INFORMATION SECURITY REPORT

1Information Security Report

KIRIN HOLDINGS COMPANY, LIMITEDINFORMATION SECURITY REPORTFor information security that goes from “supporting thecompany” to “leading the business”
We are leading the Group’s information strategies through information systemgovernance, by integrating the information system functions (people, goods, andmoney) of the entire group and being involved in the entire IT lifecycle from IT strategy
development to implementation of projects.

Information Security Basic Policy

Structure of Information Security
Regulations

Under this Policy, rules are established regarding
information security and information is managed
appropriately.
Rules are also revised as and when appropriate inaccordance with changes in the internal and external
environment, to maintain our security standards
without security operations becoming outdated.

•

Establishment, implementation, and sustainableimprovement of the information security
management system•

Implementation of education•

Business sustainability management•

Compliance with laws and regulations, rules, andcontractual requirements

As businesses have become increasingly dependenton IT and IT-related incidents are becoming risks
that threaten the very existence of those businesses,
as a company, we believe that it is important, forthe development of our businesses, to explain theactions we are taking against such risks through ourInformation Security Report.

■Privacy Policy
http://www.kirinbs.co.jp/privacy2.html*Some of our group companies have established their own separate
Privacy Policies.
■Websitehttps://www.kirinholdings.co.jp/

We hope that, by proactively releasing this Information
Security Report, we will gain the trust of ourcustomers, which will lead to the healthy developmentof the industry as a whole.

■Period Covered by this Report
This report covers actions and initiatives related to information
security between January and December 2019.
■Companies Covered by this Report
This report covers all Group companies, but not all of the actions andinitiatives described in the report were taken at all companies.

Information Security Report

2

CONTENT

3

Information Security Governance

6

Information Security Framework

8

Framework for Responding
to Information Security Incidents

10

Information Security Risks

11

Information Security Measures

15

Information Security-related
Human Resources Development

19

Information Security Track Records

24

Information Security ReportThis booklet is a compilation of the information security
reports of the entire Kirin Group, with reference to the
Information Security Report Model issued by the Ministryof Economy, Trade and Industry.

Information Security Report4Our aim is to raise awareness among
employees by establishing our own
rules for Kirin Group businesses.

5

Information Security Report

INFORMATION SECURITY GOVERNANCE
The Kirin Group aims to raise awareness among our employees by establishing theKirin Group businesses’ own rules, based on the policy and regulations, as well as
general information security rules.

Information Security Guidelines

Instruction Manuals

We endeavor to provide guidelines that will suitthe circumstances of each group company, by
preparing a range of manuals for employees basedon the Information Security Regulations.

The Kirin Group has prepared these manuals
on the basis of our policy and regulations andin accordance with the Kirin Group businesses’
original rules. They are updated as necessary,
based on reviews by an independent consulting
company and feedback regarding problems
with e-learning programs, to ensure that
common viewpoints are incorporated.

Structure of Information Security Regulations

Information Security
Regulations

Information Security
Rules

Detailed Rules of Kirin Group
System Management
Organizational Framework and Role
Manuals Regarding Information Assets[Human Security] Manual

Instruction Manual for
Information Asset[Physical Security] Manual[System Security] Manual

Kirin Group Information
Security Guidelines

Information Security Report6We oversee and advise
Group companies for the
improvement of the information
security of the Kirin Group.

Covering the Entire Kirin Group
Established in accordance with international
standards, the Kirin Group Information
Security Regulations stipulate basic
approaches, measures, and management
methods related to information security
across the entire Kirin Group.
Simultaneously, Information Security
Guidelines have also been established foroverseas Group companies, and the various
Group companies overseas are making
efforts to raise their employees’ awareness of
information management and improve theirrelevant skills through e-learning and otherregular training programs for all employees ofoverseas Group companies.

As a new initiative, we are also working
progressively on the strengthening ofindividual authentication and entry/exit
controls.
It is with initiatives such as these that the
Kirin Group is pursuing the reinforcement of
information security.

Information Security Framework Chart
Group Risk and Compliance Committee

Information Security Management Division

Operating Companies (Japan, Overseas)

Shared Function Companies

Information Security Executive Officer

Information Security Executive Officer

Member Companies (Japan, overseas)
Information Security Executive Officer

7

Information Security Report*The operating companies oversee and instructmember companies regarding information security.

INFORMATION SECURITY FRAMEWORKIn the Kirin Group, Kirin Business System Company, a shared function company inthe area of IT, has been positioned as the division for the oversight and promotion of
information security improvements for the entire Group. This company supervises andadvises Group companies to improve information security in the Kirin Group.

Important Risk Determination Framework
Individual Group companies identify and consider risks that are peculiar to their respective businesses from both
qualitative and quantitative aspects, based on the Kirin Group’s Risk Management Policy.
The Group Risk and Compliance Committee secretariat (Corporate Planning Department of Kirin Holdings Company)
collects and scrutinizes these risks. The Group Risk and Compliance Committee then examines those risks that would
have a large impact or a high probability of incidence or that are common to the entire Group and determines them to be
critical risks for the Group.

Risk Determination Process
Determination of critical risks

Risk Management Policy
Identify and consider risks peculiar toeach group company (individual companies)

Identify and consider risks for the entire Group(Kirin Holdings)

Along with the risks identified by the individual group companies, Kirin Holdings adds a whole-group perspective and,making qualitative and quantitative assessments of critical risks to the Group.
Determination of critical risks for the Group by Group Risk and Compliance Committee

Information Security Report8

Information Security Governance Framework
In addition to clarifying the frameworks for initiatives regarding information security measures and reducing the risks ofleaks of information assets, we will respond to external threats against information security and enhance effectivenessof information security measures.

Governance Framework
Executive Officer incharge of Information
Strategy

Approval
Instruction

Information System
Division∙ Approve plans for measures∙ Identify information security risks
ReportPlanning/
Monitoring
Training andinstruction

Individual locations
Implementation of(responsible executives and officers)
Measures/Maintenance
Head Office, sales locations,and Management
plants, laboratories, groupcompanies in Japan, etc.

∙ Plan and implement measures (develop training, regulations, manuals, etc.)∙ Identify systems and devices to be introduced based on individual
locations’ decisions∙ Instruct individual locations to undertake responses such assuspension of use and status reports∙ Monitor state of responses

Report∙ Implement measures, collect implementation status at individual
locations∙ Undertake maintenance and management, compile status ofmaintenance and management at individual locations∙ Confirm status of use, report outcomes

Information Security Promotion Framework
Information security promotion staff will play the central role in the promotion of
information security.
Appointment of Information Security Executive Officer•

The Information Security Executive Officer, who has been given authority by the President, will have responsibility
for the building and maintenance of frameworks in each company and the appropriate handling and managementof information assets.

•

Selection of information security Managers/Officers/promotion Staff•

Information security Managers, etc., will be appointed at each plant, business location, and Head Office division.
(However, depending on the size of the business, these roles may be held concurrently with other positions.)

Information Security Organization Framework Covering All Employees[Head Office]Company President [Information Security Executive Officer][Individual Plants]
Information security Manager
Information security Supervisor
Information security promotion Staff

9

Information Security Report[Head Office Divisions]
Information security Manager
Information security Supervisor
Information security promotion Staff[Business Locations]
Information security Manager
Information security Supervisor
Information security promotion Staff

Framework for Responding to Information Security Incidents
The Kirin Group is addressing information security measures, which is a critical riskin the Group, through the establishment of KIRIN-CSIRT (Computer Security Incident
Response Team), to respond to accelerating threats of cyber-attacks.

KIRIN-CSIRTKIRIN-CSIRT strives to bolster responses against threats of cyber-attacks, such as viruses and unauthorized accessfrom outside, through the establishment of security response frameworks in the Group and the implementation ofhuman, physical, and technical measures.

Objective

Cooperation with Relevant Sections

This initiative is effective in allowing the Group to
implement speedy, structured responses in the event of asecurity incident. KIRIN-CSIRT is establishing frameworks
for responding to security risks.

KIRIN-CSIRT has been established with the cooperationof the Group Risk and Compliance Committee secretariat,
IR Office, CSV Strategy Department, Legal Department,
and CC Department.

KIRIN-CSIRT Framework

President

Kirin Business System
Kirin Holdings
IT Planning
Department Cooperation

Group Risk and Compliance Committee Secretariat
Corporate Planning
Department

Legal
Department

Cooperation

KIRIN-CSIRT

Personnel and General
CC Department
Affairs Department

Cooperation

Individual groupcompanies

Outsourcing

Outside expert
companies
Forensic
Information
Gathering
Vulnerability
Diagnosis

What is CSIRT (Computer Security Incident Response Team)?
CSIRT is a collective term for the organizations that take action when a (predominantly security-related) problem
occurs on computers or networks (particularly the Internet).

Information Security Report10Information Security Risks
If a person uses an information asset without understanding the scope of disclosureand degree of importance of the information, there is no guarantee that the user will not
divulge information to others to whom it must not be disclosed.
The Kirin Group implements appropriate management regarding the following information.

Information Management
Companies possess a range of important information, including management information, sales information,technology information, and personal information.
Information assets are divided into categories based on the composition of the assets and managed appropriately.

Information Management Based on Confidentiality Category•

Particularly important information assets that only extremely limited personnel within thecompany may know•

Information assets that only limited personnel within the company may know•

Information assets that any personnel within the company (limited group companies in certain
circumstances) may know•

Public information that any personnel within the company or external party may know

Destruction
Rules for destruction of data are established and managed in accordance with themedium of the data.
Destruction/Deletion

Method- Printed materials [paper] are destroyed by methods such as shredding and dissolving
Printed materials [paper] - Caution is exercised in management until the materials are dissolved.
- Caution is exercised in management and storage of security boxes, storage boxes, etc.
External recording media - External recording media such as floppy disks, CDs, and DVDs are physically destroyed.
Electronic data

- All electronic data subject to destruction, including backup data, is deleted

Personal computers- All data stored on hard disk must be thoroughly deleted, using specialist data erasuresoftware. Alternatively, the recording device (hard disk) itself is physically destroyed.

Management at times of employment, resignation, and employment changes
The following matters concerning confidentiality are included in a written
pledge or the employment agreement.
•

Important information that employees could have gained knowledge of in the courseof their duties is specified and the employees are asked to confirm their duty ofconfidentiality at the time of their resignation or dismissal.

•

Information that employees could have gained knowledge of during theiremployment must not be disclosed to competitor companies.

•

Information that employees could have gained knowledge of in the course of
their duties at a company or an organization where they previously worked
must not be disclosed or used without obtaining the approval from suchcompany or organization.
11

Information Security ReportWe manage and use important
information such as personal information
appropriately.

Information Security Report12Personal Information
In accordance with the Kirin Group Personal Information Protection Regulations, Policy, and Matters for Disclosure, for theappropriate protection and use of personal information that has been accumulated by individual companies in the Kirin
Group, the scope of its handling is divided into categories and specific handling is established in accordance with the life
cycle of the information.

Categories of Personal Information
All personal information handled by the Kirin Group is managed based on the following categories.
•

Personal information obtained from customers•

Personal information obtained from suppliers•

Personal information handled in operations contracted from the party outsourcing the operations (contracted information)•

Personal information of employees•

Personal information of recruitment applicants and departed employees

Personal Information Handling ManualHandling of personal information is managed in accordance with the Personal Information Handling Manual.
Checklist

Description

Obtain/Produce

Identify the purpose of use of the information as clearly as possible and use it to the extent that it isnecessary to achieve that purpose.

Use or provision/outsourcing ofoperations

Use the information within the scope of purpose of use for which the consent of the information’sowner has been obtained. If it is necessary to disclose or provide personal information to a third
party, always obtain the consent of the information’s owner.

Transfer or transmission

When handing over information, always obtain internal approval and keep records of such handovers.

Storage

Storage methods will be based on the information category.

Disposal

Information will be disposed of immediately and appropriately to reduce the possibility of
information leakage.

Handling of personal information is
managed in accordance with the Personal
Information Handling Manual.

13

Information Security ReportManagement in Areas
If the inside and outside of information facilities are not divided into areas by the level of importance, it could potentially leadto unauthorized physical infiltration of the premises and facilities of Group companies.
The physical environment of business locations also has a major effect on information security, so if controlling thatenvironment is difficult, we respond through other means such as operational rules.

Talk and Behavior

Taking Information Out

From various perspectives, including the potential for “loose
talk,” “viewing materials in situations where others could
see it,” “leaving materials behind after a meeting,” and“responding to external inquiries (including fraudulent ones),”rules have been established for the handling of information
assets outside the workplace.

A lack of caution when taking information assets outside
may result in its loss or theft. The inability to confirm receipt
and a high risk of the information asset being lost during
shipment and receipt with certain delivery methods havebeen taken into consideration in the establishment of theserules.

Management of Sub-contractors
If a sub-contractor causes an incident such as a leak of information, the Kirin Group, as the outsourcing party, will beheld responsible. Sub-contractors perform operations that the outsourcing party would normally perform on behalf of theoutsourcing party. As the outsourcing party, the Kirin Group has an obligation to manage and supervise its subcontractors toensure that they do not cause such incidents.

Use of the Internet
Use of the company’s information devices for non-work purposes is prohibited.
These devices are equipped with security devices to control communications.

Browsing the Internet

Use of Social MediaUse of the Internet for non-work purposes is prohibited.

When posting information on the internet in a private

Downloading files from web pages is permitted only if it is forcapacity, our employees have an obligation to ensure thatwork purposes.

the content posted does not infringe on compliance andmoral considerations.

Use of Information System
Logs are kept that record the activity of users of the system, exception processing, and information security events. These
logs are stored for certain periods to supplement future investigations and monitoring of access control.

Use of Smart Devices
If it is possible to save operational information through access to the internal system and e-mail, information leaks may occur
unless appropriate security functions are put in place.
Security functions required for company-supplied smart devices may differ according to the rules of use and security
measures for those devices, so appropriate functions will be decided and installed.

Information Security Report14

Measures against Information Security Incidents
If information security incidents or any events that could potentially cause an
information security incident are not reported and acted on appropriately, there is apossibility that an incident may actually occur or that the damage may be exacerbated.
Rules have been established in which immediate notice is to be given to pre-designatedcontact points in cases where actual or suspected security incidents are discovered.

Rules have been established in which
immediate notice is to be given topre-designated contact points in cases
where actual or suspected security
incidents are discovered.

15

Information Security Report

Active and Proactive Detection
Monitoring Structure
If a human-related or machine-related security incident or suspected incident is discovered, it must be reported to thesecurity incidents report contact immediately.
If the security incidents report contact is unknown, the informant will check with the security manager, who will thenstart monitoring the situation.

Response Slogan
If an actual or suspected security incident is detected, immediately report to the pre-designated contact point

Stand-alone shutdown of communication from employee’s terminal
Individual employee prevents secondary damage
A system has been installed that allows individual employees to instinctively shut down communication when they feel
suspicious about Internet communication, e-mail, or an individual employee and report it to information system staff.
Raising awareness of this action widely will prevent secondary damage caused by suspect devices and support
healthy business activity.

Incident Response Policy and Process
Incident Level

Response Process

Incident levels are defined according to a five-grade scale, based on the size of

Preparation

the incident’s impact.
The Kirin Business System Interim Risk Committee will make suspension
decisions based on the incident response level. Relevant sections will participate
in the meetings to make those decisions.
Further, depending on the situation, decisions will be made by the executive

Incident
Occursofficer in charge or the Group Risk and Compliance Committee.

Basic Policy at Time of Response

Initial Response

Order of Priority
1.

Secure human life (health and safety)

2.

Comply with laws and regulations

3.

Prevent leaking of customers’ personal information, minimize damage

4.

Prevent Kirin from providing an environment for cyber-attacks due tovirus infection, resulting in involvement or support of a cyber attack

Report/Information
Disclosure

5.

Continue with operations

Restoration/
Countermeasures

Data Preservation

Investigation/Analysis

Information Security Report

16

Preparing education
resources development

17

Information Security ReportHRD for Information Security
To make employees aware that what they
are learning directly concerns them and toencourage them to grow, we have preparededucation curricula and conduct humanresources development that is centeredon the ARCS Model, based on analysis of
educational motivation.

HRD Centered on the ARCS Model
To make employees aware that what they are learning directly
concerns them and to encourage them to grow, we have preparededucation curricula and conduct human resources developmentthat is centered on the ARCS Model, based on analysis of
educational motivation.

ARCS Model
ARCS Model: Four Factors

curricula for human

To make information security education effective, it is important thatthe trainees feel convinced.
Incidents can be prevented proactively by making use of learningsand detecting the forewarnings of security incidents appropriately.
Through information security education, we are improving our ability
to detect security events by raising the risk sensitivity of all employeesof the Kirin Group.

Information Security Report18

Information Security Personnel
Employees are able to accumulate knowledge about information security by exercising empathy, interest, and recognition,and to take action and put their new knowledge into practice with understanding, agreement, and practicality. Under thispolicy, we define security personnel as “Recognizers” and “Understanders” at the acquisition stage

Work-based Goals
The image of the aimed-for personnel will vary depending on the nature of the work. Goals are set for each type ofwork and duty and efforts are made to achieve them.

Knowledge and Behavior of Employees

Definition of information security personnel
covering all employees
Definition

Ability

Knowledge Aspect

Recognizer- Personnel with information security knowledge(May be- Understands necessity of Kirin Group’s
multiple stages)
information security regulations

Personnel- Personnel who can take actions withknowledge as a recognizer- Has specific understanding of purposes,
policies, and necessary actions of information
security- Able to act as a contact when information
security incidents occur- Possesses knowledge and can put it to use inactual operations

Recognizer

Understander(Security
master)Understander

GeneralKnowledge

Peculiar
to Kirin

〇

〇

〇

〇

Action Aspect

PersonPerson concerned
concerned
and others
△

－

〇

△
(Responsible location)

Learnings for the entire Kirin GroupThe Kirin Group has a range of curricula with which it strives to enhance individual Group companies’ awareness of
information security. Kirin-original education content has been produced, with updates added as necessary every year.
Trends are analyzed from actual outcomes and countermeasures are taken.

Updating of Information Security Content

Education Plan Test

PLAN



CHECK
Evaluation

19

Information Security ReportDO

ACTIONCountermeasures

Information Security Staff

Group Training

Action for All Employees
Cultivating human resources will contribute to raising the standard of security responses.

HRD Planning

Growth of Information Security(From Recognition to Understanding)Growth of Personnel

e-Learning

KISeP

Training starts as soon as

All employees, including executive

The establishment of an

employees join the company.

officers, take e-learning courses

information security portal site

Both new-graduate andseveral times each year.

has made independent study,

mid-career recruits will study

Based on the results of each item,

reporting, consultation, andinformation security in stages.

the weak points as a Group arecommunication easier, and also

calculated and improvements areenables repeated study.

made, after which subsequent tests
are conducted.

Cultivating human resources
contributes to raising the standardof the Kirin Group’s security
responses

Information Security Report20Evaluation of Action
Each action will be evaluated according to a Four-Levels Training Evaluation Model to confirm the validity of policies
and strategies and appropriately assess the degree of priority of additional policies and strategies. These evaluations
are then put to use in subsequent actions.

The Kirkpatrick Four-Levels Training Evaluation Model
Knowledge Aspect

Reaction

Action Aspect

Learning

Behavior

Results

Levels 1 and 2 evaluation support functions have been provided, which allows for efficient evaluation.
Levels 3 and 4, meanwhile are used in the comprehensive evaluation to determine。
whether or not a program should be continued.

Action towards 2020
Employees in grades that have opportunities to come into

Roadmap: From 2019 to 2020

contact with IT or grades they require decisions regarding

Key Points
Employees in grades with many chances to come into contact with IT and grades asked to makedecisions about managerial risks will grow to L2 Recognizers in 2020.

managerial risks will obtain knowledge of the Kirin Groupfor information security.
Employees in grades with fewer opportunities to come(① Management grade, ② staff, and ③ KBS)

Employees in grades with fewer opportunities to come into contact with IT will remain at L1
Recognizer level in 2020, but will steadily maintain their cultivation of information security
awareness. (④ End user grades)
Gradeinto contact with IT will keep cultivating knowledge and①
Management
grade

awareness of information security steadily over two years
in 2020.

Current
StatusEnd of2019

End of 2020

End of
2021

TargetEncourage smoothpromotion of security
measures at own location

Don’t know
Not interested

L1 Recognizer Growth

②
Staff

Don’t know
Not interested

L1 Recognizer Growth L2 Recognizer

Understander③
KBS

Don’t know
Not interested

L1 Recognizer Growth L2 Recognizer

Understander

Actually move to implement
security measures in own
systems and users④
End usergradesDon’t know
Not interested

L1 Recognizer

L2 Recognizer

Act so as not to cause
incidents that would lead tosecurity risks

L2 Recognizer

Maintain© Kirin Business System Company, Limited

Actually move to roll out
smooth promotion of
security measures at own
location

1【取扱注意】（Ｃ）開示範囲（グループ外秘）Action in 2020 and Beyond
Each section will have personnel allocated to promote

Roadmap: From 2020 to 2021

information security, information security will be

Key Points
Develop Understanders with a three-year plan ending in 2021.

maintained, and various initiatives will be pursued, such as
contact points for reporting incidents.
In this way, we will develop even stronger information
security frameworks.

(② Staff and ③ KBS)

Grades that promote information security will, as Understanders,maintain information security in their own location and serve a role ascontact points for reporting incidents, etc.
See “Definition of Personnel” below for detailed definition of “Understander.”

Grade

Current
StatusEnd of
2019①
Management
grade

Don’t know
Not interested

L1 Recognizer

②
Staff

Don’t know
Not interested

L1 Recognizer

L2 Recognizer Develop

Understander

Actually move to roll out
smooth promotion of
security measures at own
location③
KBS

Don’t know
Not interested

L1 Recognizer

L2 Recognizer Develop

Understander

Actually move to implement
security measures in own
systems and users④
End usergradesDon’t know
Not interested

L1 Recognizer© Kirin Business System Company, Limited

21

Information Security Report

End of 2020

End of
2021

L2 Recognizer

L2 Recognizer【取扱注意】（Ｃ）開示範囲（グループ外秘）TargetEncourage smoothpromotion of security
measures at own location

Act so as not to cause
incidents that would lead tosecurity risks2Management Review
In addition to reporting to the top management executives in charge of information
strategy when incidents occur, regular briefings are held several times a year.
For the purposes of promoting security, these briefings aim to consolidate
awareness in the Information System Division. Another aim is to exchange
information between top management and the Information System Division
regarding what is currently happening and what is being done to mutually checkthe behavior of all personnel.
Regular Status Surveys at Individual Group Locations in Japan
With the launch of status surveys of operating companies in Japan and overseas based on the Kirin Group’s
Information Security Roadmap and the establishment of Standards for Use and Management, the status of information
security is being surveyed on a regular basis.
During the period covered by this report, surveys were conducted at several locations in Japan and overseas.
Monitoring of locations that have had issues of concern is also ongoing.

Reinforcement of Overseas Locations
Matters subject to monitoring have been established for overseas operating companies and evaluations are performed
based on status reports provided by the individual companies.
(Started in 2010)

Detection of Incidents
Numerous incidents, including malicious attacks, have been detected, but they have been successfully defended
before anything happened.
Status monitoring is conducted on a monthly basis and, if there are any abnormal figures that differ from past social
trends or in-house tendencies, the causes are investigated, and responses are planned and implemented.

Response to Attacks on Credit Card Details Entry Screen on EC Websites
Due to the revision of the Installment Sales Act, business operators without certification for handling credit card
numbers are now prohibited from storing credit card data on EC websites.
Action has been taken based on this revision of the legislation.

Information Security Report22Feedback23

Information Security ReportVarious opinions expressed by employees after
information security training conducted in 2019are being reflected in future initiatives.

Feedback from Information Security Training
Favorable opinions that we want to maintain (extract)

Problems, Reflections, and Ideas
for Improvement by Employees•

As long as we are using smartphones and personal computers,
issues such as information leaks and virus infection are
unavoidable. I realized that I need to check the websites I viewand the e-mails I receive more carefully.

•

I could not help feeling that the people who say they understand
are the ones who understand the least. I am conveying what
I learnt to my team members and I will strive for preemptive
prevention by reminding them regularly in our daily work.

•

I get the feeling that we will see more risks that could lead
to work-related information leaks in the future. I hope thatthe company will hold regular in-house training and provide
opportunities to exchange information, to help prevent
information leaks both inside and outside the company.

•

I have been given opportunities to take information security
courses in various workplaces but attending this training has
made me realize anew that I need to be careful.

•

Holding this kind of training regularly will further increase my own
awareness and knowledge.

•

This kind of training can be used as an opportunity to gain
relatively new information, so I hope it will be continued into the
future.

Suggestions for Subsequent Sessions (Extract)•

This kind of session is very effective. However, while I kept what
I learned fully in mind immediately after the training, as time
has gone on, my attention has tended to wander, so I hope thistraining will be held regularly.

•

The terminology related to information security was difficult and
I do not have much knowledge, so I found having to perform
information-related operations a challenge. Another problem I had
was that I do not know anyone around me from whom I can easily
seek advice.

Information Security Report24Note: Service and product names included in this report are registered trademarks or trademarks of Kirin Holdings or each company.

Kirin Holdings Company, Limited
KIRIN BUSINESS SYSTEM COMPANY, LIMITEDNAKANO CENTRAL PARK SOUTH
10-2, Nakano 4-chome, Nakano-ku, Tokyo 164-0001, Japan