Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough Compliance

Materiality 12

Society/LaborGovernance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

Strengthening Risk Management
Reason for Prioritization【Activity Policies】

Risk management, which involves accurately identifying risks and taking proactive measures to minimize their impact, is becoming
increasingly important as the risks surrounding companies, including increasing geopolitical risks, digital transformation, andclimate change, become more diverse.
In addition, necessary preparations and arrangements for contingencies such as pandemics, large-scale disasters such as anearthquake directly under the Tokyo metropolitan area or a massive Nankai megathrust earthquake, or international conflicts andwars, can help minimize damage and reduce risks.
Identifying various changing risks from a medium- to long-term perspective, and establishing countermeasures based on the
resulting impacts to the economy, environment, and society, will lead to sustainable corporate growth.

■ Nikon Group Information Security Policy■ Nikon Group Personal Information Protection Policy【Organizations】■ Risk Management Committee■ Quality Committee■ Export Control Committee

Commitment■ Compliance Committee

The risks facing companies are growing more diverse and complex due to the rapid evolution of technology and changes
in the global socioeconomic situation. Failure to respond to such risks appropriately could result in the loss of trust among
stakeholders such as customers and shareholders and may lead to damages that affect the continuity of a company. For thisreason, the development of an effective risk management system is becoming increasingly more important.
The Nikon Group conducts risk assessments every year, identifies important company-wide risks, analyzes and evaluates theserisks, and regularly monitors its own responses. In addition, to further enhance the effectiveness of risk response as a group, we
have strengthened our internal control promotion system and formulated Nikon Global Operating Standard that summarize
management directives for day-to-day operations to ensure sound and efficient management of business activities. We will
use those Nikon Global Operating Standard to establish an internal control improvement process. Furthermore, we continue
to develop a highly efficient and flexible Group governance system in order to improve our ability to respond to global risks,
while taking into account changes in management environments and business structures.

Takumi Odajima
Representative Director and Executive Vice President
CRO, General Manager of Group Governance & Administration Division* CRO: Chief Risk Management Officer

NIKON SUSTAINABILITY REPORT 2023

141

Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough Compliance● Fiscal Year 2022 Materiality Goals and Results
Goals for Fiscal Year 2030

What Nikon Needs to Do

Identification of current and future risks andimpacts, and utilization of the PDCA cycle toenhance and improve systems

Perform risk assessment and give instructions tomake improvements in relation to highrisk items

Avoidance of financial loss or damage to thecompanyʼs reputation through the soundoperation and management of IT infrastructure
and the implementation of cybersecurity andpersonal data protection measures

Strengthen the information security system(including cybersecurity and personal dataprotection)

Society/Labor

Governance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

Self-evaluation ○ : Achieved △ : Measures started but not yet achieved
RelatedSDGs

Scope

Goals for Fiscal Year 2022

Results for Fiscal Year 2022

Self-Evaluation

Nikon Group

Risk identification surveys. Sharing and understanding of risk
Conducted a risk identification survey, compiled measures to strengthen responses toawareness throughout the company, including the head officemajor risks, and reported to the Risk Management Committee held in March 2023
management and audit departments〇Nikon Group

Progressed as planned with measures to make the Nikon Group global network
Strengthen information security (cybersecurity, personal information
environment more secureprotection) systems and continuously comply with applicable laws
In addition, we took necessary measures to comply with the applicable personal
and regulations in each country.
information protection laws and regulations of each country○ーNIKON SUSTAINABILITY REPORT 2023

142

Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough ComplianceSociety/LaborGovernance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

Risk Management
Basic Approach

SystemThe Nikon Group has implemented a risk management
system in order to deal appropriately with all risks that may
have a significant impact on corporate management with theaim of sustainable growth for Nikon and Group companies.

To properly respond to risks that might critically impact
corporate management, the Nikon Group has set up the Risk
Management Committee. The Committee is chaired by theRepresentative Director and CRO and made up of Executive
Committee members, with the Administration Department
and Planning Section of Group Governance & AdministrationDivision serving as Secretariats. For the fiscal year 2022, thecommittee met twice, once in October 2022, and again inMarch 2023.
In order to respond more effectively to major risks, we haveestablished a system that enables continuous monitoring
and flexible support for priority target risks. In fiscal year 2023,
we plan to strengthen risk management by establishingprocesses to improve internal controls, developing an export
control system, and reviewing BCM.
The Risk Management Committee has jurisdiction over allrisks, but three committees under the Risk Management
Committee; the Quality Committee, the Export Review
Committee, and the Compliance Committee, are responsible
for handling risks that require specialized measures. From asustainability perspective, the Sustainability Committee also
monitors risks with a focus on materialities and addresses risks
related to the environment and social and labor.

Main Activity Themes of the Risk Management
Committee in the Fiscal Year 2022
・Progress & challenges for key

companies to be monitored

・Internal control-related (establishmentof internal control promotion system,
formulation of management standards)
・Conduct company-wide risk identification
survey for fiscal year 2022
・Report on results of litigation survey
・Information security compliancewith personal information protection
laws in various countries● Main Specialist Committees Involved in Risk

ManagementCommittees

Principal Risks

Risk Management CommitteeRisks

Quality Committee*

Quality

Export Control Committee*

Prevention of the Foreign Exchange Law
Violations and Security Risk Management

Compliance Committee*

Compliance

Sustainability Committee

Sustainability in general, especiallyenvironmental (climate change, chemicalmanagement, water, etc.), social and labor(human rights, etc.)

Bioethics Review Committee

Bioethics*Committees under the Risk Management Committee

NIKON SUSTAINABILITY REPORT 2023

143

Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough Compliance

Risk Assessment
The Nikon Group conducts risk identification surveys to gain
overall insight into the risks affecting the Group, including
risks such as regional conflicts and infectious diseases.
The survey results are reported to the Risk Management
Committee after being compiled into a risk map presenting
the scale of impacts and probability of occurrence. This survey
is administered to Nikon's general managers and above, as
well as presidents of Group companies in and outside Japan.
In fiscal year 2022, the risk classifications used in the Risk
Identification Survey Questionnaire were substantially revised
in line with the major risks from current economic, social, andenvironmental perspectives.
We will work with related divisions to develop a risk
management system to mitigate risks such as logistics
disruptions and supply chain disruptions caused by newcoronavirus infections and Russia's invasion of Ukraine, as wellas geopolitical risks such as the U.S.-China confrontation.

Related Information
Financial statements contain additional information
about business activity and other risks within analysis ofmanagement performance and financial conditions.
Consolidated Financial Results (for the Year Ended March31, 2023, P9 to P11)
https://www.nikon.com/company/ir/ir_library/result/pdf/2023/23_4qf_c_e.pdf

Society/Labor

Governance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

BCM*1 Activities Measures
The Nikon Group has formulated BCPs*2 in preparation
for large-scale disasters and other emergencies, including
pandemics, and reviews them every year.
In the aftermath of Russia's invasion of Ukraine in February2022, we conducted periodic situation checks with relevant
departments, particularly the Production Technology
Division and business units, to prepare for subsequent
contingency measures.
In response to the COVID-19 pandemic, the Company
made efforts to continue business activities while utilizing
telecommuting and remote work and taking company-wide
infection prevention measures.
The Nikon Group in Japan reviewed its emergency
communication tools and conducted various drills,
including communication drills that simulate disasters,in preparation for large-scale earthquakes such as one
occurring directly under the Tokyo metropolitan area or a
Nankai Megathrust Earthquake, both which are assumed tohave a high probability of occurrence. We also conducted
drills dealing with newly intensified natural disasters suchas typhoons and floods.
*1 Business Continuity Management (BCM)Management activities carried out in normal times, such as the formulation, updating andmaintenance of the BCP, implementation of proactive measures, education and training,checking and continual improvement.
*2 Business Continuity Plan (BCP)
A plan describing the policy, systems, and procedures, etc., by which corporations can avoid
suspension of critical business activities, or can restore critical business quickly if it is interrupted,
even when unforeseen contingencies arise, including natural disasters such as major
earthquakes, pandemics, etc.

Climate Change Risks Faced by the Nikon Group（➡ p.073）

NIKON SUSTAINABILITY REPORT 2023

144

Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough ComplianceSociety/LaborGovernance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

Risk Management for Information Assets and Cybersecurity
Information Assets Management Policy

Information Management System

At the Nikon Group, the management and security of
information assets is conducted in accordance with theNikon Group Information Security Policy. The Nikon Group
Information Management Rules and other internal rules havebeen established based on the Policy, to ensure optimaland efficient business conduct while properly protecting
information assets according to the circumstances in eachcountry and region. These rules are posted on the internal
portal site for employees to access anytime.

The Nikon Group has appointed the Representative Directorand President as the head of information management,
including personal information protection. We have alsoestablished operating processes in accordance with
Information Security Management Systems (ISMS). In
terms of systems operations, under the leadership of theRepresentative Director and Officer in charge of information
security, the Information Security Department carries out
management and supervision of activities across the entire
Nikon Group. This includes formulating measures regarding
information security, including responses to cyberattacks, aswell as developing and maintaining systems.
In addition, the head of each organization of Nikonʼs business
units, divisions, and the Group companies is designated asinformation managers. By working with the Information
Security Department, these individuals are helping to build
an information security management system compatible
with the situation in each country and region, while
comprehensively managing the entire Nikon Group. Material
matters involving information asset risks are reviewed by theRisk Management Committee, which includes members ofthe Executive Committee and others.
Nikon's healthcare business unit has obtained ISO 27001
certification, an internationally recognized standard for ISMS
(information security management system), for its researchand development of computational pathology and AI
assisted medical diagnosis, which requires particularly strict
information management.

Nikon Group Information Security Policy
https://www.nikon.com/company/sustainability/
governance/risk-management/security_policy.pdf

Response to Information
Security Incidents
When an information security incident occurs at the Nikon
Group, the site where the incident occurred is obligated toreport it immediately to the Information Security Department.
The Information Security Department works with relevant
departments to establish a system and procedures forminimizing damage and impact, and processes for promptly
resuming business. Serious cases are promptly reported to thedirector in charge by the Information Security Department. In
addition, members of the Information Security Department
participated in a training course on incident response
conducted by outside experts.
There have been no major information security incidents
involving the payment of fines or compensation in the past
three years.

* ISMS：Information Security Management System

NIKON SUSTAINABILITY REPORT 2023

145

Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough ComplianceSociety/LaborGovernance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

Information Security Education

Information Security Audit

Personal Information Protection

The Nikon Group conducts information security e-learning
education programs as part of new employee training,etc., in order to raise employee awareness and improve theeffectiveness of information security. Within this education
program, we include not only information about the policies
and rules related to information management, but also
provide specific examples as well.
In addition, the Nikon Group Information Security Handbook,an educational document that provides easy-to-understandexplanations of the information security measures that are
disseminated through internal regulations and bulletins, isposted on the portal site for all employees to refer to at anytime. This handbook is used in regular training to make surethat every one of the employees understands the importanceof information asset management and complies with therules with strong awareness.
In the fiscal year 2022, as in previous years, we designatedFebruary as Information Security Awareness Month, raisingawareness through in-house newsletters and conducting
an e-learning program for domestic Group companies.
Furthermore, we conducted orientation training for
employees hired regularly, which involved lectures andsessions facilitated by instructors. Group companies outside
Japan also conducted information security education
through e-learning or other methods as appropriate.
Through these training programs, we ensure that ouremployees are thoroughly familiar with information security.
In the unlikely event that an employee violates the relevant
rules and causes an incident such as information leakage, theemployee may be subject to disciplinary action in accordancewith the employment rules of the company to which theemployee belongs.

The Nikon Group periodically conducts internal audits
pursuant to the Nikon Group Information Management Rules
to improve the level of our information security.
In the fiscal year 2022, a paper-based audit was conducted
on all of the Nikon Groupʼs organizations (Nikon businessdepartments and Group companies) in Japan and onsite
audits were carried out on selected organizations based onmateriality themes. The results of these audits indicate there
were no significant risks. The Nikon Group plans to conduct
internal audits focusing on the presence of appropriate
information security measures in the fiscal year 2023.

The Nikon Group has established the Nikon Group Privacy
Protection Statement based on its respect for privacy andacknowledgment that processing personal data in a lawful
and proper manner is an important social responsibility.
Additionally, under this Statement, we established the Nikon
Group Personal Data Processing Rules as a common set ofrules covering the entire Group. We are now working tomake these rules known within the Group and ensuringthat personal data is handled in accordance with these rules
under the information management system.
Furthermore, we established the Personal Data Protection
Subcommittee under the Risk Management Committee
comprised of members from the Executive Committee
and other organizations. The subcommittee carries out risk
management concerning privacy and personal information
covering the entire Nikon Group.
Our specific initiatives include posting privacy notices on
the website of each Nikon Group company in accordancewith relevant laws and regulations, and notifying customersof contact information for support regarding privacy andindividual rights. This includes the purpose of use of personal
information and how to delete their personal information.
In addition, we request that procurement partners follow
the Nikon CSR Procurement Standards in order to maintain
information security, including privacy protection.

NIKON SUSTAINABILITY REPORT 2023

146

Contents/Editorial Policy

Message from the President

Nikon Group Profile

Nikon’s Sustainability

Business Activity

Environment＞ Thorough Compliance

Nikon Group Privacy Protection Statement
https://www.nikon.com/privacy/group/Privacy Notice of Nikon Europe B.V. in accordance withthe EU General Data Protection Regulation (GDPR)
https://www.nikon.ie/en_IE/footers/privacy_policy.page
Nikon CSR Procurement Standards
https://www.nikon.com/company/corporate/procurement/csr/

In fiscal year 2022, we promoted compliance with Thailand's
Personal Data Protection Act, posted privacy notices at groupcompanies in Thailand, and took other necessary actions.
With regard to the U.S., we have reviewed our privacy policyin accordance with the California Consumer Privacy Act. We
continuously collect information on legislation and revision
trends of personal information protection-related laws
and regulations in other countries and regions. In addition,
seminars on the Act on the Protection of Personal Information
were held to promote employee awareness.
In fiscal year 2023, we will continue to take necessary
actions in line with the enactment or revision of personal
information protection-related laws and regulations ineach country and region.

Society/Labor

Governance＞ Strengthening Corporate GovernanceCorporate Citizenship Activities＞ Strengthening Risk Management

Cybersecurity Infrastructure
Development andProcess Improvement
In order to maintain a high level of defense against
increasingly sophisticated and stealthy cyberattacks,
the Nikon Group is improving and strengthening its
operational system to collectively monitor and respondto cyberattacks on a global basis. This includes enhancing
early detection and early response capabilities. We are also
in the process of deploying a system to filter out phishingscams and other suspicious e-mails.
Furthermore, we continue to regularly improve our existing
operating processes. For example, we conduct periodic
checks on the vulnerability of our corporate website, which
could become an entry point for cyberattacks. We regularly
conduct training for designers on information securityrules during the product development process.

Privacy Notice of Nikon Europe B.V. in accordance with the EU General Data
Protection Regulation (GDPR) (excerpt)

Response to the Personal Information ProtectionLaws of Each Country
The Nikon Group complies with the personal information
protection laws of each country where it operates,
including the General Data Protection Regulation (GDPR) inthe EU. We are also working to develop a system to prevent
violations in order to achieve appropriate managementof personal information under an information security
management system.

NIKON SUSTAINABILITY REPORT 2023

147