zero-incidents

added to our in-house standards for tightly secured areas inacross the Group will continue.

government’s Personal Information Protection Commission.

other devices that record or communicate images, videos, audio,(as of March 31, 2023)

personal information, such as the handling of individual

Kansai (17 areas)

identification numbers under Japan’s Social Security and Tax

Chugoku &Shikoku (8 areas)of our client companies.

Lockers and secure storage compartments for personal
are not allowed to bring in cameras, cell phones, smartphones, orTightly Secured Areas in Japan
Hokkaido(12 areas*)

These security measures cover operations involving specific

Number System and the collection of those numbers on behalf

or more persons at the same time.
belongings are provided outside of the areas, as persons entering

accordance with the guidelines for the proper handling ofspecific personal information issued by the Japaneseauthentication measures and controls to inhibit the entry of two

Higashinihon(10 areas)

Kyushu (9 areas)

Kanto (104 areas)

Rooms dedicated to the handling of these personal

Chubu (6 areas)

identification numbers have been set up, and a special team

*Numbers of secured areas for the handlingof personal information

carries out accreditation audits on operations performed

or any other form of data.
Area control: Surveillance cameras eliminate blind spots in thetightly secured areas and monitor any unauthorized removal ortransport of data.
Device control: As a basic rule, we prohibit employees fromconnecting any external storage media to devices used within thetightly secured areas. We also deploy a two-factor authentication
login system requiring the submission of an ID, a password, andtherein.

Controlling the Tightly Secured Areas

Protecting Personal Information andConfidential Information
Activity results, performance data

Setting up Tightly Secured Areas

one or more additional factors for entry into a secured area.
Our monitoring center operates a log management system to

We constantly upgrade security levels for the handling ofcarry out operational log analysis. Whenever a potentiallypersonal information and confidential information throughfraudulent log isregular internal audits and day-to-day operational checks based

detected in theon the rules for managing the tightly secured areas within thestored data, theGroup. The key security management measures are described

center immediately

below.

notifies the relevant

Our operations involving the use of confidential materials aremanagement

conducted exclusively within workplaces that are tightly secured

Operational management inspection through internal audits:

personnel forby access controls and other security measures in a closed

Dedicated auditors regularly inspect the installation,verification.

network environment, in order to minimize the risk of fraudulent

management, and operation of tightly secured areas. The

acts and other forms of misconduct inside of the Group and thefindings of inspections are assessed and accredited to maintainrisk of unauthorized access from outside of the Group. Strictly

and further enhance operational management levels across thecontrolled operations include the handling of personalGroup.

SurveillancecameraAccess control

Controlling Security across the Supply Chain
Some of our operations that involve the handling of personal

information (e.g., individual identification numbers underinformation and confidential information are entrusted to Group

Japan’s Social Security and Tax Number System) and theAccess control: Each tightly secured area is protected byand partner companies. We also rely on the cloud services of

production and handling of security printing products withtechnical safeguards to prevent unauthorized persons fromexternal companies in the execution of some of our businessmonetary value.

entering. The safeguards consist mainly of personal

operations.

150

Sustainability Report 2023

Contents

Introduction

Management

Social (S)Environment (E)Governance (G)Recognition / Assurance

Corporate Governance | Risk Management | BCP / BCM | Strict Compliance | Information Security | Tax Governance

We mitigate supply chain risks by checking the safety ofcloud services and deploying a system to certify business

Using a CASB Service to Mitigate Cloud-usage Risks

sessions for employees not only in the development
departments, but also the sales and sales-promotion

partners who take appropriate security measures. The control

The growing usage of cloud services is driving up the amount of

departments, to ensure website security from the planning andlevels required of business partners to satisfy the security

important information handled by cloud-based applications.

design stages.

standards under our certification system depend on the types ofSince fiscal 2020 we have been using a Cloud Access Security

information and operations entrusted to them.

Broker (CASB) service that visualizes and controls computer
usage in cloud environments. CASB enhances the safety ofManaging Information Assets in Internal Operations
Information assets handled in internal operations are classified

cloud-service usage by identifying risks associated with

Cyber threats have been escalating across borders. Their

individual cloud services and detecting and restricting cloud

unprecedented malice and technical cunning can result inusage subject to unduly high risk.

instant and severe damage in all directions. In many instances,the conventional methods used against cyber-attacks areby confidentiality. Our rules governing storage, removal,
disclosure, etc. ensure the safe handling of information assets inline with their classifications.

Countering Cyber-attacks
Activity results, performance data

Cyber-attacks pose especially significant security risks to theGroup. We have been implementing various measures tomitigate them.

Protecting PCs and Servers with the EDR Application
In fiscal 2019 we began installing Endpoint Detection andResponse (EDR), an application that detects suspicious software
behaviors in PCs and servers. The EDR application is now
installed in PCs used for administrative work, terminals used
onsite in production settings, and on the Apple computers andnetwork servers running across the Group. The combined use of
the application with data such as network logs further solidifies
our information security system to ensure prompt detection anddefensive action against sophisticated malware whenever athreat emerges.

Formulating Guidelines to Address Cyber Emergencies

Implementing Threat Intelligence and OSINT Activities

useless.

We continue to implement threat intelligence, third-party

basic approach, preparations, and action flows to address

evaluations, and Open Source Intelligence (OSINT) activities toserious information security incidents caused by cyber-attacks

uncover signs of cyber-attacks against the Group and detectand other destructive acts. We are constantly strengthening ourvulnerabilities visible to outside parties early on. We strive to

responsiveness to cyber emergencies on the assumption thatmitigate cyber-attack risks by addressing weaknesses detected

unforeseen incidents can always happen.

We have formulated a set of guidelines that summarize our

within the Group before attacks can occur.
We are enhancing cyber security throughout the supply
chain. Business partners entrusted with operations involving theCountering Email Attacks

handling of personal and confidential information have been

Cyber-threats continue to grow with the return of the malicious

subject to our vulnerability-detection measures since fiscal 2022.

botnet Emotet and the rising frequency of fraudulent emails andbusiness email compromise (BEC) crimes, where a cyber-

Upgrading Website Vulnerability Assessments

criminal sends an email that appears to come from a familiar

Weaknesses in our web applications have been assessed to

specific information. In fiscal 2022 we added another tool tocounter cyber-attacks targeting website vulnerabilities. An

combat these threats by introducing an advanced service that

automatic vulnerability detection system is now installed toscreens incoming emails with help from AI analysis andperiodically check the network and address vulnerabilities thatmachine learning algorithms. This service blocks a highbecome apparent from day to day. This monitoring system works

percentage of targeted email attempts to steal money, exploit

synergistically with various external vulnerability-detection

information, or compromise networks in other ways. We will

services to further solidify our web-based services and reinforce

continue shoring up our systems to resist email attacks

our ability to provide clients with more tightly secured services.

throughout the Group by providing this screening service to

In fiscal 2022 we began organizing vulnerability training

151

business acquaintance with the intent of stealing money ormore of our Group companies from fiscal 2023 onward.
Sustainability Report 2023

Contents

Introduction

Management

Social (S)Environment (E)Governance (G)Recognition / Assurance

Corporate Governance | Risk Management | BCP / BCM | Strict Compliance | Information Security | Tax Governance

Enhancing the Capabilities of TOPPAN-CERTTOPPAN-CERT is a specialized cyber response team made upof specialists from across the Group. In December 2022 theteam participated in a series of collaborative cross-sector drillsorganized by the Nippon CSIRT Association (NCA) and the
National center of Incident readiness and Strategy for
Cybersecurity (NISC). CERT members took the lead in
responding to simulated cyber-attacks targeting the TOPPANISMS Certification (ISO/IEC 27001) for
Information Security Management Systems

ISMS Certification (ISO/IEC 27017) for Cloud
Security Management

Information & Communication Division (ToppanInc.); Business Platform Department (Digital
Innovation Division, Toppan Inc.); Technical
Department (Integration Business Center, DX
Design Division, Toppan Inc.); Toppan
Communication Products Co., Ltd.; Toppan
Graphic Communications Co., Ltd.; TGS Inc.; TB
Next Communications Co., Ltd.

Team 3 (Development Department I, ICT
Development Center, DX Design Division,
Toppan Inc.)
IC06J0151

PrivacyMark Accreditations (JIS Q 15001:2017)

Group. Response procedures during the drills were reviewed to

TOPPAN Group Kansai Business Center(TOPPAN Edge Inc.)JQA-IM0137

pinpoint weaknesses in our counter capabilities and clarify the

Toppan Infomedia Co., Ltd.

JUSE-IR-404

improvements that can best enhance the handling of a cyber-

Asaka Plant and Shiga Plant (Toppan Inc.);
Semiconductor photomask operations (Asaka
Plant and Shiga Plant, Toppan Electronics
Products Co., Ltd.); Design, development,
commissioned manufacture, and management of
products related to semiconductors (Toppan
Technical Design Center Co., Ltd.)IS 530416

ONE COMPATH Co., Ltd.

IS 533218

attack.

Sharing Information on Cyber Security Preparedness
We hold quarterly cyber-security information-sharing sessions
for personnel involved in information security management toheighten the understanding of cyber security preparedness
within and outside of the Group.

Acquiring Third-party
Certification
Activity results, performance data

Toppan Inc. and Group companies have acquired ISO/IEC
27001 certification for information security management
systems (ISMS), PrivacyMark accreditations under JapaneseIndustrial Standards (JIS) Q 15001:2017 for personal

Kyushu, Chugoku & Shikoku Team and ISMS
Promotion Committee (Information Security
Management, Nishinihon Division, Toppan Inc.)

I308

Kansai Production Department (Toppan Graphic
Communications Co., Ltd.)IC13J0361

Higashinihon Division (Toppan Inc.)

IS 606897

Takino Plant (Toppan Communication Products
Co., Ltd.); Takino Information & Communication
Production Engineering Team (Kansai
Technology, Kansai Subdivision, Toppan Inc.)
Secure BPO Team (Chubu Division, ToppanInc.); Chubu Production Department (Toppan
Graphic Communications Co., Ltd.); Nagoya
Plant (Toppan Communication Products Co.,Ltd.)
One undisclosed entity

information protection management systems (PMS), and otherthird-party certifications, as shown in the following tables (as ofJune 30, 2023).

152

SC22J0025

IC14J0376

IC17J0444

Toppan Inc.

10190891

Toppan Communication Products Co., Ltd.

24000216

Toppan Graphic Communications Co., Ltd.

10190298

Toppan Editorial Communications Co., Ltd.

24000308

Toppan Logistics Co., Ltd.

10450006

Toppan Travel Service Corp.

10450093

TOPPAN Edge Inc.

10190934

Toppan Forms Central Products Co., Ltd.

24000366

Toppan Forms Tokai Co., Ltd.

24000204

Toppan Forms Kansai Co., Ltd.

24000101

Toppan Forms Nishinihon Co., Ltd.

18860028

TOPPAN Edge IT Solutions Inc.

10820089

TOPPAN Edge Services Inc.

10450002

Toppan Forms (Hokkaido) Co., Ltd.

10190307TOSCO Corp.

11820447

J-SCube Inc.

10860018

Tosho Printing Co., Ltd.

24000032

Tokyo Shoseki Co., Ltd.

10190966

Livretech Co., Ltd.

10190035

Tokyo Logistics Co., Ltd.

10860071

EduFront Learning Research Co., Ltd.

10861827

Froebel-Kan Co., Ltd.

24000369

BookLive Co., Ltd.

28000007

T.M.G. Challenged Plus Toppan Co., Ltd.

24000419

ONE COMPATH Co., Ltd.

24000445

Toppan Cosmo, Inc.

24000449

UNIWORX Co., Ltd.

21004696

Kirihara Shoten K.K.

24000459

TB Next Communications Co., Ltd.

24000464

Sustainability Report 2023

Contents

Introduction

Management

Social (S)Environment (E)Governance (G)Recognition / Assurance

Corporate Governance | Risk Management | BCP / BCM | Strict Compliance | Information Security | Tax Governance

Information Security Training
Training, education

Our extensive training and self-assessment initiatives are
grounded in the belief that solidified human assets reinforce ourinformation security management structure.

challenges for senior managers in order to fortify their control

asked to participate in the drills in parallel with employees fromcapabilities during cyber emergencies.

domestic subsidiaries and affiliated companies, expanding thecoverage to about 50,000 persons in total.

Implementing Groupwide Self-assessment

The training was demanding. Our cyber security team sentout a fraudulent email to employees without pre-warning. Some

We are asking all Group employees to check their daily security

employees clicked a URL link to a fraudulent website, failing topractices. Our Groupwide self-assessment initiative aims torecognize it was fake.

Training Employees throughout the Groupheighten awareness on information security management by

Annual training is organized to improve the security capabilities

Self-assessment results are delivered to each department toof all Group employees. In fiscal 2022 we established a program

enable the department managers to initiate improvement

We have founded Armoris Co., Ltd., a company specialized inentitled, “Surfing on the changing currents: Groupwide counter-measures at their workplaces.

providing client companies and public-sector entities with

attack on information security threats in cyber and physicalencouraging employees to reflect on their own behaviors.

Several questions were added to the fiscal 2022

Providing DOJO Training for Cyber Security Specialists

programs to nurture cyber security specialists, as well as services

worlds.” The training covers comprehensive topics, from cyber-questionnaire to remind employees accustomed to remote

geared to improving the security levels of their organizations.

attack preparedness and daily security practices to business-working of the appropriate procedures for the handling of media

Armoris operates a series of practical personnel-training

division-specific risks and compliance with Japan’s amended Act

and documents that contain confidential information. The

programs, including DOJO, DOJO Lite, DOJO Shot, and DOJO

on the Protection of Personal Information.

questions are continuously updated to reinforce individual

CORE.

security readiness in the latest working environments.

Organizing Security Training for Plant Engineers
We launched a program called the “technical-guard training

The training programs at the DOJO are tailored to individual
skills through methods suited to long-term, continual practices.

Developing a Security Training Platform

DOJO Lite and DOJO Shot, meanwhile, arrange case examples
and case studies examining the latest cyber security themes.

school” in fiscal 2021. This program aims to achieve

TOPPAN Security Awareness Training (TSAT) has been

DOJO CORE provides practical simulation drills on responding

manufacturing DX with solidly secured production sites.

formulated as a security-training platform since fiscal 2022. TSAT

to actual incidents. Armoris strives to enhance the security

Trainees learn the requirements of the safeguards deployed toallows employees to repeat the steps of drill, evaluation, andcapabilities of individuals and organizations throughout Japan,

protect manufacturing equipment during the processes fromtraining. Human asset solidification through this efficient

including the TOPPAN Group, through the DOJO programs.

installation planning to disposal. Twenty employees completed

platform reinforces cyber-attack resistance throughout the Group.

the program in fiscal 2022.

Holding Drills to Address Virus-infected Emails
Alerting Senior Management to Cyber Emergencies

We hold suspicious email reporting drills twice a year. To

Our senior management takes part in drills twice a year toprepare for the drills, users of Group email addresses (about

rehearse the actions to take in the event of a severe cyber-attack.

25,000 persons in total) are requested to add a shortcut link or

The drills are designed to better equip them with the leadership

icon that can be quickly clicked on their standing screens toskills essential to control cyber emergencies.

report suspicious messages they have received or already

After each drill we evaluate the results and identify

opened. In fiscal 2022 overseas subsidiary employees were

153

Overview of Armoris’s DOJO service (in Japanese)
Sustainability Report 2023