tentative translation[Entrustment of Critical Maintenance and Management, etc.](As of July 2024)

Outline of the Essential Infrastructure System and Required Information- Operation of the System Commences on May 17, 2024. 【NOTICE FOR USERS】
Only the Japanese laws has legal effect, and this pamphlet is only reference materials for understanding. We cannot holdresponsibility for any problems arise from the use of this pamphlet, so please refer to the official Japanese laws andregulations published in need．
【Reference】- Text of the Economic Security Promotion Act -https://www.japaneselawtranslation.go.jp/ja/laws/view/4523

Outline of the Essential Infrastructure System
In order to ensure the stable provision of essential infrastructure services, a new system was establishedunder the Act on the Promotion of Ensuring National Security through Integrated Implementation of
Economic Measures (the “Economic Security Promotion Act”) to require business entities providing essential
infrastructure services (entities designated as specified essential infrastructure service providers) that intend to introduce
specified critical facilities or intend to entrust critical maintenance and management and control of specified
critical facilities to file a notification to the national government in advance and subject to screening.
Required Information for Filing a Notification

Suppliers ofcomponent
facilities

Suppliers ofspecified criticalfacilities

Introduction
Specified Essentialof facilities

Infrastructure
Service Provider

1. Notification
concerning a plan of
introduction, etc.

Competent
minister

3. Recommendations
and orders
2. Screening (for 30 days)(as necessary)"Designated by the competent minister= The person obliged to file a notification"

Subcontractors receiving
re-entrustment of critical
maintenance,
management and control

Contractors receiving
entrustment of critical
maintenance,
management and control(may be extended or shortened)

Entrustment ofcritical maintenance,
management andcontrol of specified
critical facilities【Reference】- Outline of the Economic Security Promotion Act -<14 covered business sectors>
electricity, gas, oil, water, railway, truck transport, international
maritime cargo, Port and Harbor Transportation（※） , airtransport, airports, telecommunications, broadcasting, postal
service, financial services, and credit cards※ Added by 2024 amendment (not enforced yet).
https://www.japaneselawtranslation.go.jp/outline/75/905R403.pdf

👉Point！
When a specified essential infrastructure service provider entrusts critical maintenance andmanagement, etc. of specified critical facilities, the following persons are required to offer cooperation
as described below for prior screening:(1) contractors receiving entrustment of critical maintenance and management, etc. and(2) subcontractors receiving re-entrustment of critical maintenance and management, etc.(*)* Including all contractors and subcontractors entrusted with critical maintenance and management, etc.

STEP 1 List of required information

STEP 2◼ Required information is as follows:(i) Information is to be provided to the relevant
specified essential infrastructure service provider.

(i) Information on contractors and subcontractors(ii) Information on persons who directly hold 5% ormore of the voting rights of contractors andsubcontractors(iii)Information on officers and other executives ofcontractors and subcontractors(iv)Information on large customers such as foreign
government of contractors and subcontractors(v) Implementation status of risk management
measures(vi)Places where entrusted and re-entrusted duties
are performed(For details, please refer to P.2.)

Method of provision* There may be cases where information is provided via contractors
receiving entrustment of critical maintenance and management, etc.

(ii) (Some of the) information may be provided directly to thecompetent minister.
* As the competent ministry differs by business sector (electricity, gas,etc.), please confirm with the relevant specified essential
infrastructure service provider.

STEP 3
Please also provide information to be “modified”.
(For details, please refer to P.4.)* As a result of the screening, you may be requested to take measures in accordance withrecommendations made by the national government.

1Required Information
What kind of information should be provided?
Contractors and subcontractors are requested to provide the following information.
(Required information is prescribed in Order of the competent ministry.)(i) Name of the contractor/subcontractor, name of their representative, their address and country
with jurisdiction over incorporation, etc. (in the case of an individual: the person's name, address,
and nationality, etc.)
As attachments, a certificate of registered information and other documents need to be！ submitted.

(ii) Information on persons who directly hold 5% or more of the voting rights of thecontractor/subcontractor (their names, countries with jurisdiction over incorporation, etc. or
nationalities, etc., and proportions of voting rights they hold)(iii) Names, birth dates and nationalities, etc. of officers and other executives (those listed in i. to v. below)of the contractor/subcontractor
As attachments, copies of a certificate of registered information and other documents and！ their passports need to be submitted.

i. Stock company: Directors (in the case of a company with a nominating committee, etc.,
directors and executive officers)ii. Membership company: Executive membersiii. General incorporated association, general incorporated foundation, and small and mediumsize enterprise cooperative: The director
iv. Partnership under the Civil Code: Members
v. Other corporation or organization: Persons equivalent to those prescribed in i. to iv. above(iv) When the contractor/subcontractor has conducted transactions with a foreign government, etc.
(a national government, governmental organization, local government, central bank, or politicalparty or other political organization of a foreign country) in the last three years and the sales fromthose transactions accounted for 25% or more of its total sales, the relevant business year, andthe name of the foreign government, etc. and the percentage accounted for by the relevant sales(v) Implementation status of risk management measures (For details , please refer to P.3 and P.5.)
As a confirmation document, a document proving that risk management measures are being！ taken needs to be submitted.

(vi) Places where entrusted and re-entrusted duties are performed(Note) Contractors receiving entrustment of critical maintenance and management, etc. may obtain information on
subcontractors and provide such information to relevant specified essential infrastructure service providers insome cases.

What kind of information can be directly provided to the competent minister?
◆ Contractors and subcontractors may provide the underlined information in the above box directly
to the competent minister.
* They may also provide a confirmation document for some items of risk management measures directly to the competent
minister.

◆ Other information should be provided to specified essential infrastructure service providers.
* There may be cases where information is provided via contractors receiving entrustment of critical maintenance andmanagement, etc.

2

RiskSTEP1Management
必要な情報
Measures
What should be done as risk management measures?
It will be effective for a specified essential infrastructure service provider to evaluate risks of any
interference with the stable provision of specified essential infrastructure services with regard to theintended entrustment of critical maintenance and management, etc. and take appropriate measuresdepending on the details and levels of such risks (constant evaluation of all items is not necessarily
required).

< Conceptual drawing of risk management measures >Risk management measures ③: Physical and logical access control regarding information on design documents,
equipment, etc. it holds* There are multiple items for risk management measures. For a list (outline) of risk management measures, please refer to P.5.

Physically restricting access

Access control

An entity intending totake specified
interference actions

Specified criticalfacilities of a specified
essential infrastructureservice provider

👉Point！
A specified essential infrastructure service provider is considered to check whether
the suppliers of specified critical facilities and component facilities are taking
measures to decrease the risk, in addition to implementing their own initiatives.
For example, the following measures could be required to take:(i) whether contractors and subcontractors can check the existence of any
unauthorized modifications regularly or as needed through keeping andchecking operational logs and task histories;(ii) whether contractors and subcontractors physically (management of entering andleaving the room with surveillance cameras, et.) and logically (prevention ofaccess to data and systems) control access so that no staff members other thanthose they have designated can access relevant information;(iii) whether contractors and subcontractors provide education and training on
cybersecurity.
3

Provision of Information to be Modified
When modifying any of the provided information, is it necessary to provide the relevant information
to be modified?
When there are any modifications to the information contained in the submitted notification, a specified
essential infrastructure service provider may be required to file a prior notification or make an ex post facto
report for the modifications.
In that case, contractors and subcontractors may be required to provide the information to be modified to
the relevant specified essential infrastructure service provider and the competent minister in some cases.
More specifically, information provision is required mainly in the following cases.
A contractor receiving entrustment of critical
maintenance and management, etc.
(1) Cases where information provision is required
prior to the material modifications

A subcontractor receiving re-entrustment ofcritical maintenance and management, etc.
(1) Cases where information provision is required
prior to the material modifications

Limited to modifications "before commencing" theentrustment or "during the entrustment period"

Limited to modifications "before commencing" theentrustment or "during the entrustment period"◆ Matters concerning the contractor(i) Name of the contractor (in the case of an individual,
the person's name), address (only modification ofcountries), country with jurisdiction overincorporation, etc. (in the case of an individual, theperson's nationality, etc.)(v) Implementation status of risk management measures(vi) Places where critical maintenance and management,
etc. are conducted◆ Matters concerning the subcontractor(i) Name of the subcontractor (in the case of an individual,
the person's name), address (only modification ofcountries), country with jurisdiction over incorporation,etc. (in the case of an individual, the person's
nationality, etc.)(v) Implementation status of risk management measures(vi) Places where critical maintenance and management,
etc. are conducted21(2) Cases where information provision isrequired after the modifications(2) Cases where information provision isrequired after the modifications

Limited to modifications "before commencing" theentrustment or "during the entrustment period"◆ Matters concerning the contractor(i) Name of the representative(ii) Information on persons who directly hold 5% or moreof the voting rights of the contractor (when thepercentages of the voting rights they hold newly
become 5%, 25%, one-third, or 50% or more of thetotal)(iii) Names, birth dates, nationalities, etc. of officers of thecontractor(iv) When the contractor has conducted transactions witha foreign government, etc. in the last three years andthe sales from those transactions accounted for 25%
or more of its total amount of transactions, therelevant business year, and the name of the relevant
country and the percentage accounted for by therelevant sales among the total

Limited to modifications "before commencing" theentrustment or "during the entrustment period"◆ Matters concerning the subcontractor(i) Name of the representative(ii) Information on persons who directly hold 5% or moreof the voting rights of the subcontractor (when thepercentages of the voting rights they hold newly
become 5%, 25%, one-third, or 50% or more of thetotal)(iii) Names, birth dates, nationalities, etc. of officers of thesubcontractor(iv) When the subcontractor has conducted transactions
with a foreign government, etc. in the last three years
and the sales from those transactions accounted for
25% or more of its total amount of transactions, therelevant business year, and the name of the relevant
country and the percentage accounted for by therelevant sales among the total

Contractors receiving entrustment of critical maintenance andmanagement, etc. may obtain information on subcontractors andprovide such information to relevant specified essential
infrastructure service providers in some cases.

< Conceptual drawing of procedures for modifications >Prior notification for theentrustment of critical
maintenance andmanagement, etc.

Make a report before
modifying the provided
information ((1) above)

Contractors and subcontractors arerequested to provide required
information, and specified essential
infrastructure service providers file
notifications.

Make a report after
modifying the provided
information ((2) above)

Make a report before
modifying the provided
information ((1) above)

Time to commence
the entrustment

Make a report after
modifying the provided
information ((2) above)

Time to terminate
the entrustment* Notifications, etc. are not required after terminating the entrustment.
4

Reference

Outline of the Risk Management Measures

Below is an overview of examples of the risk management measures, which specified essential infrastructure service
provider are expected to evaluate and take themselves under the cooperation of contractors and subcontractor’scooperation.
* It is not necessarily required to take all the measure.
* See Orders of the competent ministries for more specific details.
* The following are measures categorized by those who are mainly expected to take these measures. Specified
essential infrastructure service providers may also ask for cooperation for other matters. Please consult withspecified essential infrastructure service providers concerning concrete measures.

1

Under Contractor’s cooperation

Number on
notification form ↓Keep operational logs and task histories, etc. and check unauthorized modifications regularly or as needed①

Conduct physical (ex. Entering and leaving the room) and logical (control the access to system) access control
regarding information on design documents, equipment, etc. they holdConduct physical (ex. Entering and leaving the room) and logical (control the access to system) access control
in the environment where the entrusted duties are performed③

Provide cybersecurity education⑤

Confirm specified essential infrastructure service provider’s approval is condition for each subcontract⑥

Secure subcontractors' cybersecurity measures at the same level as those of contractors⑦

Check the stability of business based on business plans, etc.

⑧④

Check any violations to domestic laws and regulations and international standards in the last three years⑨－１

Ensure to receive reports on a possible breach of contract due to legal environment, etc. in a foreign country⑩－１

Ensure the provision of detailed information on suppliers

2⑫Under Subcontractor’s cooperation

Keep operational logs and task histories, etc. and check the existence of any unauthorized modifications
regularly or as needed
Conduct physical (ex. Entering and leaving the room) and logical (control the access to system) access control
regarding information on design documents, equipment, etc. they holdConduct physical (ex. Entering and leaving the room) and logical (control the access to system) access control
in the environment where the entrusted duties are performed①

Provide cybersecurity education⑤

Confirm specified essential infrastructure service provider’s approval is condition for each subcontract⑥

Secure subcontractors' cybersecurity measures at the same level as those of contractors⑦③④

Check any violations to domestic laws and regulations and international standards in the last three years⑨－２

Ensure to receive reports on a possible breach of contract due to legal environment, etc. in a foreign country⑩－２

Ensure the provision of detailed information on suppliers⑫(Reference) Mainly taken by Specified essential infrastructure service providers
Regularly manage assets through means such as the application of the latest security patch②

Confirm essential infrastructure service provider’s approval is condition for each subcontract⑥

Check the stability of business based on business plans, etc.

⑧

Check the appropriateness of the handling of information on video equipment (places for critical
maintenance and management, etc.)⑪

5