Information Security Report 2023

Hitachi GroupINDEXCISO Message・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・1
Hitachi's Approach to Information Security ・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・4
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・6
Information Security Management・Information Security Management Systems・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 6
Initiatives for Security Human Resource Development・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 12
Action to Strengthen Global Information Security ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 14
Action to Strengthen Information Security in M&A・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 16

Cybersecurity Initiatives ・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 18
Cybersecurity Management・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 18
Cybersecurity Countermeasures・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 24
CSIRT Activity in the Hitachi Group・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 26

Initiatives for Data Protection ・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 30
Initiatives for Personal Information Protection・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 30
Privacy Protection Initiatives・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 36

Internal and External Activity Related to Information Security・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 38
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 40
Working to Raise Information Security Awareness・

Research and Development of Cooperative Cyber Defense
Technologies to Enhance Social Resilience・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 42
COLUMN

・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・44
Third-Party Evaluation and Certification・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 47
Overview of the Hitachi Group ・Summary of this report:●Scope and time period covered by this report: Hitachi Group information security initiatives up to and including FY 2022
●Report publication date: October 2023

CISO Message

From individual optimization to
overall optimization, froma global perspective.
Coming together to move forward
as “One Security Team.”
Cyberattacks by ransomware targeting businesses are becoming
more advanced and sophisticated every year, resulting in frequent
incidents of information leaks and system shutdowns. We are now in asituation where security risks are no longer separated by national,
regional, or company boundaries, and security incidents can occur
anywhere at any time.
Security measures are becoming increasingly important as we
continue to globalize our business operations and expand ourdata-driven Lumada business under the 2024 Medium-termManagement Plan. All companies involved in Hitachi Group business,
and all employees of the Hitachi Group, will work together as “OneSecurity Team” to address information security.

Hitachi, Ltd.
Vice President and Executive Officer, CTrO/CISO

Masashi Murayama
Mr. Murayama joined Hitachi in 1985. Drawing on his experience as the leaderof the Project Management Promotion Office Smart Transformation Project
Initiatives Division, beginning in 2016, Murayama drove strategic andstructural reform as CPO and general manager of Value Chain Integration.
Appointed to role of Managing Executive Officer in 2019 and CISO in 2020.

1CISO Message

Increasingly sophisticatedcyberattack threats

properly manage information in the course of doing

Over the past few years, the number of cyberattacks

they possess.

business. The key to that is the utilization of local humanresources and the information, knowledge, and expertise

has surged, as well as the number of attacks involving

We believe it is essential to have a system that makes

unauthorized logins from multi-factor authentication

the most of the human resources in each region, rather

breaches. We recognize that this situation represents thethan having everything done by people at headquarters.

increasing sophistication of hackers, and at the sametime, it is something that is bound to happen.
As businesses deal with digital data, systems move fromon-premises to cloud-based, and more data is handled

Information security is one of themost important management issues

in open environments, the threat of cyberattacks is

Our 2024 Medium-term Management Plan newly adds

unavoidable. In addition, there is no end to incidents

our stance of “supporting people’s happiness throughcaused by human error, such as information leaks due tothe use of data and technology to achieve a sustainablecareless handling of data containing large amounts ofsociety”. The use of data is essential to the social

personal information. We need to be well aware of thisinnovation business that forms the basis of this plansituation, which goes beyond isolated incidents, andthrough IT, OT, and products. In order to safely promote

position it as an important issue for risk management inour business and provide services to our customers, wethe Hitachi Group. First of all, we need to take firm action

will work with the IT department to create an environment

on what we ourselves should do.

in which information security is ensured and firmly
underpinned.
The Hitachi Group is expanding the Lumada businessto focus on customer data and bring new insights to light,
contributing to business grow th and solutions tocustomer management problems. We are working tominimize the risk of leaks of confidential information,
including personal information, and risks related to
privacy. For that purpose, we must closely examine thekinds of situations that violate laws and rules, andabsolutely avoid them. Since not all of the information isnecessarily needed to conduct business, we want tomaintain an optimal balance between information
security and business promotion by clearly separating
what is necessary from what is not.

Stronger data protection isadvancing globally
Data protection regulations are now being tightened on

The Hitachi Group has been reforming its businessa national and regional basis, including Europe’s GDPR

por tfolio and has greatly globalized its business

and China’s three cybersecurity and data laws. The

structure. Going forward, we will promote sustainable

impact of these developments on the Hitachi Group’s

management based on that business structure.

business is certainly significant. In developing global

Although the phases of management may change, ourbusiness, we must consider and firmly adhere to each

information security efforts will not change drastically.

country and region’s laws and regulations. In particular,

However, since risk management requires a sense of

w e m u s t b e w e l l a w a r e o f a n d r e s p o n d to t h eurgency, we need to work on how to achieve that on astrengthening of cross-border data transfer regulations,

global basis.

incorporating the knowledge of experts on how to

2

Building a fast and efficient
security system

In risk management, the speed at which information

is shared must be faster, and the cycle from attack
detection to implementation of countermeasures must
be more efficient. Globally, things are happening 24

Raise employee awareness and promoteindustry-government-academia collaboration

hours a day, 365 days a year. If ever y step of theRegarding the human risks of incidents caused

response is done in Japan, it may come too late, so it

intentionally or through negligence, we must ensure thatis essential to operate without time dif ferences.

measures are applied thoroughly to employees, andFurthermore, if information is shared only vertically from

review whether the rules are truly easy for employees tothe originating business department, communication

follow. It is difficult for people to be conscious of crisis

may be slow, or may give the wrong impression to

management for things they cannot see. We aim to

subsidiaries or sub-subsidiaries if they are located in

fur ther raise employee awareness throughoverseas locations. Just as water gets spilled along theeasy-to-understand videos and periodic security drills to

way in a bucket relay, the process becomes like aprevent inadvertent data leaks. In addition, it is importantgame of “telephone”, and the correct information may

to build open relationships with the information security

not be f ully conveye d. In addition to ve r tic aldepartment, so that we can easily discuss day-to-day

collaboration, we are further strengthening horizontal

security-related problems and concerns. As anothercollaboration among regional offices with the aim ofcountermeasure against cyberattacks, which are

faster and more accurate information-sharing.

becoming more sophisticated and organized, we will
promote efforts through industry-government-academia

Toward achieving zero-trust security

collaboration. We will strengthen our security system bytaking firm measures to meet the government’s
requirements, building close relationships among

Recognizing that the threat of frequent cyberattacks

companies with the government as an intermediary,is unavoidable, we are first of all committed to doingcollaborating with research institutions, and implementing

what we must do by ourselves, and getting it right. In

their knowledge.

building our own information security environment, we
will take measures based on the principle of preventing
serious damage in the event of an emergency. While
doing so, we believe it is important to strike the rightContinuous progress as“One Security Team”

balance, with measures that are effective, but not so

Eve n i f we a ntic ipate va r iou s r is ks re l ate d tos tr i c t th at th ey i n te r fe re w i th n o r m a l b u s i n e s s

information security and take appropriate

operations.

countermeasure, new risks will emerge. There is no

Much like firefighting activities, if we adopt rigid rules
and systems for fire prevention, we may reduce risk,

ending for countermeasures. Therefore, in information
security, we believe it is vital to persist in our efforts.

but we will have more difficulty in getting on with ourT h e H i t a c h i G r o u p, w h i c h c o n s i s t s o f m a n ydaily lives. Rather, at a minimum, we take various firecompanies in various countries and regions around theprevention measures to prevent extensive damage inworld, must implement enterprise management thatthe event of a fire. Similarly, we will apply information

works as “One Hitachi” to manage risk across the

security measures in a way that is compatible withentire organization. We must integrate information thatbusiness operations, to prevent the spread of damage

has been stored separately in a way that optimizes it asin the event of an incident.

a whole.

In addition to these internal security efforts, we will

In order to further advance the security measures wealso focus on stre ngthe ning the se curit y of thehave cultivated, and operate them globally from theproducts and services we provide to our customers,

perspective of overall optimization, we must be aware

and the security of our business partners. In our supply

that we are “One Security Team”. Group companies

chains, suppliers provide products/services to Hitachi

and departments in Japan and overseas, as well asGroup, which we use to provide products/services tobusiness partners, will work together to promote fasterour customers. We pursue Zero Trust Security toand more effective security initiatives under a common

further ensure security throughout the supply chain.

security policy.

3

Hitachi's Approach to Information Security
The advance of digitalization generates new value, but there is the growing risk that increasingly
sophisticated cyber attacks could impede the continuation of business, through threats such as
information leaks and shutdowns. Minimizing that risk through risk management around information
security is one of a company's most important tasks.
Given that background, Hitachi, aiming to become a global leader with our social innovation business,positions cybersecurity measures to address the value creation and risk management aspects as a key
management issue, as we work on information security.

Promoting information security as risk management
The rapid advance of digitalization and the complex
global changes in political and economic conditions arechanging the business environment on a daily basis.
Hitachi monitors and analyzes this business environment
and practices risk management to address the aspectsof th e r i s ks H i tac h i s h o u l d b e re ad y fo r a n d th eopportunities we should seize, based on social issues,
our competitive advantages, management resources,and other considerations. We aim to create profit
opportunities while controlling risks.
R e c e nt cy b e r at tac ks a re g a i n i n g i n l eve l a n dsophistication, and their scope is widening, to coverproduction and manufacturing environments anddevelopment environments, which are OT fields, as wellas the usual internal IT systems. There are also attacks
targeting the products and ser vices we provide toc u s to m e r s, a n d o u r s u p p l y c h a i n s. A s a r e s u l t,
everywhere around the world is increasingly likely to be
attacked, and many incidents have major repercussions
on business continuity, including information leakage
and factor y shutdowns. Data protection laws, as
exemplified by China's set of three cybersecurity anddata laws, are being reinforced around the world, anddata leaks due to cyber attacks are a rising risk from theperspective of a company's legal compliance. Given thisbackground, Hitachi recognizes information security as amajor risk, and handles countermeasures aggressively
as a management issue.

Hitachi's Information Security Vision
In digital society, while the enormous amount ofdiverse data creates value, there are also major threats
to safety and security. In addition, workstyles havechanged dramatically, such as with the promotion ofworking from home, and the future form of security musta l s o c h a n g e d r a m a ti c a l l y. Ta rg e te d a t t a c k s a re
becoming more sophisticated and diverse than ever, andex i s ti n g a t t a c k m e th o d s a re n ow b e i n g u s e d i n

Figure 1‐❶

Hitachi's Information Security Vision

GovernanceContinue and steadily implement security measures that have positioned cyber security as a management issues. There isno such an absolute security, thus we must build resilience to enable capability of recovery quickly in the case of
emergency-state. (for securing business continuity)

Co-Creating
Security

To protect us against the evolving and increasing cyber attacks, expanding internal communication and building
security ecosystem together across the entire society

Jibungoto

Each employee acquire correct understanding of security and empathize the importance, and foster the mindset,
Jibungoto, to take an action as own matter.

Improve the security resilience

4

combination, for example, using ransomware threats tosteal information. In such a situation, Hitachi is now
promoting various efforts to improve cyber resilience,
based on the three approaches of internal controls as"Governance," collabrateive creation as "Co-creating
Security," and ownership as "Jibungoto," for a "nextnormal." (Figure 1‐❶)

Acquire adaptability / flexibility
and cyber resistanceT h e H i t a c h i G ro u p, w h i c h b e g a n f u l l -s c a l ecyber-attack countermeasures in 2011, has learned fromthe WannaCry infection in 2017 to expand the scope ofcountermeasures not only to internal IT but also to OT
areas. We are continuously and steadily strengthening
operational, technical, and organizational measures,
focusing on enhancing security and cyber BCP in
products, services, and supply chains.
In addition, we have initiated zero-trust security
measures on the standard of cloud-based IT
architecture, aiming for optimal security in light of therecent shifting of business systems to the cloud, andwork-st yle changes such as the establishment ofworking from home. For implementation, we consider“authentication,” “endpoint,” and “cyber-integrated
monitoring” to be key elements in achieving zero-trusts e c u r i t y, a n d w e a r e w o r k i n g t o e n h a n c e o u r
attack-detection capabilities.
■ Co-creating Security: work on building a security
ecosystem
Responses to security incidents require cooperation
among all departments, including PR, personnel, andlegal affairs, not just the IT department. As the range ofmatters addressed by security measures broadens, theMonozukuri Group, Quality Assurance Department,
Procurement Department, and other departments mustalso collaborate well to ensure full functionality. Hitachisees this kind of security ecosystem as vitally important,and is working to build it.
Our approach is that the elements of this ecosystem
structure: “things,” “people and organizations,” and“society” must be connected.
DX requires an environment in which things like
Figure 1‐❷

devices and systems, exemplified by IoT, are connected.
To maintain security in a world where connections areb e in g m ad e b et we e n th in g s th at u ntil n ow we reunconnected, we are building a system of connected
people and organizations to promote countermeasuresin which dif ferent organizations work together topromote security measures.
Connections are not just needed within Hitachi. It is
now essential to share threat information and issues
encountered when implementing countermeasures withenterprises, governments, academia, and other entities
e n g a g e d i n c y b e r s e c u r i t y i n i ti ati ve s to c re ate acommunity not bound by traditional constraints. Hitachi
invites each enterprise and organization to feed back theknowledge it gains from the community into its own
security measures, creating further connections insociety. (Figure 1‐❷)■ Jibungoto: security awareness-raising initiatives
We presume that that vulnerabilities in security
awareness will be targeted, as it has becomecommonplace for employees to work from home overthe past few years. When working outside the office with
nobody around to act as a voice of reason, risk is everpresent.
This means that improving each employee’s security
awareness will be the last defense. In addition to ourexisting strict governance, we have started activities toraise security awareness by encouraging employees totake the initiative and act independently. This does notmean making security feel like an obligation. Rather, ourgoal is to get employees interested in the issues, havethem share our commitment from the heart, and takeownership of security.

Hitachi's Approach to Information Security■ Governance: zero trust security initiatives

Illustration of the security ecosystem

Industry
People andorganizations

Government
People andorganizations
Goods

Academia
People andorganizations
Goods

Goods
IoT
IoT

IoT

Society5

Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Information Security Management Systems
Hitachi sets information security policies, establishes various rules and promotion frameworks based onthese policies, and works on information security management in order to protect the information
assets to be protected. Those assets include information entrusted to us by customers, the systems
which store such information, and the information systems that run social infrastructure services.

Information security policy
As an organization that contributes to Japan's
reputation on the global stage, Hitachi acknowledges
that security risks are business risks, and makes every
ef for t to ensure information security by defining asecurity policy that meshes with the wider management
policy of the enterprise.
(1) Formulating administrative rules for information
security and ensuring their continual improvement
Hitachi acknowledges that information security is a
key issue for management and business operations,and will formulate administrative rules for information
security that comply with the law and other regulations.
Hitachi will also establish a company-wide information
se curit y promotion framework with Hitachi, Ltd.
executives at its core, and ensure its enforcement.
Hitachi will maintain information security fromorganizational, personal, physical, and technicalperspectives, and ensure its continuous improvement.
(2) Protection and ongoing management of
information assets
Hitachi implements safe management measures thatappropriately protect the confidentiality, integrity, andavailability of information assets from threats. Hitachi
also implements appropriate control measures to ensurebusiness continuation.

(3) Legal and regulatory compliance
Hitachi complies with laws and other regulations
re l ate d to i nfo r m ati o n s e c u r i t y, a n d e n s u re s i ts
administrative rules for information security conform tothese laws and regulations. In the event of a legal or
regulator y violation, Hitachi takes the appropriate
punitive action as defined in the Rules of Employment
and other relevant policies.
(4) Education and training
H i t a c h i a i m s to i m p r ove i n fo r m a t i o n s e c u r i t yawareness among its executives and workers andconduct education and training in relation to information
security.
(5) Preventing incidents and taking action when
they occur
Hitachi endeavors to prevent information security
incidents, and if such an incident were to occur, to takeappropriate action, including preventive measures,without delay.
(6) Ensuring business processes are optimized
within the corporate group
According to (1) to (5), Hitachi will endeavor to build
frameworks that ensure proper business processes
within the corporate group consisting of Hitachi and
Hitachi Group companies.

Information security promotion framework
Within the Hitachi Group, Hitachi, Ltd. HQ (corporate)
is responsible for governance of the group as a whole.
Governance is instituted by way of instructions passed
down through lines of control to each Hitachi, Ltd.
business unit (hereinafter BU) and office and to eachGroup company. Governance of the Hitachi Group as awhole is achieved by each BU and Group company
applying the same controls to the Group companies(subsidiaries) that they manage.This framework applies
not only within Japan but also overseas locations.
The company president nominates a chief information

6

security officer who has authority and responsibility inrelation to information security, and an informations e c u r i t y a u d i t o f fi c e r w h o h a s a u t h o r i t y a n d
responsibility in relation to information security audits.
The chief information security officer establishes aninformation security committee which guides policy
regarding information security, personal information
p rote c ti o n p o l i c i e s, tr a i n i n g p l a n s, a n d va r i o u smeasures.
The matters decided by the information security
committee are disseminated to each organization

through information security promotion meetings
attended by representatives of all BUs and offices.
In principle, the head of the BU and the of ficemanager serve as the information security officer of the
BU and office. Information security officers appoint
Information Security Execution Officer and Personal
data Protection Manager to support implementation, inorder to manage and control personal information

Figure 2‐❶protection and information security.
A n info r m atio n a s set m a n ag e r is p l ac e d in a ll
divisions, and allocates responsibilities in relation to thehandling of information assets including personal
information.
Similar organizations are established in Group
companies to promote information security throughcooperation. (Figure 2‐❶)

HQ (corporate)

BU

BU

Group company

Group company

Group company

Group company

Group company

Group company

Hitachi, Ltd.

Governance

Hitachi, Ltd.

Information Security Management

Information security promotion framework

CEO

Chief information security officer (CISO*)

Information security audit officer

Information security committee

Company president
Information security officer

Chairperson (and CISO)
Information security education director
Information security audit officer
Committee members: Representatives of businessoffices and heads of HQ management divisions

Audit officer

Information security promotion meeting

BU
OfficeInformation security officer

Chief information security audit officer

Information Security Manager
Personal data Protection Manager
Information security promotion division
External liaison division
Cybersecurity officer
Information systems manager
Information asset manager*CISO: Chief Information Security Officer

7

Governance

Co-Creating Securuty

Jibungoto

Information Security Management

System of rules for information security
Hitachi has established the rules in the following tablebased on its information security policies. (Figure 2‐❷)
Group companies have established similar regulations
to promote information security.
■ Basic regulations“Information Security Management Rules” define thebasic matters that must be complied with in relation to
the formulation, implementation, maintenance, andongoing improvement of information security
management systems.
We promote our cybersecurity measures worldwide
according to our information security countermeasure
standards, which comply with US government standard
SP800.
We have enacted the Hitachi Group Privacy Principles
as a common code of conduct for personal information
protection throughout the Hitachi Group.

Furthermore, in our “Personal information protection
policy” and “Regulation for personal information
management,” we have set rules equivalent to the JIS
standard (JIS Q 15001) in order to manage personali n f o r m a t i o n a t a h i g h e r l e v e l t h a n t h e Pe r s o n a lInformation Protection Law.
“Regulations for Confidential Information Management”
d e fi n e th e h a n d l i n g p ro c e d u re s u s e d to p rote c t
confidential information.
■ Individual regulations
The “Rules on website creation and information
disclosure” define the matters that must be compliedwith in order to disclose and use information correctly on
websites.
The “Rules for the Management of Entry/Exit andRestricted Areas” define measures to maintain physicalsecurity, such as rules governing building access.

Information security management cycle
We have built a framework to run PDCA
(Plan-Do-Check-Action) cycles in our information
security management as a whole, including personal
information management. This framework defines
information security management cycles which run
through the stages of “Plan” to establish rules andmeasures, “Do” to implement measures, “Check” tomonitor and assess risks, and “Action” to continue
improvements.
In the “Plan” stage, we set information security
Figure 2‐❷

policies and measures, plan information securit y
education, and formulate audit plans for personal
information protection and information security.
In the “Do” stage, we deploy security measures within
the company and operate them. We are working toensure thorough knowledge of security measures andraise each employee's awareness through information
security education and awareness activities.
In the “Check” stage, periodic security operation
status inspections, audits according to the audit plan,

Information Security・Regulations related to personal information protection

Category

Figure 2‐❸

PDCA image diagram

Name of regulation
Information Security Management Rules
Hitachi Group Information Security Policy
Information Security Standards

Basicregulations

Hitachi Group Privacy Principles
Personal Information Protection Policy

Formulating policies and measures
Proposing education plans andaudit plans
Extending and operating measures
Implementing educational andpublicity activities

Regulations for Personal Information Management
Regulations for Confidential Information Management
Rules on website creation and information disclosure
Individual
regulations

Rules for the Management of Entry / Exit and Restricted Areas
Criteria for consignment of personal information handling

8

Implementing corrective
measures
Inspecting operational status
Implementing audits andfield surveys

a n d o n-s i te i n s p e c ti o n s by s e c u r i t y ex p e r ts a reconducted.
The “Action” stage takes corrective action based on the
results of audits, on-site investigations, etc. (Figure 2‐❸)Each fiscal year, the maturity of information security

measures is assessed based on the Cyber Security
Management Guidelines Ver. 3.0 issued by the Ministry of
Economy, Trade and Industry (METI), and the measures
for the following fiscal year and beyond are formulated.

Figure 2‐❹

wo r ks towa rd s d e e p e n i n g th e u n d e r s t a n d i n g ofinformation security and personal information protectionof the Hitachi Group as a whole.
■ Drill-based training for spear phishing email
attacks
Cyberattacks based on spear phishing emails are adaily occurrence. Every employee must be trained in how
to respond appropriately when targeted by such an attack.
We are globally implementing training on targetedat tac k e m a i l s fo r a l l e m p l oye e s i n c l u d i n g g ro u pcompanies. These drills involve sending emails thatapproximate those sent by actual spear phishingattackers, giving employees insight into the nature ofsuch emails and how to respond if they receive one. This
practical approach to education enhances the ability of
Hitachi employees to respond appropriately in the eventof a real attack. At the end of the training, instructions
are disseminated to the employees on how to recognize
suspicious emails, which raises the effectiveness of the
training.

Governance■ Information security training
An organization's ability to maintain informations e c u r i t y a n d p r o te c t p e r s o n a l a n d c o n fi d e n t i a linformation depends on its workers understanding theimportance of information security and making it part oftheir personal ethos as they go about their daily tasks.
Hitachi conducts annual training by e-learning of all
executives, workers, and temporary employees on thesubjects of information security and personal information
protection. The training participation rate for Hitachi, Ltd.
in FY 2022 reached 100% (excluding those on leave orotherwise unable to attend). Hitachi also formulates anannual information securit y training plan, andimplements it using a diverse range of education
programs tailored to specific subjects and purposes. For
example, one program might target specific group ofpeople like newly hired employees and another those in
new managerial positions, while another might offer
specialized education to people in roles such as
personal information protection manager. (Figure 2‐❹)
Hitachi, Ltd., makes its educational content available
to Group companies inside and outside Japan, andInformation Security Management

Educating workers on information security

Information security training target personnel and content

Category

Target audience

All staff education

・All employees
・Temporary employees
・Employees on secondment

The importance of personal information protection and confidential information
management, and the latest trends in information security

Executives and managers

Trends in personal information protection and the latest Hitachi initiatives

Newly-appointed section
manager or equivalent

Knowledge someone in a management position must possess in relation topersonal information protection, confidential information management, andinformation security, and Hitachi's initiatives in relation to personal information protection.

Newly-appointed assistantmanager or equivalent

Personal information protection, confidential information management, information security knowledge
necessary as a manager or equivalent, and Hitachi's efforts to protect personal information

New employees

The fundamentals of personal information protection, confidential information
management, and information security.

People responsible forprotecting personal information

Practical exercises and the specialized knowledge a person responsible forprotecting personal information must possess, such as internal and management
rules and real-world operating procedures.

Information asset manager

Knowledge required for an information asset manager to carry out their role asa manager of information assets including personal information in their division.

Description

Tiered education

Specialized
education9

Governance

Co-Creating Securuty

Jibungoto

Information Security Management

Management assessment and monitoring
Hitachi conducts regular audits and on-sitea s s e s s m e n t s to e v a l u a te a n d m o n i to r w h e t h e r
information security measures are being implemented
appropriately.

■ Personal information protection and information
security audit
Hitachi, Ltd., and all Group companies within Japan
conduct an annual audit of their personal information
protection and information security status. The audit ofHitachi, Ltd., is carried out by independent auditors
a p p o i n te d b y t h e C E O. To e n s u r e f a i r n e s s a n d
objectivity, the audit process is mutual audit.
Personal information protection and information
security audits confirm the following items.
Information security regulations, management of
information assets, and conformity of information
security measures
Personal information protection and conformity
between JIS Q 15001 and the personal information
management system
Conformity status of personal information protection
management system and JIS Q 15001
All Group companies in Japan undergo the same
audits as Hitachi, and Hitachi confirms the results.
■ On-site risk assessment
With an ever-expanding global presence, the Hitachi

Figure 2‐❺

Group makes its home in many countries and regions,counting headquarters, sales offices, service centers,
and manufacturing sites among its business entities.
T his e nvironme nt inevitably give s rise to dive rse
in-Group network environments and facilities and varied
installation and usage environments for IT equipment
and cloud environments, etc. There is alsoc o mmu nic atio n w i th ou ts id e pa r ti e s v ia inte r n etconnections, information storage media (USB storage),and other means. Preparing for security risks such as
spear phishing and malware infection is very important.
To address the risk that comes with changes to thebusiness environment, Hitachi has strengthened its
assessment framework that uses expert security teams.
Specifically, a security team will visit the workplace of a
BU or Group company and implement enhancementsfrom the following perspectives:(1) Carry out assessments of all products and internal
facilities that connect to the network of the HitachiGroup based on the latest security trends.
(2) Identify issues that might present a security risk andpropose effective countermeasures on site. (Figure 2‐❺)Since FY 2017, we have assessed a total of around
120 sites, identified a large number of security risks, andgiven advice on necessary measures. We also takefeedback from the problems that we encounter acrossthe company and incorporate it into the measures.

On-site risk assessment flow

Operational status(Surveys, standards,records)
Status report
On-siteWrittenreportCheck
list
Assessor
Summarization ofperspectives

Site check
Office10

Improvement

Countermeasures,
recommendations

Information Security Management■ Vulnerability check on public servers
Cyber attacks in recent years have found vulnerable
servers which are open to the internet and exploitedthem as entr y points to access internal networks,
leading to ransomware and other malware infections,and to thefts of personal and confidential information.
We regularly perform vulnerability checks on theservers that exposed to public using vulnerability searchsites such as Shodan.
We're working to reduce security risks by checking forany gaps compared to self checks run by the server
administrator.

Governance

Beginning in FY 2022, we intensified our assessmentsof overseas Group companies that are thought to haverelatively high security risks and of companies acquired
through M&A. This lets us identify security risks andmake suggestions to enable countermeasures at theearliest stage possible.

11Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Initiatives for Security Human Resource Development
To ensure its own internal security and to effectively implement security measures in the products andservices provided to customers, the Hitachi Group promotes company-wide human resource
development from a security perspective.

Our Approach to Security Human-Resources Education
In response to the intensification of cyberattacks inrecent years, the Hitachi Group has promoted humanresource development from a security perspective, tostrengthen its own internal security and to ensure thesecurity of the products and services it provides to its
customers. There are three categories of humanresource development. This initiative targets not only
high-level security experts, but also the technicians
involved in the development and operation of products
and services and the users of in-house IT services.
(Figure 2‐❻)

• Security experts who possess considerable security
skill and shoulder the security burden of the HitachiGroup• Human resources responsible for security measures inrelation to the design, development, and operation of
products and services provided to customers as well as
those at production and manufacturing sites• Personnel at junior level who understand the basics
and can respond appropriately when a security incident
occurs

Educational programs for each category of human resources
We are developing educational programs tailored tothree categories of human resources, and effectively
promoting human resource education according to theobjectives of each category.

■ Security expert
The approach to human resource development for
security experts includes high-level training techniquessuch as cyber range exercises, and the provision ofcommunity sites that support information sharing and

Figure 2‐❻

Three security HR categories and training measures

Category of human resource

Attributes

Training approaches

Human resources whose duties revolvearound security, who have a high skill
level in relation to security, and whoshoulder the burden of Hitachi's security

・Provision of specialized training suchas cyber range exercises
・Security specialist certification

Human resources responsible
for security measures of
products and services

Human resources who can implement theappropriate security measures in thedesign, development, operation,
manufacturing, and production
environments for products and services

・Provision of training related to security
measures associated with their work
・Visualization of training status

Personnel at junior level

Human resources who understand thefundamentals of security and are capableof an appropriate initial response when asecurity incident occurs

・Provision of basic security course andentry-level training for cyberattacks

Security
expertSkill level

Size of each category

12

cooperation. Hitachi established its Hitachi Certified IT
Professional framework for security experts in August of
2014. T his ce r tific ation f ra mewor k for Hitachi IT
profe ssionals conforms to the IPSJ Model for IT
Professional Certification. Under this certification model,
candidates with the necessar y securit y skills are
i d e n t i fi e d, t r a i n e d, a n d e v a l u a te d to p u r s u e a n
appropriate career path as an information security
specialist (HISSP: Hitachi Certified Information Security
Specialist) Hitachi has now certified more than 1,800
such experts.

Figure 2‐❼■ Personnel at junior level
The development of Personnel at junior level targets
many people with the objective of raising the security
awareness of the company as a whole and enhancing
its security countermeasures. In addition to imparting
fundamental security knowledge, this initiative ingrains
the appropriate initial response when a cyberattack orother security incident occurs. Training for Personnel atjunior level including the Basic Knowledge e-learning
Program for Cybersecurity Countermeasures and theCommunication Training for Cybersecurity Response,
has been provided since FY 2016 and taken by morethan 10,000 people. Hitachi also provides e-Learning
programs on security fundamentals for people who
require introductory training. In response to the societal
changes brought about by COVID-19, a class-rooms t y l e tra i n i n g i s n ow c o n d u c te d o n l i n e, a n d th e
Communication Training for Cybersecurity Response
offered to Personnel at junior level in a workshop format
has also moved online since FY 2020. (Figure 2‐❼)

Information Security Management

assessors to handle ef for ts to strengthen security
systems for products and services.

Governance■ Human resources responsible for security
measures of products and services
Human resources responsible for security measuresof products and services are those who promote thenecessar y security measures as part of their work
providing the product or service. These people areresponsible for carrying out the appropriate security
measures during the design, development, operation,and maintenance of products and services, and when
preparing the environments in which this work takes
place. Also important is the development of security
human resources focused on production andmanufacturing. These human resources are provided
with education to promote an understanding of security
me asure s according to company re gulations.
Environments must be created and operated in a waythat maintains the safety in the design and developmentof products and ser vices and at production andmanufacturing sites, while allowing neither of theseenvironments to adversely affect the other. To this end,
Hitachi is engaged in improving the skill of its workers in
relation to security measures for IT and OT.
We have also imple me nte d me asure s such as
developing key PSIRT personnel and security risk
Education for Personnel at junior level

Basic Knowledge e-Learning Programfor Cybersecurity Countermeasures
Training for learning behavior andimpact when a cyberattack occurs【Basic knowledge】(1) Matters to note in your daily work, (2) Responding
to cyberattacks, (3) Matters to note during
development, (4) Collecting vulnerability information
and assessing countermeasures, (5) Preparing for asecurity incident【Hands-on learning】(1) Information leakage from a spear phishing attack,(2) Damage to business from ransomware infection,(3) Damage caused by a vulnerability in a web
application, (4) Damage due to malware

Communication Training for
Cybersecurity Response (workshop)
Training in understanding the situation
when an incident occurs anddetermining a course of action【Response process】

Experience the speed and accuracy required in the(1) Observe, (2) Orient, (3) Decide, and (4) Act stages【Communication skills】

Understand the importance of knowing your role andresponsibilities when (1) reporting, (2) notifying, and(3) discussing, and the importance of accurately
describing an event using the 5W1H method13

Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Action to Strengthen Global Information Security
Information security initiatives are essential to the Hitachi Group's presence on the global stage. To
ensure reliable implementation of security countermeasures, Hitachi is strengthening its global
governance by sending information security experts in various regions to entrench global security
governance.

Enhancing governance through information security experts
Asia, China, and India who are suppor ting loc alsubsidiaries in their region.
ISEs work with organizations that control security to
improve regional governance. (Figure 2‐❽)
To establish regional communities, open lines ofcommunication, and foster security awareness, ISEs
hold cybersecurity workshops and online seminars, andpublish a security newsletter, as an adjunct to traditionallines of governance via parent companies, supporting
better governance of local subsidiaries. (Figure 2‐❾)In the Governance line for information security, as e c u r i t y m a n a g e m e nt d i v i s i o n i n H i t a c h i G ro u pcommunicates security policies and measures to andinstruct BUs and Group companies. Then, those
instructed will deliver the instructions their own overseas
subsidiaries for implementation.
To support the advancement of information security
at a global level, Hitachi has in 2019 posted ISEs
(Information Security Experts) in various regions andbegun activity intended to entrench governance. As of2023, Hitachi has posted ISEs in the Americas, Europe,

Figure 2‐❽

Governance strengthening system of Information Security Experts (ISE)

Hitachi, Ltd.
HQ (corporate)

BU

BU

Group company

Group company

Group company

Group company

Group company

ISEs support the promotion of information security at Group companies in their regions.
Americas region
ISE Team

Figure 2‐❾

Europe region
ISE Team

Asia region
ISE Team

India region
ISE Team

China region
ISE Team

Main activities of information security experts (ISEs)

Key ISE activity
Formulating and implementing security plans in cooperation
1. with organizations responsible for security

5. Supporting security activities to be aware of “Jibungotoka (Ownership)”

Ascertaining the level of cybersecurity maturity and the reach of
2. governance and supporting companies in their efforts to improve6.

3. Establishing security communities in various regions

Participating in outside conferences to gain insight into the
7. latest trends

Holding workshops for people responsible for security of
4. overseas subsidiaries

14

Working together with impacted divisions in relation to local
laws and regulations

and compliance.
Hitachi visualizes and analyzes the results of thesurvey of executives of overseas subsidiaries, and uses
the results of this process to develop concrete plans toimprove the entrenchment of governance. It shares thevisualized data with the people who manage and control
security for BUs and Group companies, and is also
effectively used as an indicator in the Plan, Do, Check,and Act stages of the PDCA cycle. (Figure 2‐❿)
We promote PDCA implementation from the two
perspectives of management and the workplace.

Governance

The Hitachi Group promotes better IT governance byconducting self-assessment and third-party assessmentof IT a nd se cur it y c ounte r m e a sure s f rom a fie ld
perspective.
Hitachi sur veys the executives of overseas
subsidiaries to assess their knowledge of security
governance initiatives. This of fers insight into thematurity level of security governance from amanagement perspective that goes beyond a
conventional field perspective.
This survey covers a range of themes including …,
inte r n a l IT se cu r i t y, se cu r i t y fo r p ro d u c tio n a nd
manufacturing, product security, third-party vendors,

Information Security Management

Security status visualization and PDCA activity

Figure 2‐❿

The process of global security status monitoring and assessment feedback

Share and instruct

Parent company
Enhance andimprove
Evaluation
perspective

Monitoring

Executives
perspective

Evaluatematurityof security
governanceLocal
subsidiary

Executives

Self-assessment(IT and security)

Security officer

Evaluation method

Evaluation items

Survey of
executive knowledge

・Governance framework
・Human resource development

Information security
management division ISE
knowledge assessment
interviewSelf-evaluation of
implementation of
IT and security measuresfor people responsible
for security in the field

On-siteperspective

On-sitesecurity risk
assessment

Identify gaps between
self-evaluationand on-site inspection

・Incident management
・Compliance・IT governance

Divisions responsiblefor information
security

Global information
security
expert committee
Sharing level ofgovernanceentrenchment andpromoting greater
entrenchment

・IT security
・IT configuration management
・Compliance・Checking of self-evaluation items
・Identifying residual risk
・Checking status of measures
to enhance robustness

ISE

15

Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Action to Strengthen Information Security in M&A
Hitachi is working to reinforce information security governance in companies which newly join the
Hitachi Group, to minimize the security risks which arise as we actively pursue M&A.

Policy on reinforcing information security governance in M&A
The Hitachi Group actively pursues M&A as a way to
expand our business. M& A generates new value by
integrating companies with differing corporate cultures.
On the other hand, we must minimize the information
security risks that occur as we integrate policies andsystems.
If we discover an information security incident after
acquisition, there is the risk of major impact that could
extend beyond the acquired company to the entire

Hitachi Group (affecting corporate value, sales activities,
and more). Therefore, it is essential for us to identify any
information risks as soon as possible and control themappropriately. Starting at an early stage of the M& A
process, it is important to enforce in the company to beacquired an understanding of, and compliance with,
Hitachi rules, and to apply controls and management
based on Hitachi policies.

Information security risk assessment during M&A
Our risk assessment during M&A is divided into twophases: before and after the contract is signed.
① Information security risk assessment performed
before contract signing (Day 0).
We analyze the information security of the acquiredcompany on the basis of published information andinformation provided to us in advance. This analysis
covers mat ters such as information securit yorganizations and systems, the readiness of rules,
policies, and standards, the characteristics of thebusiness and its adaptation to the legal system of thecountr y or region, and the occurrence of any
cybersecurity incidents and responses to them.
② Securit y assessment per formed af ter contract
signing (Day 0).

Figure 2‐⓫

Information security risk assessment and security assessment

Reach basic agreement▼
M&A
process

Pre-deal

Day 0 (Execute contract)▼

Due diligence①Evaluation of information security risk
● Risk of costs occurring due to cybersecurity attacks● Risk of leakage of confidential information● Risk of violation of national laws on the handling of personal data
● Responses to cyber attacks and other security incidents

16

We select the sites to assess on the basis of thesituation, characteristics, etc. of the countries andregions where the acquired company does business.
Next, we have the company perform a self assessmentof the selected site, addressing risk assessment items
which we have prepared for each subject field on thebasis of Hitachi rules. After that, Hitachi headquarters
makes a direct visit to the assessed site and checks the
local situation, to get a more detailed grasp of the resultsof the self assessment. Finally, if there are any matterswhich do not comply with Hitachi rules, we have thecompany prepare a corrective plan, and follow up until
the correction is complete. (Figure 2‐⓫)

Day 1 (Closing)▼

Prepare Closing

Migration②Security assessment● Mutual understanding of implementation methods corresponding to
the nation or region and business characteristics, etc.
● Self assessment of security risks according to Hitachi rules● Hitachi headquarters checks the on-site reality of the self assessment results● Correction and follow-up for non-complianceCybersecurity risks and information security risks

Development andvalidation environment

In-house IT environment

Production/manufacturing
environments

Products and services

Data protection

Common items (supply chain, governance)

Internal networks

Devices such asexternal public servers

Devices not connected
to internal networks

Internal IT devices(PCs, servers, etc.)

Information Systems Department management

Figure 2‐⓭

Devices for use
in development

Devices for use
in production

Devices for use
in validation

Devices for use
in manufacturing

Devices for use
in demonstrations

Devices for use
in inspection

Information Security Management

Figure 2‐⓬■ Target fields and assessment items for security
assessment
Hitachi sees all devices and systems used in productdevelopment and manufacturing, the environments
which deliver products and services to customers, andother areas as subject to cybersecurity risks, not just thePCs and servers (internal IT environments) employeesu s e i n r e g u l a r o f fi c e w o r k . W e a l s o c h e c k t h emanagement methods and the leak countermeasuresr e l a te d to p e r s o n a l i n f o r m a t i o n p r o te c t i o n a n d
confidential information management. (Figure 2‐⓬)
The assessment items for securit y assessment
consist of 10 categories, based on internal security
standards (Hitachi rules) that were formulated withreference to ISMS and the NIST SP-800 Series, andtaking information security incidents in recent years into
account. (Figure 2‐⓭)Governance■ Hitachi's Approach to Security Risk Assessment
Regardless of the size of the company when it isacquired, it is important to correctly grasp the existenceof information security risks at an early stage in thenegotiation. We must assess what kind of risks arepresent according to the business activities and service
content, but if there are clearly risks such as information
leakage, we must consider passing on the acquisition
cost and the IT system migration costs.
If a severe information security risk is discovered that
require s corre ction, we must deliberate with theacquired company about specific measures to reducethat risk in the future, and move forward with planned
improvement measures.
Hitachi practices information sharing with the wholegroup, alongside feedback, while also building controls
and systems for appropriate control of each company's
risk situations, and maintaining a comprehensive
overview.

Protection of
personal information
Service provisionenvironments

GDPR compliance
Confidential information
management

Individual management by Individual management by Individual management by
each organizationeach organizationeach organization

10 categories of security assessment items

Vulnerability
countermeasures

GovernanceAccount and accessprivilege management

Security incident
response

10 categories
of security
assessment

IT configuration
management
Softwaremanagement

Supply chain

Cloud management

Network security

Data protection17

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
Cybersecurity Management
The diversification of cyberattack techniques means incidents come from many sources and theirimpact can be magnified. To deal with these risks, Hitachi has expanded the scope of security risk
management. A traditional focus on internal IT environments in an OA context has been expanded toinclude the development, verification, production, and manufacturing environments, supply chains, anddevelopment processes for products and services, ultimately reducing business risk.

Initiatives to enhance cybersecurity countermeasures
A s I T p e r m e a te s p r o d u c t i o n, m a n u f a c t u r i n g,
development, testing, and other business operations,
there is an increasing need to respond to attacks
outside the traditional office automation environment, as
well as cybersecurity measures for products, services,and procurement. (Figure 2‐⓮)

Figure 2‐⓮

For this reason, since 2018, we have been working tostrengthen cybersecurity measures for internal OA,
development and testing, environmental systems inproduction and manufacturing, and process systems inproducts, services and supply chains. Various initiatives
are underway to strengthen cybersecurity measures ineach area. (Figure 2‐⓯)

Expanding the scope of cybersecurity countermeasures

Areas where security
countermeasures apply
to products themselves
Products/services

Areas where security countermeasures apply
to the environments in which things and services are created= Areas requiring in-house risk countermeasures
Production/
manufacturing environments

Development/
testing environments

Manufacturing
environment

Development
environment

Production
environments

Testingenvironments

Inspection
environment

Demonstration
environment

In-house OA environment

Under information systems
divisions group control

Under human capital
general affairs group control

Products/systems

Services provided
to third parties

In-house OA environment
In-house IT environments(Printers, entry/exit management etc.) (no GWAN connection)
In-house OA environment(PCs, servers, etc.)

Hitachi global
corporate network

Publicly accessible
server environments

Supply chain

Expansion of scope(acknowledge importance of countermeasures)

Figure 2‐⓯

Summary of actions to enhance cybersecurity countermeasures in various areas

Target divisions

Area

IT

In-house OA
Development andtesting

Environment

Manufacturing andproduction
Products andservices
Processes
Supply chain

18

Focus on corporate IT (OA systems)

Design anddevelopment
Manufacturing
andproduction
Quality assurance
for design anddevelopment
Procurement

Overview
・Formulating and disseminating requirements for connection to and isolation from the in-house OA environment
・Formulating and disseminating guidelines for creating in-house OA environments and environments for securely connecting to them・Formulating and disseminating guidelines for creating manufacturing and production environments based on IEC 62443
which is a series of standards related to protecting control systems from cyberattacks
・Formulating quality management policies for the security of products and services
・Formulating and disseminating requirements for product design, development, and maintenance processes
・Formulating requirements for cybersecurity countermeasures for business partners and evaluating them based on evaluation
processes

Promotion framework
cybersecurity countermeasures in BUs and Group
companies.
E a c h d i v i s i o n d i s s e m i n a te s a n d e n f o r c e s i t scybersecurity countermeasures under the direction of
the cybersecurity officer. (Figure 2‐⓰)

HQ (corporate) is planning measures to enhancecybersecurity by establishing subcommittees for eacharea under the auspices of the cybersecurity expert
committee.
The policies of each subcommittee are rolled out via
the cybersecurity of ficers whose role is to enforce

Figure 2‐⓰
Cybersecurity
promotion framework

Governance■ Security enhancement in development/testing
environments
Development/testing environments include various
environments for purposes such as development,
testing, research, and demonstrations. We also use
connections to customers' environments, the internet,
and cloud environments. Security requirements vary
between environments, but we have prepared guidelines
for configuring and connecting each environment safely,
and we are working on applying the guidelines acrossthe Hitachi Group. Development forms will go onchanging due to factors such as use of the cloud andworking from home, so we review our guidelines on aregular basis, and work to maintain and enhance
security. (Figure 2‐⓱)

■ Security enhancement in in-house OA
environments
Security enhancement in in-house OA environments
means setting standards for vulnerability
countermeasures and network security, etc. to protect
the networks, IT devices, and information systems used
in internal office work from security risks, and requiring
each BU and Group company to periodically check andcorrect the state of countermeasures. As a common
measure for all companies, we have started monitoring
the status of vulnerability countermeasures for eachdevice and following up with users and administrators,
and we are expanding the range of application of thisaction.

Cybersecurity Initiatives

Initiatives to strengthen security for each environment

Cybersecurity Expert Committee: HQ (corporate)
In-house IT

Development and testing

Manufacturing andproduction

Products and SI

Supply chain

IT divisions

Security divisions

Manufacturing andproduction innovation divisions

Quality assurance divisions

Procurement divisions

Cybersecurity countermeasures
enforcement function

Cybersecurity officers
Design and production
technology division

IT division

Manufacturing andproduction division

Quality assurance
division

Procurement division

BUs and Group companies
Figure 2‐⓱

In-house OA
environment
EnterprisenetworkDevelopment/testing
environment security network

Environment
in the cloud

FW

Internetpublication

Cloud use

Development/testing
environments

FW

Large-scale
development
environment
Development
project A

Internet

Research
environment

Testingenvironment

Research
environment

FW
Demonstration
environment

Closedenvironment

Individual
development
environments

Client OA
environments
Connections
to othercompanies

Development
project B

Development
project C

Clients' internal
environments

FW

FW
Individual
development
environments

19

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives■ Security enhancement inproduction/manufacturing environments
It is important that manufacturing and production
environments do not affect other environments, such as
internal OA and development environments, andvice-versa. Hitachi has established guidelines governing
the creation and operations management of mutually
secure connection environments, and acts according tothose guidelines within the Hitachi Group. (Figure 2‐⓲)
At actual sits of manufacturing and production,
posters and rulebooks on information security help
employees remember their responsibility to comply intheir daily work. This leads to greater security awarenessin the manufacturing and production sites.(Figure 2‐⓳)

Figure 2‐⓲

Figure 2‐⓳

Posters/rule collections for production
and manufacturing workplaces

Content of guidelines for production/manufacturing environments and an illustration of their use

HQ and BU cybersecurity
management divisions
Feedback

Cybersecurity
management
divisions ofindividual sites

Departmentsthat operate
systems at
individual sites

Chief officer

20

Security guidelines for
manufacturing andproduction environments(Management edition)
Scope

Feedback

Site
Site
Site
policies and policies and policies andwrittenwrittenwritten
instructions instructions instructions

Manufacturing andproduction lines
Operatingadministrator
department A

Operatingdepartment B

WrittenWritten
instructions instructions

Field managers
Field workers

Written
instructions

Manufacturing/production line A

Operatingdepartment C

Feedback
Written
instructions

Manufacturing/production line B

Security guidelines for
manufacturing andproduction
environments(System edition)
Scope

Manufacturing/production line C

Guideline structure

Description

Target audience

Management edition

From a managerial perspective (as initiatives for organizational andhuman resource management), this document describes the process
of formulating and revising rules related to security operation andmanagement for an entire site and specific divisions.

Person responsible forcybersecurity management

System edition

D e s c r i b e s t h e s y s t e m c o n fi g u r a t i o n a n d a p p r o a c h t ocountermeasures in terms of ascertaining the current status andassessing countermeasures based on IEC 62443-3-3 with model
used by the Hitachi Group. The contents of this document arereference to a typical customized by each division and department.

Manufacturing/production line manager
Field manager
Field worker

Initiatives to enhance supply chain security

Checks status of countermeasures

Reports results

Security strengthening system in the supply chain

Security initiatives related to products and services

Figure 2‐

Governancecybersecurity risks and the importance ofcountermeasures for those risks. In relation to the IT
systems, OT systems, IoT devices, and other assorted
products and services provided by the Hitachi Group,

Hitachi's digital solutions business provides new
customer value through increasingly sophisticateddigitalization and networking technology and more open
systems. However, this is accompanied by a growth in
Fields of products and services provided by the Hitachi GroupInternet(cloud)IT system
Information system that supports business operations
Businessapplication
serverWi-Fi

IT
infrastructure
server

DatabaseserverCybersecurity Initiatives

Figure 2‐⓴

Information security criteria

Procurement
partners

Hitachi Group
companies

To have procurement par tners handlie Hitachi’s
information assets with security considerations, Hitachiverifies and screens the partner's information security
levels in advance, based on Information security
criteria set by Hitachi.
These information security criteria havesupplementary information security guidelines whichhave added security measures against recent cyberattacks on supply chains.
Hitachi also specifically stipulates requirements
c o n c e r n i n g i n fo r m a ti o n s e c u r i t y, a g a i n s t w h i c hprocurement partners can perform checks (Figure 2‐⓴)

Office PC

OT system
Industrial control systems and operation support
systems for plants and factories
Production
management
serverWi-Fi

Control server

Generic
PC

HMI※1

ENGS※2

IoT devices
Embedded systems that use IT
and information network
technology
Note: Can be embedded in IT/OT systems

Controller

Controller
Remote I/O※1 Human Machine Interface※2 Engineering Station21

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
Hitachi continues to promote initiatives intended toprotect customer assets and social infrastructure fromcyberattacks. (Figure 2‐ )■ Security management policy for products andservices
To unify the approach to security management for the
many and varied products and services of the HitachiGroup, Hitachi has prepared guidelines for quality
assurance in the form of a Security Management Policy
for Products and Services and related documentation.
(Figure 2‐ )By applying the contents of this policy to its own
security management regulations, each division canadvance the implementation of secure processes acrossall stages of the lifecycle of its products and services
including development, manufacturing, maintenance,and operation. (Figure 2‐ )■ Dissemination of guide material and support
activity
Hitachi disseminates various guidebooks, such as the

Figure 2‐

Secure Process Implementation Guide, and otherresources to help divisions develop their own security
management polices. These resources accumulate andshare the know-how of the Hitachi Group by presentingcase studies of the initiatives of divisions that have taken
the lead in terms of security measures. The case studies
cover implementation procedures and the like for each
design and manufacturing, operation and maintenance,and security incident response process.
Hitachi shares this guidance materials on the intranet
and assists all divisions in preparing their own securedevelopment processes.
■ PSIRT and security management system forproducts and services
Based on the aforementioned “security management
policy for products and services,” in order to continue toprovide safe and secure products and services, we haveappointed a person in charge of product security ateach BU and group company and established a security
management system under the control of this person. In
order to respond to any vulnerabilities or incidents that

Security management policy for products and services

Security management regulations etc.
Security Management Policy for Products
and Services

A policy intended to unify the approach to security management for the products and services(hereinafter products) of the Hitachi Group.

Requirements for product development
and maintenance processes

Requirements that apply to processes associated with product development and maintenance. These
requirements form the basis for specific tasks appropriate to the nature of the product and can be
enforced through checklists or other means as needed.

Product security inspection checklist

An inspection checklist used to confirm that the product development and maintenance processes ofthe division conform to the policies and criteria.

Figure 2‐

Overview of development and maintenance processes to ensure security

1.Design/manufacturing process
1-1. Risk analysis and requirements
definition/basic design

2. Operation/maintenance3. Security incident
response process

2-1. Change management

3-1. When detected internally2-2. Collecting vulnerability information

3-2. When detected externally

1-2. Configuration management

2-3. Predictive maintenance3-3. Regular drills

1-3. Design/manufacturing2-4. Routine vulnerability inspections

1-4. Procurement (including OSS)
1-5. Testing and evaluation
1-6. Inspection

22

Overview

2-5. Reporting of vulnerabilities andcountermeasure information to
the customer

■ Pioneering initiatives related to ensuring security
for products and services
To ensure the security of information-related products
and services provided to its customers, Hitachi, Ltd., hasestablished frameworks to assess and formulate
security measures. Hitachi implements and improves
securit y measures according to the securit y
management process. The pioneering initiatives over thelong term are as follows:(3) Promoting measures concerning the placementof security personnel
In order to ensure security quality to counter security
risks in products and services, we have defined three
types of personnel with appropriate qualifications,experience, and knowledge (① security risk assessors,② s e c u r i t y s y s te m s a rc h i te c t s, a n d ③ s e c u r i t yoperations administrators), and we are advancing
measures to allocate them to each review, design andtesting, and operation process. Security risk assessors
are appointed by the head of each businessdepartment. They conduct security reviews from theirexpert perspectives, and give advice and guidance. The
security systems architect and security operations
administrator use their expert knowledge to design, test,
and operate security for each project. This allows us todevelop and operate products and ser vices withassured security and deliver them to customers.

( 1) F o r m u l a t i n g a n d i m p l e m e n t i n g s e c u r i t ycountermeasures
Hitachi promotes the formulation and implementationof security countermeasures. For example, becauseinternet connections are typically high risk, Hitachirequires approval for internet connections. A framework
is in place that prohibits internet connections or sharing
without the appropriate permission. This approach has
also been adopted by related Group companies, andmeasures formulated through collaboration have been
deployed to and used by related business divisions.

(4) Implementing vulnerability inspections
Hitachi conducts regular vulnerability assessmentswith the aim of minimizing damage from attacks that
exploit vulnerabilities. These inspections occur routinely
or when starting a new development or changing anenvironment. Methods of inspection include a qualitative
approach that uses a checklist and an approach thatuses a vulnerability inspection tool. These methods canbe used independently or together to conduct aninspection appropriate to the characteristics andoperation status of the system.

(2) Product and service development and operationthat conforms to security management processes
Hitachi defines security management processes foreach phase of product and service development andoperation. Formalizing rules based on these processes
has allowed securit y countermeasures to be
implemented reliably within organizations. Using theconcept of a security ranking by risk level and clarifying
the criteria for such a ranking, the security management
process is presented to define the securit y levels
required for development and operations, based on the
ranking. The use of a security ranking encourages
people to take the appropriate measures commensuratewith the seriousness of the risk, but also promotes a wayof thinking that considers the balance between risk andc o st. T h e s e p ro c e s s e s a re li n ke d w i th H i tac h i's
standardized development process for information
systems. The contents of the formalized securit y
management processes are revised regularly or asneeded. This process takes place based on feedback
from actual incidents, manifesting risks, and lessons(5) Handling vulnerability-related information andestablishing an incident response framework
To reduce the likelihood of an exploited vulnerability
causing a security incident, Hitachi has created a guidethat summarizes handling process forvulnerability-related information in divisions that provide
i nfo r m ati o n-re l ate d p ro d u c ts a n d s e r v i c e s, a n d
encourages activity based on this guide. Hitachi also
provides a response framework and response manualaccompanied by drills to ensure a rapid and appropriate
response when a large-scale incident occurs.

Cybersecurity Initiatives

learned from operations to continuously improve themanagement processes.

Governancemay occur under the security management system, a
PSIRT (Product Security Incident Response Team) has
been established at the headquarters (of corporate) andat BUs and group companies as an organization in
charge of security technical response for products andservices. The PSIRTs work together to appropriately
respond to vulnerabilities and incident responses for
products and services.
T h e H i t a c h i G ro u p’s PS I RTs h ave e s t a b l i s h e dguidelines for the activities required of PSIRTs, andoperate according to these guidelines.

23Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
Cybersecurity Countermeasures
To stay on top of its handling of cyberattacks and incidents, Hitachi enhances security monitoring andincident response at the Hitachi Security Operation Center (SOC). We also take proactive measures bycollecting and analyzing threat information, and disseminating vigilance information.

Enhancing security monitoring and incident response
Recently, there have been more at tacks where
genuine authentication information is acquired
fraudulently and used maliciously. These attacks are
difficult to detect since genuine authentic authentication
i nfo r m ati o n i s u s e d. S o, we h ave e n h a n c e d o u r
monitoring of the authentication system to allow early
detection of fraudulent account use by third parties.

Security risks are increasing not only for individualcompanies and organizations, but across the supply
chain, with complex and ingenious cyberattacks such as
targeted attacks, ransomware, and double extortion. To
establish an ef fective line of defense against suchcyberattacks, it is crucial to discover them early and limit
the damage. To enhance its security monitoring andincident response capabilities, Hitachi, Ltd. established a
Hitachi Security Operation Center (Hitachi SOC) in
October of 2017. The Hitachi SOC operates 24 hours aday, 365 days a year, detecting threats such as malware
infection or unauthorized access at an early stage. Thiscondenses the timeline from initial response to resolution
and minimizes the extent of damage.

■ Incident response
T he Hitac hi G roup has e sta blis he d a ha ndlingprocedure and contact system that come into play when
an incident occurs. This allows the cause and scope of
impact of an incident to be quickly identified and theappropriate countermeasures to be taken. Since 2020,
we have been able to capture the details of any incident
more quickly by combining log monitoring of core bases
and EDR surveys. This means that we can judge theresponse priority and whether a response is required,allowing us to handle incidents more efficiently.
Moreover, we can handle the new threats associatedwith work-from-home environments by monitoring theauthentication system. The know-how we gather during
incident response is then fed back to various internal
security measures, making it less likely that the samekind of incident could occur again. (Figure 2‐ )■ Security monitoring
The Hitachi Group has established systems andnetwork monitoring points that cover the entire globe for
integration, analysis, and monitoring of logs. We have
expanded our monitoring scope since 2017, and oursystems now cover all core global bases. With theintroduction of EDR (Endpoint Detection and Response),
we can now also monitor the operation of devices, carryout surveys, and address issues. This means that we
can analyze logs from EDR and core bases incombination, and implement high accuracy, efficientmonitoring.

Figure 2‐

Global security monitoring and incident response

Americas

Asia

Oceania24

Sites

Regular security risk and incident status reports
Security monitoring

Incident response

Hitachi SOC

Collection of
threat information
Threat information
EDR

Authentication
SystemMonitoring

Dispatch

EuropeSecurity monitoring

Japan

Applicable division

IT administrator

System administrator(Individual systems)

■ C o ll e c t in g , a n a l y zin g , a n d ve r i f y in g t h r e a t
information
When collecting information, in addition to thefollowing vulnerability and threat information publishedon the web, we also make use of a range of CTI (Cyber
Threat Intelligence) services to collect information on
threats in Japan and internationally.
Information sites operated by public third parties suchas IPA, JPCERT/CC, and CISA
Security-related news sites
Blogs and white papers published by various security
vendors
We use metrics published by the information provider(such as severity and CVSS base score) to classify
threats into five vigilance levels, based on factors suchas their likelihood of success and the prevalence of thevector in internal systems.
For some threats, we use a simulated environment top e r fo r m ve r i fi c ati o n s. T h i s a l l ows u s to c o m p i l e
information to assist with our investigations of impact,
countermeasures, and damage, which we use in ourcountermeasure activities.
We also collect and organize information on the
rapidly changing security-related legal systems ofvarious countries in order to augment risk response in
the Hitachi Group.
Figure 2‐

Application of threat information in
ordinary times and extension to
emergency measures■ Disseminating security advisory information
Collected information is disseminated to selected
people responsible for cybersecurity of BUs and Group
companies. This might take place by email (immediate or
we ek ly dige st) or posting to an internal website.
Additionally, to enhance countermeasures, when athreat has the potential to widely impact the whole
Hitachi Group’s operations, we issue a cyber warning tourge thorough implementation of countermeasures, andwe consider issuing a cyber BCP order. We also survey
public systems outside of the company, and if there is arisk of damage, we contact the relevant departments
individually and recommend countermeasures. We use
this collected and analyzed information to enhanceincident responses and monitoring, and to collaborate
with Hitachi SOC and the IT System Department inhunting for threats.
From the knowledge gained through these activities,
we examine the current status of the Hitachi Group andcountermeasures that require improvement. We thenshare the information with the HQ Security Management
Division, which leads to deliberations at the
management level about security strategy for the HitachiGroup, accelerating the security response execution
cycle.

Governance

Hitachi, Ltd. collects and analyzes threat information,and disseminates vigilance information, to ensure thesecurity of the information systems used internally andthe products and services it provides to its customers.
We share the knowledge gained from these activities
w i th th e CISO a n d ad va n c e d e lib e rati o ns at th e
management level about security strategy for the HitachiGroup.

Cybersecurity Initiatives

Collecting and Analyzing Threat Information, and Disseminating Vigilance Information■ Taking action in emergency situations
If a threat might severely impact business operationsat numerous sites within Hitachi, or would render
continuation of business impossible on a company-wide
scale, Hitachi establish a task force that directs the
response at the company level, with measures such a
issuing a cyber BCP. (Figure 2‐ )(Company-wide) Emergency Response
Headquarters establishedManagement

Information sharing and security strategy advice

Outside organizations, etc.
(IPA/JPCERT and others)

Cyber BCP

Major threat andincident detection

CISO and otherexecutive members

BUs and Group companies

Information Vulnerability
information
Collecting and threat
Security-related
information

Feedback

Information sharing and measure suggestion

LiaisonInformation analysis and warning level determination
Intelligence generation

vendors

Incident detection andemergency contact

Information security officer
IT

Investigation
Response and application Verificationcooperation

QA

Development

Security
advisory

Monitoring
Various CTI services
Public information

Hitachi SOC・Countermeasure
instructions
・Incident response

Internal information systems

25

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
CSIRT Activity in the Hitachi Group
Hitachi established the Hitachi Incident Response Team (HIRT) as a CSIRT (Cyber Security Incident
Readiness/Response Team) to support our cybersecurity countermeasures. By preventing theoccurrence of security incidents and promptly responding to them if they do occur, the HIRT
contributes to the realization of a safe and secure network environment for our customers and society.

What is an incident response team?
A security incident (hereinafter incident) is an artificial
cybersecurity-related occurrence, examples of which
include unauthorized access, denial of service, anddestruction of data.
An incident response team is a group of people who
lead incident operations to resolve issues throughinter-organizational and international cooperation. Thes k i l l s e t of a n i n c i d e n t re s p o n s e te a m i n c l u d e sunderstanding and communicating threats from atechnical perspective, coordinating technical activity,and liaising with external parties on technical matters. A
team with these skills can prevent (through readiness)and resolve (through responsiveness) various issues thatmight arise.

Model of HIRT activity
The role of the HIRT is to provide ongoing support for
Hitachi's cybersecurity countermeasures throughvulnerability handling, which eliminates vulnerabilities
that threats might exploit, and incident response which
involves evading and resolving cyberattacks. The teamapproaches these tasks from the perspective of
intra-organizational activity and collaborative activity.
Intra-organizational activity covers information security
initiatives targeting Hitachi's corporate information
systems, and collaborative activity covers initiatives
intended to ensure the cybersecurity of products andservices targeting our customers' information systems
and control systems. HIRT's mission also includes
helping to realize a safe and secure internet society bycatching the early signs of nascent threats and taking
preventive measures at the earliest possible stage.
The HIRT has adopted a model that consists of four

26

IRTs (Incident Response Teams) to advance vulnerability
handling and incident response. The four IRTs are:(1) Product vendor IRT, responsible for developing
products related to information systems and control
systems(2) SI (System Integration) vendor IRT, responsible forbuilding systems and providing services using theseproducts(3) In-house user IRT, responsible for managing theoperation of Hitachi's information systems as an internet
user Plus the fourth:(4) The HIRT/CC (HIRT center) which coordinates among
these IRTs, combining to create a model that makes therole of each IRT clear and promotes ef ficient andeffective security countermeasures through inter-IRT
cooperation. (Figure 2‐ )Four IRTs that support vulnerability countermeasures and incident response activities

Ensuring the security ofcustomer systems

Information security
initiatives

Addressing vulnerabilities
in Hitachi products

Ensuring the security of
in-house infrastructure

SI vendor IRT

Product vendor IRT

Internal user IRT

Divisions that provide SI
services to third parties

Product development
division

Divisions managing
in-house infrastructure

HIRT center (HIRT/CC)
Liaison and coordination among IRTs

Hitachi

Building a global networkwith external IRT communities

Information Security Early
Warning Partnership

Category

Cybersecurity Initiatives

Initiatives to bolster cybersecurity of
products and services

Governance

Figure 2‐External IRT communities
such as FIRST*Role

HIRT/CC*

Applicable division: HIRT center
Promotes vulnerability countermeasures and incident response activity throughcoordination with external IRT groups such as FIRST, JPCERT/CC* and CERT/CC*,and cooperation with SI vendor IRTs, product vendor IRTs, and in-house user IRTs.

SI vendor IRT

Applicable division: SI/service division
Supports vulnerability handling and incident response for customer systems by
ensuring their security in the same way as in-house systems in relation to known
vulnerabilities.

Product vendor IRT

Applicable division: Product development division
Supports vulnerability countermeasures for Hitachi products by investigating froman early stage whether any products are affected by known vulnerabilities, andtaking action to resolve any issues found by patches or other means.

In-house user IRT

Applicable division: Divisions that provide internal infrastructure
Supports promotion of vulnerability countermeasures and incident response so that
Hitachi-related websites do not become the point of origin of a security breach.

* HIRT/CC: HIRT Coordination Center
FIRST: Forum of Incident Response and Security Teams
JPCERT/CC: Japan Computer Emergency Response Team/Coordination Center
CERT/CC: CERT Coordination Center
SI: System Integration27

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives

Activity promoted by the HIRT center
The activity of the HIRT center in relation to in-house
IRTs includes promoting cybersecurity measures on asystemic and technical level through cooperation withinformation security supervisory divisions, which leads
the institutional side of IRT activities, and quality
assurance divisions, and suppor ting vulnerability
countermeasures and incident response in businessdivisions and Group companies. The HIRT center alsos e r ve s a s l i a i s o n w i th ex te r n a l I RTs to p ro m oteinter-organizational cybersecurity measures.
■ In-house IRT activity
In-house IRT activity includes issuing alerts andadvisories derived from know-how obtained through thegathering and analysis of security-related information,and feeding this know-how back into product andservice development processes in the form of guidelines
and support tools.
(1) Collecting, analyzing, and disseminating
security-related information
The HIRT center disseminates information andknow-how related to vulnerability countermeasures andincident response fostered through involvement in the
Information Security Early Warning Partnership*1 andother initiatives.
*1 A public-private par tnership based on of ficial rules that facilitates theunimpeded dissemination of information related to vulnerabilities in software
products and websites and the proliferation of countermeasures.

Figure 2‐(2) Developing frameworks for research activity
T h e H I R T c e n te r u s e s b e h a v i o r o b s e r v a t i o ntechnology to identify nascent threats and implement
countermeasures as early as possible. Behavior
observation is an observational technique that uses asimulated version of an organization's internal network
to investigate cyberattacks such as spear phishing. This
technique is used to record and analyze the behavior ofan attacker who has managed to infiltrate the system.
(Figure 2‐ )(3) Improving security technology for products
and services
To improve the IRT capability at an organizational
level, the HIRT center establishes concrete security
countermeasures for products related to information
systems and control systems and ensures that skills
learned are passed on to the relevant experts. As part ofan approach to dissemination of practical in-housesecurity know-how, the HIRT center is also involved in
the development of simulated cyberattack drills thatteach workers how to handle spear phishing andransomware.
In June 2022, HIRT was registered with the CVE
Numbering Authority (CNA), to be able to assign CVE ID
numbers to vulnerabilities in Hitachi products, and to
cre ate and publish CVE re cords. As a CNA , HIRT

Dynamic activity observation system to record attackers’ behavior

Branch office(Related office)Internet
Internet

Public web server
Email relay server
External DNS server(1) Deceive an attacker by presenting
a simulated environment
VPN

HUB

VPN
RouterPC

Sales/
Business travelers(Mobile connections
etc.)

HUB
PC

(2) Record the
behavior of theattacker after theygain access

HUB
RouterPC
HUB
Internal network server
PC

28

Simulated network
for behavior
observation

Actual networkassigns a CVE ID when a vulnerability is reported in a
Hitachi product and publishes suitable vulnerability
information, as it works to enable customers to use our
products with peace of mind.

member organizations as part of CSIRT activity. The
HIRT center also suppor ts the creation of an
information-sharing platform based on the JVN*3 service
jointly operated by the JPCERT coordination center andthe Information-technology Promotion Agency (IPA).

(4) Implementing IRT activity for individual sectors
The HIRT center assesses and organizes IRT activity
for specific sectors that accounts for the context andtrends of that sector. A preeminent example of such an
initiative is HIRT-FIS*2 established in October of 2012 forthe financial sector.

*3 JVN: Japan Vulnerability Notes (a portal site that provides information about
vulnerability countermeasures)(1) Enhancing domestic cooperation for IRT activity
The HIRT center endeavors to create networks forcooperation, including passing on information about
vulnerabilities and incidents that came to be known
through information gathering to the PoC of other*4 STIX: Structured Threat Information eXpression*5 AIS: Automated Indicator Sharing(3) Organizing research activity
The HIRT center fosters opportunities for humanre s o u rc e d eve l o p m e n t a n d th e d eve l o p m e n t ofresearchers and workers with specialized knowledge
through participation in academic research including
anti-Malware engineering WorkShops (MWS).

■ Hitachi Incident Response Team

Cybersecurity Initiatives■ Inter-organizational IRT activity
As inter-organizational IRT activity, multiple IRTs
promote inter-organizational cooperation to present a
united front against developing threats and build
partnerships that can help improve each other's IRT
activity.

Governance*2 HIRT-FIS: Financial Industry Information Systems(2) Enhancing international cooperation for IRT
activity
The HIRT center promotes the organization of aframework for collaboration among international IRT
organizations and overseas product vendor IRTs thatmake use of FIRST initiatives, and a plat form for
information sharing that uses STIX*4 and United States
Department of Homeland Security's AIS*5 program.

https://www.hitachi.co.jp/hirt/
https://www.hitachi.com/hirt/29

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection
Initiatives for Personal Information Protection
With the advancement of digital technology causing rapid growth in data usage, the protection of
personal information, and its transfer across borders are growing concerns. Against this background, asa provider of safe and secure social infrastructure systems, Hitachi places considerable importance on
personal information protection initiatives to reliably manage personal information kept on customers'
behalf and personal information used during business. Hitachi has defined its vision for personal
information protection, summarized as providing safety and trustworthiness and recognizing theimportance of individual rights. This vision underpins Hitachi's role as a member of a global society.

Vision for personal information protection governance
Hitachi's vision regarding personal information
p rote c ti o n i s “ Prov i d i n g a s afe a n d tr u s t wo r thy
environment and Valuing individual rights.” Hitachi has

positioned personal information protection as a key
issue in its business and is making steady progress
towards achieving its vision. (Figure 2‐ )Personal information protection framework
To fulfill its mandate as an organization committed tothe appropriate handling of personal information,
Hitachi's upper management has formulated a personal
information protection policy. Rules and guidelines for
managing personal information are then formulated
in-house that conform to this basic policy. Hitachi has aframework in place to check and evaluate whether its
Figure 2‐internal rules confirm to applicable laws and to JIS Q
15001 which is the basis for PrivacyMark certification. In
addition to creating these rules, Hitachi implements
concrete safety management measures that come into
effect when handling personal information. There are
four aspe cts to the se me asure s: orga niz ationa l,personal, physical, and technical. (Figure 2‐ )Vision for personal information protection governance

VISION
Doing its part to protect personal information as a member of global society

1 Providing safety and trustworthiness
Hitachi provides a safe and trustworthy environment by observing personal information protection andconfidential information management programs (process regulations) based on laws and other regulations.

2 Recognizing the importance of individual rights
Hitachi faces the global trend of respecting the rights of the individual from a good faith position.
Personal information protection equates to the protection of a fundamental human right, and Hitachi
considers it a key issue in terms of business management.

30

(2) Collect, use and provide personal informationand forbid the use of such information for purposes
other than the original intent
While carefully considering the personal information is
entrusted to us in our company activities, Hitachi willhandle such information appropriately by establishing amanagement system for personal information protection
for each type of business, and also by following ourr ule s for colle cting, using or prov iding pe r sonal
Figure 2‐(3) Implement safety measures and correct
problems
To ensure the correctness and safety of personal
information, in accordance with the rules for information
security, Hitachi will implement various measures suchas managing access to personal information, restricting
the means for transporting personal information outside
the company and preventing incorrect access fromoutside the company, and strive to prevent the leakage,loss or destruction of personal information. In addition,
when any problems regarding safety measures arefound, Hitachi will identify the cause to take corrective
measures.
(4) Follow laws and norms
Hitachi will follow the Japanese laws, guidelines andother norms for the handling of personal information.
Also, Hitachi will conform our rules with personal
information management to such laws, guidelines andother norms.
(5) Respect a person's rights regarding his or her
personal information
When a person makes a request to disclose, correct
or delete his or her own personal information, seeks toprevent the use or provision of such information, or
gives any complaints or requires consultation, Hitachi
will respond with sincerity, respecting the person's
rights related to that personal information.

Initiatives for Data Protection(1) Establish rules for managing personal
information protection and make continual
improvements
Hitachi will make sure that executive staff and workers
recognize the impor tance of personal information
prote c tio n, a nd w ill e sta b lis h r ul e s fo r p e r so n a linformation management to appropriately use andprotect personal information and ensure that the
management system is put in execution. These rules will
be maintained and improved continually.

information. In addition, Hitachi will not use suchinformation for purposes other than the original intent
and will implement appropriate measures for it.

Governance■ Personal information protection policy
Hitachi, Ltd. (hereinafter “Hitachi”) is a global supplierof total solutions. In this role, Hitachi handles all types of
information including its own technical information andinformation it holds on behalf of customers. Reflecting
how highly it values this information, Hitachi hasestablished an information management framework andendeavored to enforce it. With that in mind, Hitachi, Ltd.
has established a personal information protection policy
and makes it widely available to stakeholders, on its
website and by other means.
（https://www.hitachi.co.jp/utility/privacy/）.

Personal information protection framework

Personal information protection framework
PolicyFormulate basic policy (upper management)

Note: Governance of data protection according to basic policy
Internal
regulations

Prepare regulations for handling of personal information
Four types of safety management measures

Organizational
measures

Personal
measures・Prepare organizational framework
・Operate according to regulations
・Prepare means for reviewing status of personal
information handling・Provision of framework for incidents such as
information leakage
・Ascertain the handling status and improve safety
management measures
・Inspection and audit

・Dissemination of correct handling procedures,
regular training and drills

Physicalmeasures

Organizational
measures

・Entry and exit management for buildings and rooms
・Measures to prevent theft and loss of devices,media, and documents
・Measures to prevent leakage during deletion or disposal

・Measures to prevent unauthorized access and use ofunauthorized software
・Manage and authenticate access rights
・Measures to protect information during transfer and communication
・Monitoring of information systems

31

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection■Personal information protection system
Through our information security promotion framework,
headed by the CEO, we thoroughly apply our policies on theprotection of personal information, and manage personal
information appropriately. All Hitachi, Ltd. BUs and offices
appoint information asset managers in all divisions, under the
information security officer, and allocates responsibilities inrelation to the handling and protection of personal information.
Similar organizations are established in Group companies, tofoste r thorough pe rsonal infor mation prote ction andmanagement throughout Hitachi Group.
■System of rules for personal information
H i t a c h i a p p r o p r i a te l y m a n a g e s t h e p e r s o n a linformation it obtains and holds according to a set ofrules governing personal information protection. (Figure
2‐ )■Safety management measures
As part of its organizational safety management measures,
H i t a c h i d e s i g n ate s p e o p l e re s p o n s i b l e fo r p e r s o n a linformation protection and establishes a personal information
protection system.
Hitachi defines rules related to the roles and responsibilities
of workers in relation to safety management and handling of

personal information, and operates according to those rules.
Hitachi has also put in place a response framework to follow
when an incident such as information leakage occurs, anddefined rules related to inspection and audit, and carries out
its operations accordingly.
As personal safet y management measures, Hitachi
conducts education and training in how to handle personal
information appropriately based on the education plan for
personal information protection. This includes stratified
education, specialized education, and universal e-learning.
(See Education regarding personal information protection).
As physical safety management measures, Hitachi has put
safety measures in place including managing entry and exit tovarious buildings and rooms, physically protecting devices
and documents, anti-theft measures, and measures toprevent information leakage when disposing of devices anddocuments.
As technical safety management measures, Hitachi
prevents unauthorized access to information systems andeliminates unauthorized software. Hitachi also manages andauthenticates access rights, implements measures duringtransfer and communication, and monitors information
systems according to the impor tance of the personal
information being handled.

Personal information protection management system
Hitachi's personal information protection management
system was established based on JIS Q 15001. Hitachi's
personal information protection policy defines its policy
regarding the protection of personal information.
The Article 47 of the general rules for information
security management define the rules for personal
information protection management.
The handling of personal information is based on the
Figure 2‐
System of personal
information protection rules

Article 73 of the personal information protection rules, theArticle 12 of the criteria for consignment of personal
information handling, and related documents.
■Personal information protection
management cycle
Hitachi's framework for personal information protection
management is subject to the PDCA

Personal Information
Protection Policy＜Document structure＞

Basic policy

Information Security Management Rules

Information Security Standards

Basic regulations

Regulations for Personal Information Management
Criteria for consignment of personal information handling

Related documents (written procedures and by-laws)

Rules related to information security

32

Related documents(written procedures and by-laws)
Related laws including
those referenced

Management and appropriate handling of personal information
To ensure protection of personal information at a levelexceeding that specified by the Personal Information
Prote c tio n Ac t, Hi tac hi h a s e sta b lis h e d inte r n a lregulations equivalent to the stipulations of JIS Q 15001(Personal information protection management systems requirements). These regulations are the basis for
Hitachi's efforts to strictly manage and appropriately
handle personal information. Each workspacenominates a person to be responsible for personali n fo r m a ti o n m a n a g e m e n t (a n i n fo r m a ti o n a s s e t
manager). This person identifies all personal information
handled during business, manages it in a ledger, andtakes the appropriate measures according to the
Figure 2‐

importance and risk of the personal information.
For each business operation that handles personal
information, Hitachi recognizes and analyzes theassociated risks. Hitachi defines rules for business
operations that handle personal information. These rules
are centrally managed by the company and regularly
reviewed.
People who handle personal information are informedof the rules for its handling, and leave a record of having
confirmed them before star ting their work. During
operations, each workplace conducts a monthly
self-check to assess the status of safety management
measures and operations.

Initiatives for Data Protection

conduct regular self-checks of its operations, andconducts audits based on the audit plan to check thestatus of other divisions. The person responsible for theaudit formulates a written company audit plan and written
report and has them approved by the company president.
If there are any matters raised by these audits, Hitachi
remains vigilant until the issues are remedied. (SeeAuditing personal information protection)
In the “Action” stage, Hitachi revises its management
system based on various factors. These include changes
to legal obligations regarding the handling of personal
information, changes in the social landscape, opinions
gathered from inside and outside the company, changes
in the business environment, and the results of internal
operations.
In FY2022, we have created the “Plan”, conducted the“Do”, and checked the progress and audit the results
based on the “Amendments to the Act on the Protection of
Personal Information” which was promulgated in FY2021.
(Figure 2‐ )Governance(Plan-Do-Check-Action) cycle, undergoing continuous
improvement through decisive implementation of a plan.
The “Plan” stage entails formulating the personal
information protection policy and personal information
protection measures and establishing a personal
information protection training plan and personal
information protection audit plan. These are then approvedby the company president.
In the “Do” stage, the personal information protection
measures are disseminated and used in-house.
Personal information protection training is conducted tomake the personal information protection measures andmanagement approach well-known throughout Hitachi.
(See Management and appropriate handling of personal
information)
Hitachi also holds meetings to promote personal
information protection matters, using these meetings to
p rov i d e i n fo r m ati o n a n d to re p o r t th e s t atu s of
implemented measures.
In the “Check” stage, Hitachi asks each department to

The framework of personal information protection management though the PDCA (Plan-Do-Check-Action) cycle● Reliably implement personal information protection management system (PMS)● Conduct regular reviews and ongoing improvements by cycling the PDCA

Rules

●Internal rules●Management
framework

Protection andmanagement●Identification and inventoryof personal information●Personal information

protection and management

Education andmonitoring●Education●Auditing andinspection

Ongoing
improvement●Revising the PMS

33

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection
Hitac hi's inte r n a l re g u l atio ns c o m p l y w ith th e
standards required by the My Number system, Japan’ssystem of social insurance, tax numbers and others.
Based on these regulations, Hitachi makes every effort
to m a n ag e a nd h a nd l e th is info r m ati o n w i th th en e c e s s a r y d i s c i p li n e. H i tac h i h a s e sta b lis h e d aframework for managing My Number information. It uses
th i s f r a m ewo r k to eva l u ate th e r i s k of b u s i n e s soperations that handle My Number information, andensure the appropriate measures are taken.
■Auditing and checking per sonal information
protection
Hitachi, Ltd., and all Group companies within Japan
conduct an annual audit of their personal information
protection and information security status. A personal
information protection and information security audit
reviews compliance with personal information protection
and management, and audits compliance with legal
requirements.
Group companies outside Japan perform common
global self checks to monitor compliance status in a
Hitachi-wide inspection process. All Hitachi, Ltd.
departments perform "Personal Information Protection
and Information Security Operation Checks" annually, as
self-checks in the workplace. In addition, departments
involved in operations that handle important personal
information (739 operations*) per form "Personal
Information Protection Operation Checks" every month.
With the se measure s, we regularly check safet y
management measures and their operational status.

■Educating employees about personal information
protection and promoting their understanding
To ensure that personal information is reliably
p rote c te d, H i t a c h i c o n d u c ts a n n u a l tr a i n i n g bye-learning of all executives, workers, and temporary
employees. Hitachi, Ltd., gives each of its employees apersonal information protection card that outlines
Hitachi's personal information protection policy andbasic matters regarding information security.
■Strengthening subcontractor management
Hitachi has taken the early initiative to enhance its
policies regarding subcontractors' handling of personal
information. It has established internal regulations that
apply when subcontracting the handling of personal
information and implemented screening and supervisionof subcontractors. When subcontracting business
operations, Hitachi screens its subcontractors so thato n l y th o s e w h o s e l eve l of p e r s o n a l i n fo r m ati o nprotection equals or exceeds that of Hitachi are
selected. T he contracts Hitachi signs with its
subcontractors incorporate strict provisions regarding
personal information management. These provisions
might include the need to establish a management
framework and a ban in principle on fur thersubcontracting. As part of its approach to managing
and supervising subcontractors, Hitachi also conducts
regular assessment of its subcontractors and reminds
them of their obligations.

*As of March 2023

Global personal information protection initiatives
Advancements in data use driven by the remarkableprogress being made in digitalization will inevitably resultin increased privacy risks. Countries all over the world
are formulating and revising legal frameworks related topersonal information protection, strengthening suchprotection in response to rising demand.
With the widespread use of data across national
borders, the legal systems of various countries may
require the protection of personal information in thehome country for businesses located abroad, or may
r e g u l a te t h e c r o s s - b o r d e r t r a n s f e r o f p e r s o n a li nfo r m ati o n to oth e r c o u ntr i e s. Fo r th i s re a s o n,compliance for personal information protection must be
based on a thorough understanding of current trends invarious countries' legal systems.
H i t a c h i h a s t a ke n t h e i n i t i a t i ve by p r o m ot i n gcompliance with the EU's General Data Protection
Regulation (GDPR).

34

Hitachi is also promoting compliance with the
Chinese Personal Information Protection Law and thedata protection laws of other countries and regions
through cooperation with regional headquarters.
We have enacted the Hitachi Group Privacy Principles
as a common code of conduct for personal information
protection throughout the Hitachi Group, and appointed
personal information protection of ficers to ensure
thorough action on personal information protection ineach Group company. To ascertain risk status in relation
to personal information protection within the HitachiGroup and take action, Hitachi conducts ongoingm o n i to r i n g o f t h e c o m p l i a n c e s t a t u s o f G r o u pcompanies and implements appropriate measures.
All Hitachi Group companies will continue to bolsterand develop their abilit y to comply with personal
information protection regulations.

PrivacyMark*-Related Initiatives of the Hitachi Group

Website for PrivacyMark System of Japan Institutefor Promotion of Digital Economy and Community(https://privacymark.org/)■Holders of PrivacyMark certification within the Hitachi GroupAs of the end of July 2023, the following Hitachi Group companies hold PrivacyMark certification:

Hitachi, Ltd.

Hitachi Systems Power Services, Ltd.

Hitachi, Ltd., Corporate Hospital Group

Hitachi Systems Field Services, Ltd.

Hitachi Kenpo

Hitachi Social Information Services, Ltd.

Okinawa Hitachi Network Systems, Ltd.

Hitachi Information & Telecommunication Engineering, Ltd.

Kyushu Hitachi Systems, Ltd.

Hitachi Research InstituteShikoku Hitachi Systems, Ltd.

Hitachi Solutions, Ltd.

SecureBrain Corporation

Hitachi Solutions Create, Ltd.

Hitachi ICT Business Services, Ltd.

Hitachi Solutions West Japan, Ltd.

Hitachi Urban Support, Ltd.

Hitachi Solutions East Japan, Ltd.

Hitachi Academy Co., Ltd.

Hitachi Channel Solutions, Corp.

Hitachi Pharma Information Solutions, Ltd.

Hitachi Document Solutions Co., Ltd.

Hitachi Information Engineering, Ltd.

Hitachi Hi-System21 Co., Ltd.

Hitachi SC, Ltd.

Hitachi Power Solutions Co., Ltd.

Hitachi Global Life Solutions, Inc.

Hitachi Building Systems Co., Ltd.

Hitachi KE Systems, Ltd.

Hitachi Foods & Logistics Systems Inc.

Hitachi Consulting Co., Ltd.

Hitachi Insurance Services, Ltd.

Hitachi Industry & Control Solutions, Ltd.

Hitachi Management Partner, Corp.

Hitachi Systems, Ltd.

Hitachi Real Estate Partners, Ltd.

Hitachi Systems Engineering Services, Ltd.

Hokkaido Hitachi Systems, Ltd.

Initiatives for Data Protection* PrivacyMark is a third-party certification program that certifies businesses
recognized to be implementing security measures and protection measuresappropriate for personal information.
(Issuing organization: Japan Institute for Promotion of Digital Economy and Community)

Hitachi's Privacy Mark

Governance

The Hitachi Group engages in personal information protection as asingle entity.
The first instance of PrivacyMark certification by a Group
company was in 1998. As of the end of July 2022, 38 business
operators now hold this certification. These businesses protect
and handle personal information at a higher level than that
required by law.
Hitachi, Ltd. received its ninth certification in March 2023 and iscontinuously working towards the next renewal in March 2025.
In addition, the “Hitachi Group P Mark Liaison Committee” isorganized mainly by companies that have acquired the Privacy
Mark, and regularly holds information exchange meetings, study
sessions, and lectures by invited outside experts, as well as
sharing and studying information on personal information
protection throughout the Group.

35

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection
Privacy Protection Initiatives
Advancements in digital technologies such as AI and IoT have set high expectations for social
innovation using the varied and vast data they produce. However, public awareness is also growing
around privacy protection for consumers. Hitachi is taking the initiative regarding privacy protection tofoster value creation in a way that protects people's safety and security.

Using personal data and protecting privacy
Recently, all businesses are expected to use personal
data to create value, regardless of whether it is deemed“personal information”. This situation demands concern
for personal privacy. In the DX era, the amount of
personal data collected is increasing exponentially,
which inevitably changes the privacy risk a businessmust manage. As Figure 2, there is a partial overlap

bet ween personal data and information about anindividual. For example, they include information likelocation data and purchase histories which have privacy
implications.
To create value using personal data, a business must
protect personal information while also protecting
privacy. (Figure 2‐ )Hitachi's privacy protection initiatives
Hitachi, Ltd. seeks to create value through the safe
and secure use of personal data. To this end, Hitachi
has been working on privacy protection initiatives fordata use in the Digital Systems & Services Sector since
2014.
■Operation of the privacy protection advisor ycommittee
In the Digital Systems & Ser vices Sector at theforefront of digital business, we have nominatedpersonal data managers who oversee the handling of
personal data, and established a privacy protection
advisory committee which supports risk evaluation andcountermeasure assessment by aggregating knowledge
related to privacy protection.
Figure 2‐■Preparing rules and manuals related to privacy
protection
We have defined a privacy protection policy withreference to this framework, defined rules for handlingpersonal data based on its policies, and createdmanuals for workers. These manuals set out specificprocesses to be followed and matters to consider toprotect privacy, allowing each employee to implement
privacy protection measures.

Relationship between personal data, personal information, and information with privacy implications

Personal data

Personal
information

36

Information withprivacy implications

■Privacy protection education
Using personal data while also protecting privacy
requires that individual employees understand theimportance of privacy protection and implement privacy
measures accordingly. To this end, Hitachi conducts
regular education and information sharing related to
privacy protection and keeps a keen eye on attitudes
regarding privacy protection in wider society.

Ensuring the safety and security of customers
In March 2022, we presented our actions on privacy
protection under the title of “Personal Data Usage andPrivacy Protection” at the Symposium on the Proper
Use of Personal Data, which was organized by theJapan Business Federation (Keidanren).
At a panel discussion after the presentation, thepanelists rated Hitachi's privacy protection initiatives as

Initiatives for Data Protection

infrastructure, industry, and logistics. Since 2023, wehave implemented the Hitachi Privacy (PIA) System toaccelerate the privacy protection initiatives introduced
throughout Hitachi, Ltd. Using these initiatives, we canconduct a Privacy Impact Assessment for businessp ro c e s s e s th at h a n d l e p e r s o n a l d at a, a n d t a kemeasures to prevent privacy issues from arising.

Governance■Assessing privacy impact
Using these rules and manuals, workers involved inbusiness processes that handle personal data can
c o nd u c t a p r i vacy im pac t a s se s s m e nt a nd ta kemeasures to prevent privacy issues from arising. To
carry out this assessment, the worker uses a checklist
in a format created by Hitachi based on legal systems,
technological trends, case studies, and knowledge
gleaned from opinion surveys (described later). If thee m p l o y e e's j u d g m e n t w i l l n o t s u f fi c e o r r i s k i sdetermined to be high, the privacy protection advisorycommittee can reduce risk by providing support.
For the digital systems & services sector, we haveapplied privacy impact evaluations to many businessprocesses—approx. 270 in FY 2022 alone. The areas ofbusiness subjected to privacy impact evaluation were
diverse, and included finance, public utilities, social

advanced and valuable. Hitachi also applies its privacy
protection know-how to its customers' businesses byoffering better services and technology that consider
privacy. In this way, Hitachi helps make progress
to w a r d s s a f e a n d s e c u r e P e r s o n a l d a t a s o c i a linnovation.

37

Governance

Co-Creating Securuty

Jibungoto

Internal and External Activity Related to Information Security
Recent cyber attacks are gaining in level and sophistication, so the scope of their impact is widening, toinclude supply chains. To counter the threat of such cyber attacks, it is vitally important to build asecurity ecosystem that goes beyond internal departmental boundaries and also collaborates withexternal organizations. To that end, we are building a framework for inter-divisional collaboration,
between divisions other than security, through various internal activities. We also participate actively inexternal activities, to enable collaborative creation with others in industry, government, and academia.

Internal Activity Related to Information Security
their individual roles and deepen connections with thosearound them.
Global security workshops held with counterparts in
Europe and the Americas deepen understanding of
measures that are promoted as internal controls.
Workshops in Japan hold panel discussions under theheading of security ecosystems with a perspective
completely different from security and IT experts. Points
raised and lessons learned at these events are thenshared.

Now that we are in an environment where devices,
systems, and other things “interconnect” in the IoT, evendivisions which previously had few occasions to think
about security must do so. Therefore we organize
se mina r s, wor ks hops, a nd othe r eve nts to build
communities beyond barriers of position or organization,in addition to thorough implementation of measures byusing IT systems and tools, and controls such as rules,
regulations, and guidelines. These oppor tunities
strengthen security by helping participants to reaffirm

External Activity Related to Information Security
We communicate with communities that transcend
frameworks, to share matters such as threat informationand issues arising when countermeasures are applied,with other nations, academia, and companies which are
working to promote cybersecurity.
Hitachi participates in global communities to that end.
We endorse the C ybersecurit y Tech Accord joint
declaration, which the IT and technology industries called
for as a way to ensure safety in cyberspace. We aim towork within this global collaborative framework to protectuser companies from cyber attacks. We have also joined
the Information Security Forum (ISF), an organization
engaged in world-leading investigation and research into
subjects such as information security standardization andbest practices for cybersecurity and digital risks.
We also use the knowledge and experience of ouremployees to participate in various external activities
related to information security, such as the international
standardization activities noted below, and CSIRT work.

■International standardization activity
Hitachi participates in the following international standardization activities:
・ISO/IEC JTC1/SC27
SC27 is a subcommittee of the ISO/IEC joint technicalc o m m i t t e e J TC1 i n s t i t u t e d b y t h e I n t e r n a t i o n a l
Organization for Standardization (ISO) and International
Electrotechnical Commission (IEC) for the purpose ofinternational standardization. SC27 asse sse s thestandardization of information security management
systems (WG1), encryption and security mechanisms(WG2), security evaluation technology (WG3), security
control and services (WG4), and identity management
and privacy technology (WG5).

38・ISO TC292
ISO’s Technical Committee (TC) 292 assesses various
security-related standardization including general security
m a n a g e m e n t, b u s i n e s s c o n ti n u i t y m a n a g e m e n t,
resilience and emergency management, prevention andmanagement of unauthorized activity, security services,
homeland security, and assurance of supply chain
reliability.

■CSIRT activity
In addition to the CSIRT activity of the Hitachi Group, Hitachi participates in external CSIRT activity with the HIRT
(Hitachi Incident Response Team) as its PoC (Point of Contact). Hitachi also promotes the sharing and exchange of
information about vulnerabilities and other matters through cooperation with external CSIRT organizations.
・FIRST
FIRST (Forum of Incident Response and Security
Te a ms) is a n inte r n atio n a l c o m mu ni t y of inc id e nt
response teams bound by mutual trust. FIRST includes
universities, research institutions, corporations, andgovernment agencies among its members.
As of the end of June2022, membership consists of 652
teams from 105 countries.
・Nippon CSIRT Association (NCA)
The NCA was established to help resolve issues faced
during CSIRT activity by facilitating information sharing
and cooperation among Japanese CSIRT organizations.
Its mission includes helping organizations establish

CSIRTs and creating collaborative frameworks among
CSIRTs when an issue occurs, providing a venue throughwhich Japan's CSIRT community can independently
improve its basic incident response capability and findpartners for collaboration in times of need. Hitachi is afounding member of the association, and from 2015
through 2020, a Hitachi representative held the positionof chairperson and advanced it toward becoming ageneral incorporated association. As an executive
committee member from 2021, and as deputy director
since 2022, Hitachi has helped to promote CSIRT
activities within Japan.

Internal and External Activity Related to Information Security

automation, measurement, and control. Within it, WG10
is working with the ISA-99WG of the International Societyof Au tomation (ISA) to sta nda rdize the te c hnic a l,operational, and administrative securit y measuresrequired for control systems. Also, IEC TC65/WG20 isworking on standardization of development processes
that achieve both security and functional safety in control
systems.
・OASIS CTIThe Organization for the Advancement of Structured
Information Standards (OASIS) Cyber Threat Intelligence(CTI) committee assesses the standardization of theStructured Threat Information eXpression (STIX) format
for exchanging cyber threat intelligence and procedures
for automatically exchanging detection index information.

Co-Creating Securuty

・ISO TC262
ISO's TC 262 is focused on risk management, andassesses standardization of terminology, principles,policies, risk assessment methodology, and otheraspects for all types of risk.
・ITU-T SG17
S G 17 i s a S t u d y G r o u p ( S G ) u n d e r t h e I T U
Telecommunication Standardization Sector (ITU-T) of theInternational Telecommunication Union (ITU). SG17 looks
at standardization in such matters as cybersecurity,
security management for communications providers,
telebiometrics, security functions for communication andapplication ser vices, anti-spam measures, and ID
management.
・IEC TC65/WG10, WG20, and ISA-99WG
IEC's TC65 promotes the standardization of industrial■Other activity
In addition to the preceding activity, Hitachi participates in various outside activity to promote research, discussion,
proliferation, public awareness, and matters related to security. Hitachi also holds various seminars and conferences
across the country.
・ Information-technology Promotion Agency (IPA): Ten
Major Security Threats Authors' Committee, etc.
・ Japan Institute for Promotion of Digital Economy andCommunity (JIPDEC) ISMS Expert Committee, Control
Systems SMS Expert Committee, etc.
・Japan Cybercrime Control Center (JC3)・Japan Information Security Audit Association (JASA)
・NPO Japan Network Security Association (JNSA)・ Information Security Operation providers Group Japan(ISOG-J)・Japan Digital Trust Foundation (JDTF)
・ Japan Electric Measuring Instruments Manufacturers'
A s s o c i a t i o n (J E M I M A ) PA / FA C o m m i t t e e o nInstrumentation and Control, Security Research WG
・Control System Security Center (CSSC)
・ Ja pa n El e c tro n i c s a n d Info r m ati o n Te c h n o l o g yIndustries Association (JEITA), Information Security

Exper t Committee, Personal Information Protection
Expert Committee, etc.
・ICT-ISAC
・Council of Anti-Phishing Japan・ National Institute of Technology and Evaluation (NITE)
Evaluation Body Certification Technical Committee
・ Robot Revolution & Industrial IoT Initiative and Industrial
Security Action Group・Japan Society of Security Management (JSSM)
・ CRIC Cross-Sector Cybersecurity Committee, CRIC
Security Quality Committee, etc.
・ The Society of Instrument and Control Engineers(SIC E ), In d u s tr i a l A p p l i c ati o n D i v i s i o n, Te c h n i c a lCommittee on Industrial Networks System
・J-Auto-ISAC
・Transportation ISAC JAPAN・JE-ISAC

39

Governance

Co-Creating Securuty

Jibungoto

Working to Raise Information Security AwarenessWe see each employee's individual security awareness as security's last line of defense.
Therefore, in addition to our existing strict governance, we have star ted activities to foster
independence in our employees and raise their security awareness by encouraging them to take theinitiative and act independently.

“Jibungoto (ownership)” in information security
Working from home has rapidly become normalized,
but with growth in cyber attack threats showing no signsof abating, adequate security measures are essential tounlock the potential of working from home. Until now,
at tacks have primarily targeted vulne rabilitie s inorganizations' IT infrastructure, but with work styles
increasingly based on working from home, attackers are
beginning to target lapses in security awareness.
Security measures have always required a balance
between the three elements of IT, processes, and people.
We have begun expanding and enhancing education
and awareness-building for employees and promoting

more balanced security measures, in order to adapt tothe current dramatically-changing environment and to
reduce future security risks. We see improving security
awareness as the last line of defense, so in addition to ourexisting strict governance, we are working to raise
security awareness by encouraging employees to takethe initiative and act independently. Our goal is to get
employees interested in the issues and have them takeownership of security, rather than taking a passive role.
Our mottos for this approach are “Jibungoto (ownership)”and “Sharing a common mindset”.（Figure 3‐❶）Figure 3‐❶ The ideal future form of security awarenessIn addition to our existing strict governance, generateawareness by employees taking the initiative and acting independently.

The important thing is to elevate the security awareness of each and every person
Key concepts: “Jibungoto（Ownership）” and Sharing a common mindset

Management
Enforcing governancemeasures(2) Self-directed action

Organizations(such as business units)

Enhancing knowledge
Sharing knowledge

Employee(1) Encouraging self-initiative
New security awareness-raising activities
Raising security awareness40

raise people's awareness of security around them bymaking them interested in it.
We use the newly-developed mascot character “Harry”
with animations, chats, and other means to get closer to
employees by making information dissemination more fun
and accessible.

Self-directed action: Green Aegis
We are promoting “Green Aegis” internal community
activities as “behavior reform” to support employees intheir own independent actions on security measures.
(Figure 3‐❸)
The aim of this activity is to get employees interested insecurity issues, so that they independently acquire
knowledge and research the issues, and share thisknowledge with their colleagues.
Intra nets a nd de dic ate d Microsof t Te a ms* a repositioned as “communities for enjoyable involvementwith security, which spread with open sharing andharmony”. We use them to provide places for introducing
actions which we have taken, distributing videos that
employees have planned for themselves, and allowing
employees to freely exchange opinions and take theinitiative to get involved with security in ways which suitthem.

Figure 3‐❷ Harry's Security Activities

Figure 3‐❸ Green Aegis Activities

Mindset Reform

Behavior reform

1) Actions to gain empathy (recognition/* Microsoft Teams is a trademark or registered trademark of Microsoft Corporation in
the USA and other countries.

Actions to make each employee see security

understanding)as a personal matter and take the initiative in⇒ Get people interested in security.

their behavior.

2) Initiatives for instilling “Jibungoto (ownership)”⇒ Make people aware of
security issues around them.

Jibungoto

We are promoting “Harr y’s Security” for internal
communications as a “mindset reform” to help employees
see that security is an issue that directly impacts them,and to encourage them to get involved independently.
(Figure 3‐❷)
Security work tends to have a negative impression of
being difficult and tiresome, but this activity is intended toWorking to Raise Information Security AwarenessEncourraging self-initiative: Harry's Security⇒ Get people to learn,
investigate, and shareknowledge.

41Research and Development of
Cooperative Cyber Defense Technologies
to Enhance Social Resilience

COLUMNIn recent years, the impact of cyber-attacks on the economy and social infrastructure due to missed ordelayed responses has become an issue for society. Hitachi aims to achieve automatic response and recovery
to more attacks by combining technologies that enable organizations under attack to quickly sharecountermeasure know-how with others, together with assessing the impact of countermeasures on digital
twins to select appropriate countermeasures.

Research and Development of Cooperative Cyber Defense
Technologies to Enhance Social Resilience
In recent years, cyber-attacks have become more frequent regardless of industry, and in many cases, attacks
similar to those that have occurred in one organization also occurred in other organizations. Since April 2017,
Hitachi, Keio University, and Chubu Electric Power Company, Inc. have been advancing joint research on theconcept of decentralized security operations (referred to below as “decentralized SOC” ) to quickly share andutilize information that has not been shared in previous measures, such as incident tickets (referred to below as“tickets” ) containing countermeasure know-how against attacks. This aims to prevent the spread of damage by
working together to prevent and detect attacks, and take appropriate action.
Hitachi is also developing “Security Digital Twin” (referred to below as “SDT” ) technology that quickly selects
optimal countermeasures by reproducing the system to be protected in cyberspace (known as “digital twinning” ),formulating and virtually applying multiple security measures against attacks, and evaluating the side effects suchas system stoppages that will result from the measures in advance. This enables appropriate security measuresthat minimize adverse effects on core business operations in mission-critical systems such as control systems,
where stable system operation is particularly important.

Research Into Decentralized SOC Technologies
In 2022, we developed the Cooperative Defense
Platform, a technology that automatically sets the scopeof sensitive and confidential information that can bedisclosed for each partner organization, based on thetrust level of the sharing partner and the value that can be
expected through cooperation in sharing tickets. By
limiting the scope of sensitive and confidential information(with anonymized and abstracted processing), we expect
to achieve both security and efficiency in the sharing ofcountermeasure information, and to promote information
collaboration among organizations. The technology wedeveloped is characterized by the following two features:

1. A dynamic shared access control function that
determines the information processing level oftickets to suit the partner organization
As shown in (Figure ❶), this control function quantifies
the level of trust in the partner organization’s handling ofsensitive and confidential information (referred to below as“confidentiality management trust level”) and the expected
benefits to the sharing organization through collaboration(refe r re d to be low as “colla boration value”), a nd
determines the information processing level according tothese values. Organizations with high confidentiality
management trust level and collaboration value are

Figure ❶ Incident Response Information Sharing Technology

Cooperative Defense Platform

AttackOrganization A
TicketcreationA

Confidentiality management trust level

42

Response

Organization B

A4B

Dynamic
Determination of the information
shared access
control function redaction level for the sharing organization
Collaboration value

Feedback

Ticket withredaction

Ticket withredaction

A4C

Organization C

provided with unmodified tickets, while those with low
values receive tickets with redacted sensitive andconfidential information such as IP addresses and systemc o n fi g u r a t i o n i n f o r m a t i o n . T h i s c o n fi d e n t i a l i t ymanagement trust level is determined based on the otherorganization’s security system and the skills of its security
personnel, etc. The collaboration value is determined by
the “Ticket Sharing Profit Calculation Function” described
below.
2. Our Ticket Sharing Profit Calculator Function
calculates the value of feedback fromticket-sharing partners
Based on the assumption that “an organization that has

been attacked in the same way as your organization is
likely to be able to provide useful feedback,” we compare
the attacker identifiers (e.g. IP address of the attacker,
malicious domain name, content of suspicious emails) inthe ticket with those observed in the other organization,and find that the more parts there are in common, themore value your organization can gain from collaboration.
In addition, due to the sensitive nature of the attacker’s
identifier itself, this function specifies the in-common par tof the ident ifier in encr ypted form, using securecomputation.

Research Into Security Digital Twin Technologies
We are deve loping Se cur it y D igital Twin (SDT )technology to select security measures that ensurebusine ss continuit y whe n impleme nting se curit ymeasures for systems. For 2022, we have developed adigital twin and production rate calculation modeltargeting OT systems, where business continuity isparticularly important. The technology we developed ischaracterized by the following two features:

IT security experts,
industrial networks experts,
OT systems experts, etc.

Experts in each field constructmodels quickly and preciselyInteraction

Dependency

Vulnerability

Actor

Security
settings

Operating capacity

Security
Measures

Cyber-attack

Task 2

Task 3

Performance

Performance▼Measure ▼Restoration
startsTask 2 complete▼Measure ▼Restoration Side effectTask
1startscomplete
Performance reduction▼Measure ▼Restoration
startscomplete Side effectTime

Rippleeffects…
Task 4

Task 1

Cyber

…

Asset

Task 3…

Process

Synchronization

Analysis

Performance

2. Production Rate Calculation Model in a Factory
Environment
In order to apply the three-tier models described above
to a factory environment, we specifically set “maintaining
the production rate of the line” as a key performanceindicator (KPI), and developed a model that enables
calculation of the impact of security measures on
production rates. This technology uses Petri Net to

Figure ❷ Security Digital Twin Technology

Everyday operations,cyber-attack,security measures

1. Digital twin construction technology for OT
systems, based on three-tier models
The OT system is recreated as a digital twin withthree-tier models of actors, assets, and processes,
to a s s e s s t h e i m p a c t o f s e c u r i t y m e a s u r e s o nbusiness continuity (Figure ❷). Actors are models that
represent the behavior of workers, at tackers,
security-countermeasures personnel, and others, as they
perform their daily tasks. Assets are models of runningcompute r e quipme nt, and re pre se nt sof t warevulnerabilities, network dependencies, etc. A process is amodel that represents the work performed by an OT
system. Each model incorporates a unique state transition
program that can reproduce behavior that changes overtime.
This technology allows an attacker to virtually attack an
asset on the digital t win, identif y the impact andweaknesses (e.g., high-risk vulnerabilities) identify the
impact and weaknesses (e.g., high-risk vulnerabilities). In
addition, it is possible to develop multiple security
measures to mitigate the impact of an attack and toassess the side effects of each measure (e.g., negative
impact on business performance) in advance, without
affecting the actual systems.

construct a digital twin of production operations,reproducing the production of products represented bytokens in cyberspace through multiple processes. This
allows the achievement of the KPI (production rate) to be
calculated by counting the tokens in which all processes
have been completed.
Other operations can be modeled by Petri Net in thesame way. When multiple patterns of security measures
are assumed for high-risk vulnerabilities, the optimalsecurity measures are derived by considering thecustomer’s KPI and the side effects of each measure.
In the future, by reproducing cyber-attacks thath av e o c c u r r e d i n ot h e r o r g a n i z a t i o n s a n d t h e i r
countermeasures on their own SDTs, organizations will
evaluate the impact on themselves and automaticallyselect and execute appropriate countermeasures, aiming
for automation not only in IT systems but also in OTs y s te m s . I n a d d i t i o n , w e w i l l p r o m o te s o c i e t a l
implementation of the newly developed technology andexpansion of the community, thereby contributing to theachievement of safe and secure social infrastructure.

…
Physical

Performance reduction

Side effect

Performance reduction

Time

Time

43

Third-Party Evaluation and Certification
Hitachi promotes third-party evaluation and certification in relation to information security management.

Status of ISMS certification
The following Hitachi organizations have gained ISMS certification from the ISMS Accreditation Center (ISMS-AC)
based on the international standard for information security management systems (ISO/IEC 27001) (As of the end of
June2023). The names of the organizations are as they appear in the list of ISMS-accredited organizations maintainedby the ISMS-AC.

● Hitachi, Ltd. (Financial Information Systems 2nd Division,
Governmental & Public Financial Systems Division)● Hitachi, Ltd. (Social Infrastructure Systems Business Unit,
Control System Platform Division)● Hitachi, Ltd. (Service & Platform Business Unit Service
Platform Division, Application Services Division, Lumada
Solutions Operation, Digital Systems & Services Division,
Social Innovation Business Division, Lumada CoE)
● Hitachi, Ltd. (Social Infrastructure Information Systems
Division, Strategy Planning Division, Energy Systems
Division 1, Energy Systems Division 2, Energy Solutions
Division and Mobility Solution & Innovation Division)● Hitachi, Ltd. (Social Infrastructure Systems Business Unit,
Government & Public Corporation Information Systems
Division)● Hitachi, Ltd. (Water & Environment Business Unit, Water
Solutions Division, Digital Solutions Business Development
D e p a r t m e n t, Wa te r & E nv i ro n m e n t B u s i n e s s U n i t,
Environment Solutions Division, Information System
Engineering Department, Connective Industries Division,
Information Technology & Business Process Innovation
Division, Secure IT Innovation Center, Secure Information
Group)● Hitachi, Ltd., Social Infrastructure Systems Business Unit,
Defense Systems Division (Yokohama Office), Corporate
Sales & Marketing Group, Digital Systems & Ser vices
Business Sales Management Division, Defense Systems
Sales Management, and Hitachi Advanced Systems
Corporation (HQ)
● Hitachi, Ltd. Industrial Digital Business Unit Enterprise
Solutions Division (DX Cloud Solutions Department)● Hitachi Channel Solutions, Corp.

● Hitachi Social Information Services, Ltd. and Okinawa
Hitachi Network Systems, Ltd.
● Japan Space Imaging Corporation● Hitachi Systems, Ltd. (Public & Social Platform Services
Division)● Hitachi Systems, Ltd. (Contact Center & BPO Services
Division)● Hitachi Systems, Ltd. (Solution Business Administration
Group Advanced Support Platform Design Department)● Hitachi Systems, Ltd. (Managed Services Division, Cloud
Services Division, Business Services Division, Security
Services Division)● Hitachi Systems Power Services, Ltd. (Managed Services
Division, Platform Services Office)● Hitachi Systems Engineering Services, Ltd. (Managed
Services Business Group)● Hitachi Systems Field Services, Ltd. (Branch HQ, Tokyo
Branch, Tokyo Office)● Hokkaido Hitachi Systems, Ltd. (Management PlanningGroup, Administration Division, Public & Social Systems
Management Division, Corporation Services Business
Division, Business Planning Department, Systems Division,
Systems Section 1, Group 1, Group 2, Systems Section 2,
Platforms Division Section 1, Facilities Division Promotion
Department, Facilities Service Group, Platforms Division
Section 2 Sales Management Division, Sales Planning
Division, Public & Social Sales Division, Sales Section 1,
Sales Group 1, Sales Section 2, Corporate Sales Division,
S a l e s S e c t i o n 1, S a l e s G r o u p 1, S a l e s S e c t i o n 2
Production Technology Management Division, Quality
Assurance Division)● Hitachi Solutions Create, Ltd.

● Hitachi Solutions West Japan, Ltd.
● Hitachi Solutions East Japan, Ltd.
● Hitachi Solutions, Ltd.

● Hitachi Power Solutions Co., Ltd.

● Hitachi Information & Telecommunication Engineering, Ltd.
(Customer Support Center)● Hitachi Foods & Logistics Systems Inc.

● Hitachi Information Engineering, Ltd.

● Hitachi KE Systems, Ltd. (Tokyo Development Center)● Hitachi ICT Business Services, Ltd. (Product Support
Department Media Service Group)● Kyushu Hitachi Systems, Ltd.

● Shikoku Hitachi Systems, Ltd.

● Hitachi Systems, Ltd. (Financial Platform Division Service
Office 2, ATM Services Department)

44● Hitachi Systems, Ltd. (Public & Social Business Group)● Hitachi Pharma Information Solutions● Hitachi High-Tech Corporation(Solution Center)*Transferring from Hitachi High-Tech Solutions Corporation● Hitachi Management Partner Corp.(Business Planning
Division, Human Resources Solution Division)

Status of IT security evaluation and certification

Figure 4‐❶Main products certified under the Japan Information Technology Security Evaluation and Certification Scheme

TOE type*1

Product

Certification No. Evaluation assurance level*2

HiRDB/Parallel Server Version 8 08-04

Database management system

C0225

EAL4+ALC_FLR.1

HiRDB/Single Server Version 8 08-04

Database management system

C0216

EAL4+ALC_FLR.1

HiRDB Server Version 9 (Linux Edition) 09-01

Database management system

C0351

EAL2+ALC_FLR.2

Smart Folder PKI MULTOS application 03-06

Smart card application software

C0014

EAL4

Hitachi Device Manager Software,

Access Control Device andC0536

EAL2+ALC_FLR.1

Hitachi Tiered Storage Manager Software 8.0.1-02

Systems

Storage device control software

C0514

EAL2+ALC_FLR.1

Storage device control software

C0513

EAL2+ALC_FLR.1

Microprogram 0917/A for Hitachi Unified Storage 110

Storage device control software

C0421

EAL2

Microprogram 0917/A for Hitachi Unified Storage 130

Storage device control software

C0420

EAL2

Finger Vein Authentication Device UBReader2

Biometric device

C0332

EAL2

Certificate Validation Server 03-00

PKI

C0135

EAL2

CBT Engine 01-00

Major application of CBT

C0288

EAL1+ASE_OBJ.2、Third-Party Evaluation and Certification

The following table lists the key products certified under the Japan Information Technology Security Evaluation andCertification Scheme run by the Information-technology Promotion Agency (IPA) based on ISO/IEC 15408. (Thisincludes listing in the “archived list of certified products” as of the end of June 2023) (Figure 4‐❶)

Hitachi Virtual Storage Platform G1000,
Hitachi Virtual Storage Platform VX7 Control Program
80-01-25-00/00（R8-01A-06_Z）
Hitachi Unified Storage VM Control Program73-03-09-00/00（H7-03-10_Z）

Hardware: D, Software: 03-00

examination system
Security Threat Exclusion System SHIELD/ExLink-IA 1.0

Security Management Software

ASE_REQ.2、ASE_SPD.1
C0090

EAL1

*1 TOE (Target Of Evaluation)
A TOE is defined as a product such as software or hardware that is the subject of evaluation. This can include written guidance for managers and users (user manuals, guidance,
installation procedures etc.).
*2 EAL (Evaluation Assurance Level)
ISO/IEC 15408 stipulates the degree of assurance of evaluation items (assurance requirements) in a range from EAL1 to EAL7. A higher level means more stringent evaluation.
・EAL1 involves the validation and testing of security functions and the objective evaluation of guidance used to maintain security.
・EAL2 adds vulnerability analysis with respect to typical attack vectors and evaluation from the perspective of product integrity from manufacturing to commencement of operation. This
adds a security perspective to the standard development lifecycle.
・EAL3 adds to the assurance of EAL2 by evaluating the development environment to assure the comprehensiveness of testing and prevent tampering of the product during
development.
・EAL4 is considered a high level of assurance for general consumer products, and evaluates the entire development lifecycle including the integrity of development assets in thedevelopment environment, the source code of the product, and the trustworthiness of personnel.
・ALC_FLR.1 objectively evaluates the basic procedures for providing the necessary patches when a security defect is found in the product. You can use this assurance level to add
assurance requirements not included in the EAL of the standard. The level is expressed as EAL2+ALC_FLR.1, for example.
ALC_FLR.2 requires that procedures are in place to accept reports about vulnerability information and to notify users.

45

Third-Party Evaluation and Certification

Status of testing and certification of cryptographic modules
The following table lists the main products certified by the Japan Cryptographic Module Validation Program (JCMVP)
based on ISO/IEC 19790 operated by the IPA or the Cryptographic Module Validation Program (CMVP) based on FIPS
140-2 operated by NIST in the United States and CSE in Canada. (This includes listing in the “historical list” by CMVP
as of the end of June 2023) (Figure 4‐❷)
Figure 4‐❷Main products certified by the Cryptographic Module Validation Program (CMVP)

Product

Certification No.

Hitachi Vantara Cryptographic Library

4239

Level 1

Hitachi Virtual Storage Platform (VSP) Encryption Board for NVMe

4194

Level 1

Hitachi Virtual Storage Platform (VSP) Encryption Module

4183

Level 2

Hitachi Virtual Storage Platform (VSP) Encryption Board for NVMe

4076

Level 1

Hitachi Virtual Storage Platform (VSP) Encryption Module for NVMe

3803

Level 2

Hitachi Flash Module Drive HDE

3314

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Board

3279

Level 1

Hitachi Virtual Storage Platform（VSP）Encryption Module

3278

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Adapter

2727

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Board

2694

Level 1

Hitachi Virtual Storage Platform（VSP）Encryption Module

2462

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Engine

2386

Level 1

Hitachi Unified Storage Encryption Module

2232

Level 1HIBUN Cryptographic Module for User-Mode 1.0 Rev.2

JCMVP #J0015、CMVP#1696

Level 1HIBUN Cryptographic Module for Kernel-Mode 1.0 Rev.2

JCMVP #J0016、CMVP#1697

Level 1HIBUN Cryptographic Module for Pre-boot 1.0 Rev.2

JCMVP #J0017、CMVP#1698

Level 1

Keymate/Crypto JCMVP Library (Solaris*1and Windows*2editions）

JCMVP #J0007

Level 1

Keymate/Crypto JCMVP Library

JCMVP #J0005

Level 1

*1 Solaris is a trademark or registered trademark of Oracle Corporation, its subsidiaries, and affiliated companies in the USA and other countries.
*2 Windows is a trademark or registered trademark of Microsoft Corporation in the USA and other countries.

46

Level

Overview of the Hitachi Group
Company Profile（As of March 31, 2023）
Corporate name

Hitachi, Ltd.

Incorporated

February 1, 1920 (founded in1910)

Head office

1-6-6 Marunouchi,Chiyoda-ku, Tokyo,Japan

Representative

Keiji Kojima, President and CEO

Capital462.817 billion yen

322,525(Japan: 133,762, outside Japan:188,763)

Number of employees
Number of consolidated
subsidiaries

696 (Japan: 119, outside Japan: 577)

Numberof equity-method
associates andjoint ventures

267

Business Performance Highlights for FY 2022,
Based on the International Financial Reporting Standards(IFRS)Revenue

10,811.1 billion yen（106% year on year）

Net income attributable to Hitachi, Ltd. stockholders

Adjusted EBITA*1

884.6 billion yen（up 29.2 billion yen, year on year）

Adjusted operating income ratio

6.9％（down 0.3 percentage points, year on year）
8.1％（down 0.2 percentage points, year on year）

649.1 billion yen（up 65.6 billion yen, year on year） Adjusted EBITA ratio(billion yen)(billion yen)

12,00010,00010,881.1

10,264.6

9,480.6
8.0%

8,767.2

8,729.1

7.5%

8,000

5.7%

8.3%
7.2%
583.4

6,000

1,200
1,000

8.1%
6.9%
649.1

800

■ Revenue (left scale)

600■ Net income attributable
to Hitachi, Ltd.
stockholders (right scale)

501.6
4,000

400

222.5
87.5

2,000
0

2018

2019

200

2020

2021

2022

0

(FY)

Adjusted operating
income ratio (%)
Adjusted EBITA
ratio (%)

*1 Adjusted EBITA (Adjusted Earnings Before Interest, Taxes and Amortization): Adjusted operating income + Acquisition–related amortization + Share of profits (losses) ofinvestments accounted for using the equity method
Note: Hitachi's consolidated financial statement is prepared based on the International Financial Reporting Standards (IFRS).

■ Revenue by Region*■ Business Composition*

OthersDigital Systems &Services

5%

29%

16%

Green energy &mobility

30%

Japan

North
America
Europe7,638.2 billion yen

36%

6%

14%

FY 2022
Revenue

Connective
Industries

Other Regions

ASEAN and India

9%42%
FY 2022
Revenue

7,638.2 billion yen

China

13%

*Note: Figures are for the continuing consolidated business (three sectors), excluding Hitachi Metals and Hitachi Construction Machinery, which were deconsolidated in FY2022,
and Hitachi Astemo, which is scheduled to be deconsolidated in FY2023. The figures on this page are FY2022 results

47

Information Security Risk Management Division
1-6-6 Marunouchi, Chiyoda-ku, Tokyo 100-8280
Tel: 03-3258-1111

All product names and services mentioned herein are registered trademarks or trademarks in Japan and/or other countries.