保険監督者国際機構（IAIS）「保険者のサイバーセキュリティ監督に係る市中協議文書」に対する損保協会意見
ﾊﾟﾗ総論

和文・全体的に、記述してある内容は正しい方向性であると考える。

英文
We, the General Insurance Association of Japan (GIAJ), believe that

しかしながら、Cyber security risks は保険会社固有の課題ではなく、保険会社 what

theDraftApplication

PaperonSupervisionofInsurer

以外の金融機関等に対するガイドラインや規制との整合性を保持し、重複を回Cybersecurity (hereinafter referred to as "AP") describes is going in the

避する必要があることから、金融機関向けの汎用なガイドラインをベースとしright direction. However, against the background of cybersecurity risksた検討を行う方が妥当。業界固有の重要なリスクがない場合には、AP の分析の

not being issues particular to insurers, we think it is more appropriate to

とおり、現行 ICP にもその要素は含まれており十分である。仮に不足がある場

consider potential insurance-specific guidelines and rules based on

合でも、これを補う修正対応が適切と考える。

comprehensive guidelines for the whole financial sector so that their

また、今回の AP の内容を受けても、保険業界固有のガイドラインや規則を策

integrity in relation to sector-wide guidelines and regulations is

定する必要性があるか否かは不明確であり、保険会社固有の規則を設ける場合

maintained and unnecessary duplication is avoided.には、その合理的な理由を明示する必要があると考える。

If there are no significant or industry-specific risks, the current ICPs
which already encompass the issues presented by cyber risks should be・本 AP の Recommendation におけるコメント内容は、導入文（例えばパラ 48

sufficient for the supervision of insurer cybersecurity. If the current ICPs

や 81）は may の表現が使用されていることからも、ベストプラクティスとしare found to be insufficient, we believe it is appropriate to revise the ICPsて記載されている趣旨であると考えるが、一方で後続の文章にはほぼ全て

to make up for the shortfall.

should や must の表現が使用されており、バランスを欠く。should や must の In any case, we are still not convinced that the insurance industry needs
表現は may や would に変更し、監督者や保険者が重要性に応じて裁量を持て

to develop its own guidelines or rules even after taking into consideration

る記載にすべきと考える。

the contents of the AP. Therefore, when developing rules particular toinsurers, the IAIS should clearly express its rationale.
Judging by the fact that the introductory statements in the“Recommendation” section of the AP often use the word “may”, such as inparagraphs 48 and 81, we understand “Recommendations” to mean “bestpractices”. Additionally, almost all of the sentences in the latter part ofthe document use the words “should” or “must”, which therefore indicatesa lack of balance. We believe that the words “should” and “must” should
be replaced with “may” and “would” so that supervisors and insurers can
exercise discretion in accordance with the materiality of the issue.

保険監督者国際機構（IAIS）「保険者のサイバーセキュリティ監督に係る市中協議文書」に対する損保協会意見
48.d

取締役会と経営陣の間の役割や責任の配分は、取締役会の責任において、サイバ

It is the responsibility of the insurer’s Board to appropriately define theーセキュリティーフレーワークの実効性を高める目的に資するよう、保険会社のrespective roles and responsibilities of itself and its management so that

裁量を許容すべきである。

its cybersecurity framework is effective. Therefore, the insurers’
discretion should be allowed on this point.

81.a

3.1 48-d コメント同様

See our comment on 48.d.

81.b

同上

See our comment on 48.d.

81.d・3.1 48-d コメント同様

See our comment on 48.d.

・人材の確保については、それぞれの国の事情によって難易度が高いケースがあConsidering that it could be difficult in some countries to secure members

ることも鑑み、以下の通り修文を行うべき。

with appropriate skills, this paragraph should be revised as follows;d. An insurer’s Board and senior management should cultivate

81.fd. An insurer’s Board and senior management should cultivate awareness ofawareness of and commitment to cybersecurity. The Board and seniorand commitment to cybersecurity. The Board and senior management should

management should make the effort to include members with skills

make the effort to include members with skills appropriate to their oversightappropriate to their oversight and management roles with respect to theand management roles with respect to the risks posed by cyber threats. In

risks posed by cyber threats. In addition, the Board and senioraddition, the Board and senior management should promote a culture thatmanagement should promote a culture that recognizes that staff at all

recognizes that staff at all levels have important responsibilities in ensuringlevels have important responsibilities in ensuring the insurer’s

the insurer’s cybersecurity and lead by example.

cybersecurity and lead by example.

senior executive が independence を保有すべきとあるが、1.3 のプロポーショナ

Although this paragraph alludes to the independence of the roles of

リティに則り、当該保険者の事業規模、複雑性、事業特性などに応じた統治形態

senior executives, we understand that various forms of governance areが容認されるものと理解している。

allowed depending on the insurers’ scale of business, complexity, and thecharacteristics of its business in accordance with the principle ofproportionality stipulated in section 1.3.

103.e

管理が必要な要素を台帳によって管理するにあたって、その形式については、単As for managing elements and forms of the inventory, management

一の台帳に情報を網羅する方法をすべての保険者に対し一律に求めるのではな

techniques that insurers judge appropriate should be allowed rather than

く、保険者が適切と判断した管理手法が容認されるべきであるため、本項は以下

uniformly requiring all insurers to encompass all the information into aの通り修正されるべき。

single inventory. Therefore, this paragraph should be revised as follows;保険監督者国際機構（IAIS）「保険者のサイバーセキュリティ監督に係る市中協議文書」に対する損保協会意見

103.g

The inventory should may encompass hardware, software platforms and

The inventory may encompass hardware, software platforms andapplications, devices, systems, data, personnel, external information systems,applications, devices, systems, data, personnel, external information

critical processes, and documentation on expected data flows, based on thesystems, critical processes, and documentation on expected data flows,management method deemed appropriate by the insurer.

based on the management method deemed appropriate by the insurer.

「統合」を狭義の意味で実現するのは難易度が非常に高いと想定される。

We assume it is immensely difficult to literally "integrate" identification→「関連付けた管理を実施すべき」という解釈が許容されるべき。

efforts with other relevant processes in a narrow sense. Therefore,
insurers should be allowed to interpret this paragraph as “insurers
should manage identification efforts in association with other relevantprocesses”, such as acquisition and change management, in order tofacilitate a regular review of its list of critical business processes,
functions, individual and system credentials, as well as its inventory ofinformation assets to ensure that they remain current, accurate andcomplete.

103.q

・通常発現しないと考えられるイベントや、過去に発現しなかったイベントのとAs each insurer may have a different perception of “cyber events

らえ方は保険会社により異なると思われるため、考慮すべきイベントのレベル感

considered unlikely to occur or have never occurred in the past”, weや内容について保険会社の裁量が確保されることを確認したい。

would like to make sure that the judgment of cyber threats to beconsidered is left to the discretion of each insurer.

133.f「cyber threat intelligence programme」を明確化していただきたい。

The definition of the “cyber threat intelligence programme” should beclarified.

133.n「advanced threat agent capabilities」の定義について解説頂きたい。

We would like to have a detailed definition of “advanced threat agentcapabilities”.

133.o

3.1 48-d コメント同様

See our comment on 48.d.

133.s

ペネトレーションテストは通常 IT 部門を中心に限られた範囲で実施する。"wider

Penetration tests are usually carried out by a limited number of (mainlybusiness stakeholders"を含めて実施するペネトレーションテストとはどんなイIT) departments. We would like to have a clearer view of how “the tests

メージかを確認したい。

which could include wider business stakeholders” will be carried out.

保険監督者国際機構（IAIS）「保険者のサイバーセキュリティ監督に係る市中協議文書」に対する損保協会意見
160.e

当該規律の目的を明確化したい。大規模インシデント時の外部リソース枯渇リス

We would like to more clearly understand the objective of the rule

クを避けるために外部と事前に契約締結を求めているものか。

“insurers should plan to have access to external experts”. Does it require
insurers to conclude some kind of contract with third-parties in advanceof a large-scale or industry-wide event to avoid the risk of losing access toexternal resources?

160.f

レスポンスプランについて、関連当局と事前調整まで求める意図を教示いただきWe would like to know the intention behind the IAIS requiring insurers

たい。

to consult and coordinate with relevant authorities regarding theirresponse plan. This requirement seems too prescriptive.

160.h

コミュニケーションのために「a specific team」を配置する必要はなく、各人の役 As long as the necessary responsibilities with regard to stakeholder
割を明確にすることで足りると考える。

communications are clarified, we do not think insurers need to have “aspecific team” in place for all stakeholder communications.

198.a

198 パラグラフについて、FS-ISAC または金融 ISAC に参加するかどうかについWe would like to make sure that insurers have the discretion as toての判断は、保険会社自身が、そのサイバーセキュリティの実効性を高めるうえ

whether to participate or not in FS-ISAC or Financials ISAC Japan,での必要性等に照らしつつ、自己の責任で適切に行うものであること、および当taking into account their judgment of the necessity to enhance the

該必要性の有無および程度についても比例の原則が適用されること、を確認した

effectiveness of their cybersecurity. We also would like to make sure thatい。

the principle of proportionality is applied with regard to their decision on
the necessity of such participation.

198.d

脅威分析の機能があるものとして記述されているが、現実は機能を持つことも難This paragraph assumes that an insurer’s cyber threat intelligence

度は高いことを指摘したい。

operations are a given. However, we would like to point out that in realityit is difficult to even have a department that deals with cyber threat
intelligence operations.

198.e

同上

See our comment on 198.d.

198.f

同上

See our comment on 198.d.

保険監督者国際機構（IAIS）「保険者のサイバーセキュリティ監督に係る市中協議文書」に対する損保協会意見
198.g

業務委託関係にあるような第三者のサービスプロバイダーとの間でサイバーセキ

We think that exchanging information “bilaterally” on their cybersecurityュリティフレームワークに関する"bilaterally"の情報交換を行うことは、当方側の framework with third-party service providers is unrealistic. Such
セキュリティやガバナンス上のリスクをさらけ出すことそのものであり、セキュexchanges would be no different from exposing an insurer’s security and

リティ上危険な状態に陥る可能性があるため、現実的ではないと考える。

governance risks, and would put insurers in greater danger with regard
to their cybersecurity.
以上