資料３－３

The Basic Policy of
Critical Information Infrastructure Protection(3rd Edition)(Tentative Translation)

May 19, 2014
Information Security Policy Council
XXX xx, 2015 (Revised)
Cybersecurity Strategic Headquarters
Government of JAPAN(This page intentionally left blank.)

Contents
I. INTRODUCTION ················································································· 1
1. BACKGROUND············································································· 1
2. CLARIFICATION OF THE PURPOSE OF CIIP······································ 3
3. LESSONS LEARNED FROM ACTIVITIES UNDER THE SECOND EDITION4
3.1
3.2

4.
5.

ISSUES TO BE CONSIDERED ························································· 7
REVIEW OF THE SCOPE OF CII ······················································ 9
5.1
5.2

6.

Outcome························································································· 4
Challenges ······················································································ 5Results ··························································································· 9
Relationship between existing CII sectors and added sectors ··················· 10

OUTCOME OF THE REVIEW FOR THE REVISION OF BASIC POLICY ·· 11

II. EXECUTIVE SUMMARY OF THE BASIC POLICY ··································· 13
III. POLICIES FOR CIIP ········································································· 15
1. MAINTENANCE AND PROMOTION OF THE SAFETY PRINCIPLES ······ 15
1.1
1.2
1.3

2.

ENHANCEMENT OF INFORMATION SHARING SYSTEM···················· 17
2.1
2.2
2.3
2.4

3.

Improvement of cross-sectoral exercises ·············································· 22
CEPTOAR communication training ····················································· 24

RISK MANAGEMENT ··································································· 25
4.1
4.2
4.3

5.

Information sharing system during the term of this Basic Policy ················· 17
Promotion of information sharing ························································ 18
Promotion of CII operators activities ···················································· 19
Responsibilities of each stakeholder in the information sharing system ······· 19

ENHANCEMENT OF INCIDENT RESPONSE CAPABILITY ·················· 22
3.1
3.2

4.

Continual improvement of the Guidelines for safety principles ··················· 15
Continual improvement of the safety principles ······································ 15
Promotion of the safety principles ······················································· 16

Basic view of risk management ·························································· 25
Support for risk management ····························································· 26
Establishing a process of synergizing the relevant policies ······················· 28

ENHANCEMENT OF THE BASIS FOR CIIP ······································· 29
5.1
5.2
5.3

Public relations activities ··································································· 29International cooperation ··································································· 29
Maintenance of reference of standards and guides ································· 30

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS ································· 32
1. ACTIVITIES BY CABINET SECRETARIAT ········································ 32
2. ACTIVITIES BY RESPONSIBLE MINISTRIES FOR CIIP ······················ 34
3. ACTIVITIES BY INFORMATION SECURITY RELATED MINISTRIES ······ 36
4. ACTIVITIES BY CRISIS MANAGEMENT MINISTRIES ························· 36
5. VOLUNTARY ACTIVITIES BY CII OPERATORS ································· 36
6. VOLUNTARY ACTIVITIES BY CEPTOAR ·········································· 38
7. VOLUNTARY ACTIVITIES BY THE CEPTOAR COUNCIL ····················· 38

i

8.
9.

VOLUNTARY ACTIVITIES BY CIIP SUPPORTING AGENCIES ·············· 39
VOLUNTARY ACTIVITIES BY CYBERSPACE-RELATED OPERATORS ·· 39

V. ASSESSMENT, VERIFICATION AND REVISION····································· 40
1. GOALS TO BE ACHIEVED DURING THE TERM OF THIS BASIC POLICY 40
1.1
1.2
1.3

For all stakeholders·········································································· 40
For CII operators ············································································· 41
For Cabinet Secretariat ····································································· 42

2. CONTINUAL IMPROVEMENT BASED ON ASSESSMENT AND
VERIFICATION DURING EACH FISCAL YEAR ········································ 43
3. METHODOLOGY FOR ASSESSMENT AND VERIFICATION DURING EACHFISCAL YEAR ··················································································· 44
3.1
Indexes for the assessment and verification of activities by CII operators ···· 44
3.2
Indexes for the assessment and verification of activities by governmentorganizations ···························································································· 45

4. RIVISION OF THE BASIC POLICY BASED ON THE ASSESSMENT OF THE
OUTCOMES ····················································································· 48
ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATIONSHARING FROM NISC" ········································································ 49
1. INFORMATION RELATED TO IT FAILURES, ETC······························· 49
2. INFORMATION SHARING TO NISC FROM CII OPERATORS ··············· 50
2.1
2.2
2.3
2.4

3.

In case of "information sharing to NISC" ··············································· 50
Contents of "information sharing to NISC" ············································ 50
Framework for "information sharing to NISC" ········································ 50
Handling of "information sharing to NISC" ············································· 50

INFORMATION SHARING FROM NISC TO CII OPERATORS ··············· 52
3.1
3.2
3.3
3.4
3.5

Scope of CII operators subject to "information sharing from NISC"············· 52
Contents of "information sharing from NISC" ········································· 52
Framework for "information sharing from NISC" ····································· 52
Cooperation for "information sharing from NISC" ···································· 53
Improvement of the quality of the information to be shared ······················· 53

ANNEX 1. SCOPE OF CII OPERATORS AND CRITICAL INFORMATION SYSTEM
EXAMPLES ························································································ 54
ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELS ·············· 56
ANNEX 3. CATEGORIES OF EVENTS AND CAUSES FOR INFORMATIONSHARING TO NISC ·············································································· 60
ANNEX 4-1. INFORMATION SHARING SYSTEM (NORMAL CIRCUMSTANCES)61
ANNEX 4-2. INFORMATION SHARING SYSTEM (IT CRISES) ······················ 62
ANNEX 5. COMMUNICATION CHANNELS UNDER IT OUTAGES ················· 63
ANNEX 6. DEFINITIONS / GLOSSARIES ················································· 66

iiI. INTRODUCTION
1. BACKGROUND

I. INTRODUCTION
1. BACKGROUND
1The Basic Policy of Critical Information Infrastructures (hereinafter abbreviated as CII) is ashared basic policy for the government, which bears responsibility for the protection of the CII,
and CII providers, which independently carry out relevant protective measures. It wasestablished to serve as the basis for the policy related to information security measures forJapan's critical infrastructure, such as the enactment of the "Special Action Plan on
Cyber-terrorism Countermeasures for Critical Infrastructure" (concluded in the December
2000 Information Security Measure Promotion Meeting), prior to the establishment of the2

National Information Security Center (NISC) .
After the establishment of the NISC, in 2005, the "First Action Plan on Information Security
Measures for Critical Information Infrastructures" (hereinafter referred to as the First ActionPlan) was established based on the "Basic Orientation for Countermeasures Necessary forProtecting Critical Infrastructure from IT Outages and Ensuring Business Continuity of
Critical Infrastructure Providers" presented in the Information Security Policy Council of thesame year. Based on the First Action Plan, relevant measures were taken by the stakeholders
including the government and 10 CII sectors with a view to reducing IT outages at CII as close
to zero as possible.
Furthermore, the "Second Action Plan on Information Security Measures for Critical
Information Infrastructure" (hereinafter referred to as the Second Action Plan) was establishedin 2009 which identified policies to be implemented by the nation, based on the basic measures
for CIIP and the public-private information sharing framework established by the First Action
Plan. The Second Action Plan has taken over the measures of the "maintenance and promotion
3of the safety principles", "enhancement of information sharing", "common threat analysis " and"cross-sectoral exercises" in the First Action Plan and also additionally identified policies for"response to environmental changes" in order to appropriately address ever-changing social
and technological environment.
In this manner, the protection of Japan's CII has been carried out for 13 years since theSpecial Action Plan and even for 8 years since the establishment of the Second Action Plan. It
can be concluded that relevant measures have been steadily implemented based on 5 policies

1

The terminology "Action Plan" was used in the previous version of this document. However, taking the nature of this document
into consideration, the title is renamed as "The Basic Policy of Critical Information Infrastructure Protection".
2
The National Information Security Center (NISC) was reorganized as the "National center of Incident readiness and Strategy for
Cybersecurity (NISC)" on January 9, 2015.
3
In the First Action Plan, this was referred to as "interdependency analysis".

1

I. INTRODUCTION
1. BACKGROUND

such as establishing a robust information sharing system.
As such, this Basic policy appropriately reflected the lessons learned through the assessmentof a group of policies identified in the Second Action Plan while taking into account the
Cybersecurity Strategy (determined at the June 2013 Information Security Policy Council).
Furthermore, in addition to the lessons learned from the experience of dealing with systemoutages and data loss during the Great East Japan Earthquake, this Basic Policy also reflects
appropriate responses to the ever-changing social and technological environment and the trendsof increasingly sophisticated and complex cyber-attacks carried out in recent years.

2

I. INTRODUCTION
2. CLARIFICATION OF THE PURPOSE OF CIIP

2. CLARIFICATION OF THE PURPOSE OF CIIP
As a basis for the implementation of this Basic Policy, it is necessary to clarify the purposeof the protection of CII and to share awareness among stakeholders.
Cybersecurity Strategy identified "Ensuring Free Flow of Information", "Responding toIncreasingly Serious Risks", "Enhancing Risk-based Approach" and "Acting in Partnership
Based on Shared Responsibility" in its Basic Principles, and the purpose of the Second Action
Plan are consistent with the Cybersecurity Strategy.
As such, in addition to maintaining the elements of the purpose of the Second Action Plan,
the need for continuous provision of CII services was added, which further clarified the
purpose of CII protection.
Purpose of "CII protection" (referred to as "CIIP")
In order to continuously provide CII services and to avoid serious effects on the publicwelfare and socioeconomic activities from IT outages resulting from natural disasters,
cyber-attacks or other causes, all stakeholders should protect CII by reducing the risk of IT
outages as much as possible and by ensuring prompt recovery from IT outages.
Basic Principles for CIIP
In the first place, CII operators should implement measures for CIIP on their own
responsibility. In addition, a sense of security should be nurtured among the public andsocial development, resilience and international competitiveness should be promoted
through activities in cooperation between Government and private sectors.
・ The CII operators should respectively take measures and make effort for continuous
improvement of those measures as entities providing services and bearing social
responsibilities.
・ Government organizations should provide necessary support for CII operators' activities
for CIIP.
・ Each CII operator should cooperate and coordinate with other stakeholders due to thelimit of each operator’s individual information security measures to address various
threats.

3

I. INTRODUCTION
3. LESSONS LEARNED FROM ACTIVITIES UNDER THE SECOND EDITION

3. LESSONS LEARNED FROM ACTIVITIES UNDER THE SECONDEDITION
The Second Action Plan is composed of the following 5 policies.
[1] Maintenance and promotion of the safety principles[2] Enhancement of information sharing system[3] Common threat analysis[4] Cross-sectoral exercises[5] Response to environmental changes
Each policy’s outcome and challenges are summarized as follows:

3.1 Outcome
The assessment of these policies was carried out according to the assessment indexes set in
the Second Action Plan since the Second Action Plan was determined based on the most
updated information regarding CII as of 2009. Consequently, for the expected targets, it can beconcluded that a certain result was achieved as elaborated below.
For maintenance and promotion of the safety principles, stakeholders involved in measures
for CIIP could understand and identify necessary measures which they should takeindependently and made efforts to carry out such measures under a periodic self-inspection. As
a result, an integrated and steady review cycle was established for guidelines and the safety
principles, which reinforced the promotion of measures for CIIP.
As for enhancement of information sharing, for the purpose of addressing the ever-changing
social and technological environment surrounding CII security measures and increasingly
complex and sophisticated cyber-attacks, frameworks for information sharing with NISC wasestablished through cooperation between Government and private sectors, and the utilization ofsuch frameworks was steadily achieved. In addition, information sharing within and among
CEPTOARs was realized and necessary information was shared and utilized among CII
operators.
For common threat analysis, as a result of carrying out examinations of common threat
analysis based on analyses of cross-sectoral circumstances which is indispensable for the
maintenance and enhancement of protective capability for overall CII, basic material wasprovided which contributed to the establishment of business continuity plans for CII operatorsand part of the result was reflected in guidelines.
For cross-sectoral exercises, as a result of making efforts to provide opportunities forverification of systems for communication and collaboration through simulated exercises with4

I. INTRODUCTION
3. LESSONS LEARNED FROM ACTIVITIES UNDER THE SECOND EDITION

the participation of both public and private stakeholders in all relevant sectors in case of IT
outages, the number of organizations and individuals participating in the exercises is on an
upward trend. Furthermore, it contributed to information security through verification of CII
operators’ manual for early recovery and business continuity plans in case of an IT outage,
based on the lessons learned through the exercises.
Regarding public relations activities in particular among the response to environmental
changes, materials on the results of CII information security policy, meeting materials of CIISpecial Committee under the Information Security Policy Council and other materials wereposted and published on the Cabinet Secretariat website. In addition, lectures focusing on
information security policy and other events were held. As for development of risk
communication, exchanges of opinion were held among CIIP supporting agencies and a mutual
understanding WG was held at a CEPTOAR council. As for promotion of international
cooperation, cooperation with other foreign countries was carried out through such initiatives
4

5

as participating in the Meridian and the Cyber Storm Exercises . Through these initiatives,
relevant efforts were made to improve capabilities to perceive threats due to environmental
changes.

3.2 Challenges
Through the implementation of each policy, challenges were identified which required
improvement/reinforcement of the policy based on environmental changes fromsocial/technological aspects. The principal challenges for each policy are described below.
As for maintenance and promotion of the safety principles, reexamination in conformity
with measures for continued improvement in line with the PDCA cycle of CIIP measures at CII
operators should be carried out. This is because measures for CIIP also have an effect not only
on CII operators themselves but also on the maintenance and enhancement of protective
capability for overall CII. Furthermore, there have been requests from CII operators for sharing
guidelines which have prioritized items based on the actual conditions of measures.
With regard to enhancement of information sharing, necessary measures to establish aneffective information sharing system include: eliminating the gap in terms of the frequency of
information sharing among sectors; further elaborating "threat patterns"; establishing an
emergency information sharing system to cope with IT crises, which should be the same basisof normal conditions; and studying forms of coordination with other new stakeholders.
4

An international forum where CII supervisors from various countries meet and carry out discussions specialized for CII
protection.
5
A large scale exercise held by the U.S. government. Japan participates as a member of the IWWN (International Watch andWarning Network) when promoting international measures for handling vulnerabilities, threats and attacks.

5

I. INTRODUCTION
3. LESSONS LEARNED FROM ACTIVITIES UNDER THE SECOND EDITION

For common threat analysis, detailed analysis of threats based on changes over time andenvironmental changes which have become evident is necessary. The purpose of this analysis is
to improve the effects of threat analysis and to conduct reviews on how to carry out common
threat analysis from the perspective of expanding the scope of such analysis to include threats
which may have a major effect broadly even if not on all sectors instead of limiting the scope
only to the common threats across all sectors, looking ahead to the review of the subject androle as well as the frequency of such analysis.
As for cross-sectoral exercises, the design of exercise environments is limited since the IT
usage and information management at each organization differs, which makes it unlikely torealize a major expansion of the number of participants. For this reason, with a view toproviding CII operators opportunities to identify shortcomings of CIIP measure, further
dissemination and promotion of the outcome of the exercises across the entire CII sectors
should be realized , rather than depending only on the expansion of participants. Additional
issues to be addressed include: qualitative improvement of how to carry out exercises based on
the assessment of results; identification of relevant stakeholders based on responses to CII IT
outages; and examination of collaboration between exercises and training sponsored by andresponsible ministries for CIIP and those in charge of disaster prevention.
Regarding public relations activities in particular among the response to environmental
changes, reexamination of public relations activities depending on the purpose and the scope of
information disclosure should be carried out, while ensuring consistency among policies in thenext-term Basic Policy. For development of risk communication, challenges include: having adefinition of risk management in conformity with international standards; reexamination of
information sharing which takes into account the balance between the secrecy of sensitive
information and the value of such information; and continued mid- to long-term examinationand study of the themes of environmental changes such as new IT technologies which will be
developed and utilized in the mid- to long-term and a significant impact of threat against whichis expected. For promotion of international cooperation, continuous promotion of cooperation
with other countries is necessary in order to quickly address increasingly globalized risks in the
cyberspace that transcends national borders. It is also necessary to reinforce international
cooperation through active utilization of bilateral, inter-regional and multilateral frameworks in
the Asia-Pacific, such as with ASEAN, as well as with the United States and Europe.

6

I. INTRODUCTION
4. ISSUES TO BE CONSIDERED

4. ISSUES TO BE CONSIDERED
In addition to identifying the challenges in the previous section and the issues which were
specified in the Cybersecurity Strategy, the following examinations were carried out todetermine the direction of this Basic Policy based on the aforementioned challenges.

Issue 1 While CII protection continues to develop as a system, in regard to the "In the firstplace, CII operators should implement measures for CIIP on their own
responsibility." in the Basic Principles, there are some CII operators which are not
implementing such measures or which lack sufficient understanding on this point.
What are the appropriate ways to promote effective and voluntary activities by
those CII operators?
<Direction>* The content should not be something too idealistic that are difficult for CII operators to
implement in a realistic way. It should take into account the reality and be something"accomplishable" in line under the current situation. For example, expressions such as"absolute security is expected" or "100% perfection is anticipated" should be avoided.
* Basic items should be articulated in the Basic Policy so that executives and senior managers
in the business community who hold the key to ensure information security at CII operators
can understand the need for the implementation of the Basic Policy.
* Since both experts as well as non-experts are likely to read the Basic Policy, the Plan should
be something easy to comprehend for any relevant parties so that each party understands
what kind of measures are required to take under the Basic Policy.
* Clarify the PDCA cycle for maintenance and enhancement of protective capability for CII,
particularly vis-à-vis small- and medium-sized CII operators as well as those operators stillin the process of developing such capability, which will contribute to promoting effective
and voluntary measures by those operators.
* Explain in detail the importance of risk management and the need for introducing such risk
management by CII operators so as to address environmental changes in a flexible manner.
* Compile regulations across various layers which CII operators are required to understand intoa certain kind of package in a way that such package can easily be shared and handed over tosuccessors among relevant parties despite high turnover.
* Further promote public relations activities so that even after the Basic Policy is released,
appropriate response will be made to address ever-changing environment and collection andprovision of relevant information will be continuously carried out.

7

I. INTRODUCTION
4. ISSUES TO BE CONSIDERED

Issue 2 In regard to ever-changing social and technological environment and threats whichhave become increasingly serious year by year, there are concerns that measures
have not been fully taken to respond in an appropriate and quick manner. What typeof activities, both in the public and private sectors, will be necessary in order toappropriately address such environmental changes and threats? In addition, isn’t itnecessary to consider if there are any actors which should be included as
stakeholders?
<Direction>* Add relevant parties among cyberspace-related operators as stakeholders so as to ensure morerobust information sharing.
* Promote greater awareness among relevant parties that activities of CII operators incyberspace could be targeted and be exploited and that they should bear responsibility
accordingly.
6* Conduct examination on priority risk sources across multiple areas and continual
examination of mid- to long-term changes of new technologies, systems, etc., taking into
account the fact that threats and vulnerabilities in each area and among CII sectors vary andthat social and technological environment is constantly changing.

Issue 3 While a variety of activities have been initiated among stakeholders to address
potential IT outages, there are concerns that the management and systems(public-private and public-public) in the event of a severe IT outage have not been
sufficiently identified. Isn't it necessary to identify the scope of information whichneeds to be shared and to elaborate each stakeholder’s response and coordination
mechanism in the event of such a severe IT outage?
<Direction>* Enhance an effect of exercises, training, etc., through collaboration among exercises andtrainings among relevant stakeholders.
* Establish a mechanism which detects when and what kind of IT crises require special
warnings among CII operators, and clarify to the possible extent who should be added as
stakeholders and how they should be added to a response systems under normal
circumstances (situations other than during IT crises response). (*It is not realistic to set up
an entirely new system when an incident occurs.)

6

According to JIS Q 31000:2010, risk source is defined as "elements which alone or in combination has the intrinsic potential to
give rise to risk".

8

I. INTRODUCTION
5. REVIEW OF THE SCOPE OF CII

5. REVIEW OF THE SCOPE OF CII
During the process of compiling this Basic Policy, deliberation was carried out on the scopeof CII, which is currently composed of 10 sectors identified in the Second Action Plan. Further
study was carried out to determine whether new sectors should be added in the list of CII.
7

In addition, as for issues identified in the Cybersecurity Strategy as something that further
deliberation will be carried out on, including the scope of the CII, deliberation will continue by
taking into account environmental changes and based on coordination with relevant parties.

5.1 Results
Deliberation was carried out, based on the lessons learned from the past experiences, such as
during the Great East Japan Earthquake.
In the case of deliberation, we have conducted identification of sectors that had not been
identified as CII in the Second Action Plan. But these might make same serious impacts on the
public welfare and socioeconomic activities as existing CII sectors in the event of an IT outage.
As a result, several sectors were identified as necessary to be added as new CII sectors asshown in Table 1.
Table 1. Results of study on the scope of CIIClassification

Viewpoint/Necessity

SectorValue and scale of the service to be provided
by the sector

Credit card
services

Sectors to be added due to the effects inthe event of an IT outage of the sectors
Scale of the potential risk under a situation
concerned
where the sector gets out of control
Sectors to be added due to the effects on
the information systems of the current CII Interdependency with the current CII sectors
sectors

Chemicalindustries,
petroleumindustries
Petroleumindustries(See above)

As a result, in this Basic Policy, the CII sectors are composed of the following 13 sectors:"information and communication services", "financial services", "aviation services", "railway
services", "electric power supply services", "gas supply services", "government andadministrative services (including municipal government)", "medical services", "water
services", "logistics services", "chemical industries", "credit card services" and "petroleum
industries".
When these added sectors participate in the existing efforts as CII, it is important for thesector to recognize why the sector was added and what is the merit of the participation without
7

Refer to "2. Basic Policy" - "(3) Roles of Multi-Stakeholder" - "② Roles of critical infrastructure providers" (p. 20).

9

I. INTRODUCTION
5. REVIEW OF THE SCOPE OF CII

doubts, in order to understand the necessity of own initiative.
For ministries and agencies which have jurisdiction over the added sectors and for thoseindustry groups which are candidates for serving as CEPTOAR secretariat, a pivot to ensure
information sharing, explanations were made on the above viewpoints. As a result, there isshared understanding among relevant parties about the addition and the participation of new
sectors as CII. Furthermore, the relevant industry groups are identifying critical information
systems and service maintenance levels and preparing for the establishment of a CEPTOAR.

5.2 Relationship between existing CII sectors and added sectors
7 years have passed since the establishment of the information sharing system in FY2007.
Currently, each CEPTOAR has certain experience through implementing CIIP measures andhas unique qualities originating from the nature of each operation and others.
Against such backdrop, when these added sectors participate as new CEPTOARs, there is aconcern that the activities of the existing CEPTOARs could be overwhelming. It is necessary
for the Cabinet Secretariat to give advice to those new sectors, keeping in mind thatcooperation with other CII operators in the same CII sector and CII operators in other CII
sectors is important. In addition, it is also expected that at a CEPTOAR council, CEPTOARs
advice will be given to the added sectors out of a spirit of mutual support, which will contributeto maintenance and enhancement of protective capability for overall CII.

10

I. INTRODUCTION
6. OUTCOME OF THE REVIEW FOR THE REVISION OF BASIC POLICY

6. OUTCOME OF THE REVIEW FOR THE REVISION OF BASIC POLICY
Based on the challenges and directions identified, , in the process of compiling this Basic
Policy, it was decided that the basic framework of the Second Action Plan, which was inconformity with the Cybersecurity Strategy, would be maintained. However, individual
policies and the implementation systems were decided to be revised, and through reinforcing
and refining the components of the Basic Policy, the policy group structure shown in Table 2
was specified.
Table 2. Policy groups and direction of reinforcing and refining the componentsof the Basic Policy
Policy groups inthis Basic Policy

Policy groups in the Second
Action Plan and the status ofeach group

Direction of reinforcing and refining the components of
the Second Action Plan

1. Maintenanceand promotionof the safety
principles

Keep the element of "[1]Maintenance and promotionof the safety principles"- Articulate the process of reflecting the results on
guidance and measures- Make an appeal based on the growth models, etc. andconduct reviews on the actual status of theimplementation of relevant measures

2. Enhancement of Keep the element of "[2]information
Enhancement of information
sharing systemsharing system"- Review and rearrange the relationship of eachstakeholder in the information sharing system,
including new stakeholders- Review the scope of information (threat patterns, etc.)
which should be shared among relevant parties basedon the increase in cyber-attack related information- Clarify crisis management system in case of IT crises
based on the management under normal
circumstances

3. Enhancement of
Re-arrange the element ofincident"[4] Cross-sectoral
response
exercises"
capability- Enhance overall IT outage response system after
developing an understanding of the overall image of
CII related exercises and training- Ensure qualitative enhancement of cross-sectoral
exercises in view of the need for coordination withnew stakeholders

4. Riskmanagement

Re-arrange the element after
integrating a portion of "[3]Common threat analysis"
with "[5] Response toenvironmental changes"- Implement a mid- to long-term studies on potential risk
sources which could have a major impact on multiple
sectors as a result of environmental changes as well as
environmental changes which could have a major
impact in the future- Make an appeal for CII operators to have accurate
understanding on the current circumstances and on
risk management which will be the key to identify
goals on their own responsibilities

Re-arrange after excluding- Add reference for related international
5. Enhancement of the sections of "[5] Response
standards/norms, regulations etc. and method forthe basis forto environmental changes"
utilizing those in addition to public relations andCIIP
integrated with "[3] Common
international cooperation
threat analysis"

In order to ensure an appropriate response to major environmental changes which could take11

I. INTRODUCTION
6. OUTCOME OF THE REVIEW FOR THE REVISION OF BASIC POLICY

place after this Basic Policy is issued, it is necessary to continually monitor environmental
changes and identify threats from the information, and to construct systems that will enable
flexible response. In addition, it is also important for the systems to be able to seamlessly shift
from that of normal circumstances to that of IT crises while ensuring robust measures toenhance IT outage response systems, rather than just focusing on prevention which wasapriority previously.

12II. EXECUTIVE SUMMARY OF THE BASIC POLICY

II. EXECUTIVE SUMMARY OF THE BASIC POLICY
The key points for this Basic Policy are as follows;(1) Purpose of "CII protection" (referred to as "CIIP")
In order to continuously provide CII services and to avoid serious effects on the publicwelfare and socioeconomic activities from IT outages resulting from natural disasters,
cyber-attacks or other causes, all stakeholders should protect CII by reducing the risk of IT
outages as much as possible and by ensuring prompt recovery from IT outages.
(2) Basic Principles for CIIP
In the first place, CII operators should implement measures for CIIP on their own
responsibility. In addition, a sense of security should be nurtured among the public and social
development, resilience and international competitiveness should be promoted throughactivities in cooperation between Government and private sectors.
- The CII operators should respectively take measures and make effort for continuous
improvement of those measures as entities providing services and bearing social
responsibilities.
- Government organizations should provide necessary support for CII operators' activities for
CIIP.
- Each CII operator should cooperate and coordinate with other stakeholders due to the limit ofeach operator’s individual information security measures to address various threats.
(3) Responsibility of the stakeholders; CII operator / government organizations /CIIP supporting agency- All the stakeholders should periodically check the progress of their own measures and policies
as part of relevant efforts and accurately recognize the current circumstances, and proactively
determine the goals of relevant activities. In addition, stakeholders should enhance theircooperation with each other, taking into account the status of other stakeholders’ relevant
activities.
- All the stakeholders should understand the 5W1H (when, where, who, why, what and how) of
IT outage response depending on the scale of IT outages and should be able to calmly address
signs or occurrence of an IT outage. They should be capable to cooperate with otherstakeholders and respond in a cooperative and concerted manner in addition to ensuring robust
communication among various stakeholders and taking proactive measures.
(4) Responsibility of CII operator's executives and senior managers
In addition to the aforementioned measures, the executives and senior managers should
recognize the need for and be able to ensure the implementation of the following measures:- Recognize risk sources with a focus on information security for the purpose of CIIP.
- Assess risk sources and set forth measures to address those risks by identifying priorities.
- Determine plans necessary for the establishment and operation of systems and theimplementation of relevant policies in addition to securing management resources (e.g. budget,
human resources, etc.).
- Check the status of the implementation of relevant policies through monitoring the system
operation.
- Check the status of incident response capability including information sharing among relevant
stakeholders through conducting exercises and trainings.

13

Policy

Rulemaking

CII operator measure examples

14

Resource
management

Government activities

Public relations / International cooperation / Arrangement of standards

Enhancement of the basis for CIIP

Survey on activities under the safety principles

Information sharing between
public-private stakeholders
Information sharing facilitationon the CEPTOAR council

Establishment

Continual improvementof the guides for safety principles
Continual improvementof the safety principles

normal circumstances Outages

Information sharing

Protection/recovery
from IT outage
Public announcementof measures for CIIP

Issue identification throughIT outage response

Training by
responsible ministries for CIIP

CEPTOAR communication training

Cross-sectoral exercises

Incident response

Risk identification / analysis
supportRisk management

Issue identification through results ofresearch/analysis of IT environmental change

Issue identification throughexercises and training

Issue identification throughoperation of measures for CIIP
Issue identification throughinternal/external audits

Check (verify) + Act (revise)/identification and fixing issues

Outages

Safety principles

Design/procedure manual creation/maintenancerelated to operational measures for CIIP

Design/implementation/maintenancerelated to technological measures for CIIP

Clarification and modification of
information security requirements

Public announcementof measures for CIIP

(Recognizing signs, changing passwords, etc.)

Operation of measures for CIIP

Management review ofmeasures for CIIP operation(M onitoring/control)

Operation of measures for CIIP

Do (actual operation)/detection and recovery

normal circumstances(management system/contract/during IT outages)

Measures for outsourcing

Human resource development/assignment
and accumulation of know-how(budget, human resources, infrastructure)

Planning

Provision of resources

Information handling

IT-BCP(Information security policy, etc.)

Establishment and revision of roadmap
for measures for CIIP
Establishment and revision of planfor measures for CIIP

Basis

Internal rule

Risk assessment
based on identified issues
Determination and revisionof operator’s basic policyPlan (preparation)/prevention and mitigation

Figure 1. "CII operator measure examples" and "Government activities"

II. EXECUTIVE SUMMARY OF THE BASIC POLICYIII. POLICIES FOR CIIP
1. MAINTENANCE AND PROMOTION OF THE SAFETY PRINCIPLES

III. POLICIES FOR CIIP
1. MAINTENANCE AND PROMOTION OF THE SAFETY PRINCIPLES
During the term of this Basic Policy, the Cabinet Secretariat carries out the review the
Guidelines for safety principles and related surveys so that they would conform with the PDCA
cycle of CII operators and would enhance the cooperation with other policies, in order tostrengthen the ability of CIIP.
Also, CII operators continuously and steadily work on measures for CIIP in accordance with
their PDCA cycle, in view of importance of the measures.

1.1 Continual improvement of the Guidelines for safety principles
The Cabinet Secretariat carries out the review the Guidelines in FY 2014, in order tostrengthen the ability of CIIP, especially in order to contribute to effective and autonomous
activities of mid-process or small-and-medium-sized CII operators.
In detail, it arranges the orders of the items in the Guidelines in accordance with the PDCA
cycle of CII operators, and adds some items, if necessary, based on knowledge from otherpolicies etc. in this Basic Policy.
In addition, some example views on prioritization of measures for CIIP in case CII operators
execute these measures, ways of gradual addition of measures for CIIP, and ones on balancing
with pre-active measures and post-active measures, are described as "growth-model".
Further, the Guidelines appeal the importance of the responsibility of CII operator’s
executives and senior managers regarding policy, rulemaking, planning, resource management
and establishment that are essential to gradually and constantly strengthen CII operators'
measures.
After FY 2015, social trends changes and newly obtained knowledge is released each fiscal
year, and the revision of the Guidelines is executed every 3 year or as necessary.

1.2 Continual improvement of the safety principles
Responsible ministries for CIIP and CII operators continually improve the safety principles
based on knowledge learned from experiences when taking the measures, in order to maintainor strengthen the abilities of not only individual CII operator but also overall CII.
In detail, they approach continual improvement of the safety principles through risk
assessment, by identifying issues from operation of measures for CIIP, internal/external audits,15III. POLICIES FOR CIIP
1. MAINTENANCE AND PROMOTION OF THE SAFETY PRINCIPLES

environmental change studies, exercises, training and incident responses.
In addition, when verifying the safety principles, the Guidelines as well as social trendchanges and newly knowledge released by the Cabinet Secretariat is used.
The Cabinet Secretariat carries out survey on the improvement of the safety principles by the
responsible ministries for CIIP each fiscal year and releases the results of survey.

1.3 Promotion of the safety principles
The Cabinet Secretariat carries out survey the CII operators' activities, in order to recognize
the status of promotion of the safety principles at CII operators. In addition, in order tocontribute to CII operators' effective and autonomous activities, survey operations will also be
revised so that responses to the survey will serve as self-checks of measures.
With regard to survey itself, the activities include addition of survey items that can identify
more detail conditions in CII operators and ones that can detect degrade of measures in CII
operators which have excellent conditions through periodical survey, with some expansion of
the coverage of the target CII operators.
With regard to survey operations, the activities include an arrangement of the questionnaire
items in the survey in accordance with the PDCA cycle so that the measures and process to be
enforced become explicit.
In addition, in order to supplement the survey using the questionnaire method, the Cabinet
Secretariat conducts visit to CII operators.
With regard to the visit, the activities include extraction of issues from detail conditions ofmeasures and collection of best practices, through the interviews with detail items based on thequestionnaire.
For the results from the questionnaires and the visit, in principal, these will be released eachfiscal year, and in addition, the obtained improvement issues reflected on each of the policies ofthis Basic Policy.
Survey items can be changed flexibly to the degree that such change does not impair theperiodical survey.

16III. POLICIES FOR CIIP
2. ENHANCEMENT OF INFORMATION SHARING SYSTEM

2. ENHANCEMENT OF INFORMATION SHARING SYSTEM
While the social and technological environments surrounding CII constantly change, it isnecessary to recognize these environmental changes accurately and then reflect these changes
in the measures for CIIP, in order to maintain the effectiveness of measures for CIIP. In
addition, it becomes more important to raise the level of measures in CIIP and cyber-attack
response capability due to increasing complexity, sophistication of cyber-attacks.
As described in the Basic Principles in "I.2. CLARIFICATION OF THE PURPOSE OF
CIIP", CII operators should fundamentally implement measures for CIIP at their own
responsibilities, however, it is difficult to verify whether a response by only itself to various
threats is sufficient or not. For this reason, it is important to work on necessary measures for
CIIP through cooperation by carrying out information sharing within sectors, between sectors
and through public private partnership.
Based on these conditions, in the term of this Basic Policy, the Cabinet Secretariat manages
the information sharing system among stakeholders including added sectors and stakeholders,further promotes information sharing, and works towards further vitalization of information
sharing activities by CII operators.

2.1 Information sharing system during the term of this Basic Policy
In this Basic Policy, for the purpose of enhancement of the information sharing system
during IT crises, the Information Security Policy Council (referred as "ISPC" hereinafter)
decides to add the disaster prevention related ministries for disaster management, and also add
cyberspace-related operators. They are consisted of system vendors, which are engaged in thedesign, construction, operation and maintenance of information systems required for providing
CII services, security vendors, which provide measures for CIIP and platform vendors, which
provide the platforms which serve as foundations. The information sharing system after these
addition is represented in "ANNEX 4-1. INFORMATION SHARING SYSTEM (NORMAL
CIRCUMSTANCES)" and "ANNEX 4-2. INFORMATION SHARING SYSTEM (IT CRISES)"
as extended system of the former one.
In addition, the ISPC reviews CII sectors' critical information systems and service
maintenance levels including those in newly added sectors. The results are shown in "ANNEX
1. SCOPE OF CII OPERATORS AND CRITICAL INFORMATION SYSTEM EXAMPLES" and"ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELS".
During the term of this Basic Policy, the stakeholders manage the information sharing
system according to their respective position and responsibilities. In addition, it is expected thatcyberspace-related operators implement measures required for the maintenance of information

17

III. POLICIES FOR CIIP
2. ENHANCEMENT OF INFORMATION SHARING SYSTEM

security, such as sharing of vulnerability information and preventing spread of damages in theevent of IT outages resulting from cyber-attacks.

2.2 Promotion of information sharing
For arrangement of information to be shared, it is important to identify and arrange
information that should be shared among stakeholders, including government organizations
and CII operators, from aspects of "proactive prevention of IT outages", "prevention of the
spread damages and quick recovery from IT outages", and "prevention of recurrence throughanalysis and verification of IT outage causes".
When establishing this Basic Policy, the Cabinet Secretariat has carried out revision of"ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATION SHARINGFROM NISC" and "ANNEX 3. CATEGORIES OF EVENTS AND CAUSES FORINFORMATION SHARING TO NISC" based on the above 3 aspects regarding the information
sharing system during normal times and during IT crises, in order to contribute to CIIP
including proactive prevention of IT outages.
8

9

In detail, the ISPC has revised event items based on the information security C.I.A
viewpoint and formed detailed cause items based on new threats, etc. in "ANNEX 3.
CATEGORIES OF EVENTS AND CAUSES FOR INFORMATION SHARING TO NISC", inorder to grasp situation of IT outage rapidly and accurately. In "ATTACHMENT:"INFORMATION SHARING TO NISC" AND "INFORMATION SHARING FROM NISC", the
ISPC has clarified the coverage of information sharing, including handling of IT outage
predictive information, in order to eliminate the disparity in the frequency of information
sharing between sectors.
During the term of this Basic Policy, the Cabinet Secretariat carries out information sharing
to and from NISC in accordance with the attachment, cooperate with stakeholders and promote
this information sharing system, with the expectation that information sharing among
stakeholders contribute to CII operation and their verification of measures, and proactive
prevention of IT outages. In addition, in the event any environmental change occurs, it attempts
to review the information system as appropriate.

8

An Information Security Event is defined as "The occurrence of a specific condition in systems, services or networks. Specificcondition refers to an unknown condition which may be related to potential violations of information security policy, management
measure failures or security." in ISO/IEC 27000:2013.
9Stands for Confidentiality, Integrity and Availability.

18

III. POLICIES FOR CIIP
2. ENHANCEMENT OF INFORMATION SHARING SYSTEM

2.3 Promotion of CII operators activities
It is expected that enrichment of information sharing between CEPTOARs as well as theactivities of the CII operators themselves enhances further vitalization of CII operator
activities.
In detail, it is expected that CII operators proactively work towards their own information
sharing activities as well as they construct and enhance IT failure response systems, such as
10

CSIRT ,. It is also expected between CEPTOARs that they continue to share information
provided by the Cabinet Secretariat, regarding agreements for handling of those provided
information, maintenance of confidentiality and provision of information outside of constituent
members, rules decided upon by constituent members will be applied, and the continued
11

sharing of information provided by the Cabinet Secretariat is expected with a PoC
established allowing contact between constituent members and with non-members in case of
emergency.
It is also expected that sharing activities is further activated through establishment of
coordinators who will carry out information collection and decision making within
CEPTOARs, sharing of predictive information and IT outage examples during normal times
and enhancement of functions required for information sharing between CEPTOARs and with
the CEPTOAR council.
The CEPTOAR council is an independent body, not positioned below other agencies,
including government, so information mutually shared based on independent determinations by
12each CEPTOAR .
In this sense, it is expected that CII operator activities, such as further enhancement of
information sharing between CEPTOARs, are further vitalized. through wide ranging andautonomous activities which contribute to the improvement of service maintenance andrecovery capacity at CII operators through the proactive involvement of each CEPTOAR

2.4 Responsibilities of each stakeholder in the information sharing system
The information sharing system is composed of an information sharing system for normal
times and an expanded information sharing system for times of IT crises, and the roles of IT
stakeholders during times of IT crises are also an expansion of their roles during normal times.
The overall image of information sharing during normal times and during IT crises is shown
10

Computer Security Incident Response Team. A system for monitoring to check if any security issues exist with information
systems and for carrying out investigations including cause analysis and extent of impact in the event an incident occurs.
11
PoC: Point of Contact.
12
According to CEPTOAR council charter (CEPTOAR council foundation preparatory committee and NISC).

19

III. POLICIES FOR CIIP
2. ENHANCEMENT OF INFORMATION SHARING SYSTEM

in "ANNEX 4-1. INFORMATION SHARING SYSTEM (NORMAL CIRCUMSTANCES)" and"ANNEX 4-2. INFORMATION SHARING SYSTEM (IT CRISES)" and the roles of eachstakeholder are as follows.
2.4.1

Responsibilities of each stakeholder in the information sharing during
normal circumstances

The roles of each stakeholder in the information sharing system during normal times are as
follows.
(1) CII operators
Information sharing related to IT outages and cyber-attacks shall generally be carried out by
the relevant CEPTOAR. In addition, responsible ministries for CIIP shall carry out information
sharing related to IT outages and cyber-attacks as necessary. In the event there are any criminal
damages, reports shall be made to the crisis management ministries based on independent
decisions.
(2) CEPTOAR
Cooperates with the CEPTOAR council, responsible ministries for CIIP and CIIP supporting
agencies to carry out mutual sharing of IT outage and cyber-attack related information,
recovery method information, early warning information, etc.
(3) the CEPTOAR council
The CEPTOAR council is an independent body, not ranked below other agencies, including
government organizations. Cooperation is carried out based on independent decisions by each
CEPTOAR.
Each CEPTOAR actively participates based on independent decisions and carries out a wide
range of information sharing aimed at CII operator service maintenance and recovery.
(4) Responsible ministries for CIIP
Carry out sharing to the Cabinet Secretariat (NISC) of IT outage and cyber-attack related
information received from CII operators over which the ministries have jurisdiction. Also carryout information sharing to CEPTOAR under the jurisdiction of the ministries as necessary.
Carries out information sharing to CEPTOAR under the jurisdiction of the ministries for IT
outage and cyber-attack related information, recovery method information and early warning
information received from the Cabinet Secretariat (NISC).
(5) Cabinet Secretariat (NISC)
Carries out reciprocal sharing of IT outage and cyber-attack related information and recovery
method information with responsible ministries for CIIP, CIIP supporting agencies from whom
requests for cooperation were received in advance and cyberspace-related operators.

20

III. POLICIES FOR CIIP
2. ENHANCEMENT OF INFORMATION SHARING SYSTEM

2.4.2

Responsibilities of each stakeholder in the information sharing during IT
crisesIn the event of an IT crisis resulting from disaster, terrorism or similar causes, collection andsharing of information related to the emergency shall be carried out between relevant ministries
in accordance with "Regarding the Government Initial Response System for Emergencies"(November 21, 2003, Cabinet resolution). If the situation worsens and shifts to IT crisis
response, the centralization of information in the crisis management ministries and the disasterprevention related ministries is important, so the information sharing system shall be laid out asfollows.
(1) Cabinet Secretariat (Situations Response and Crisis Management)
Is integrated with the Cabinet Secretariat (NISC) and collects damage information provided
by the crisis management ministries and the disaster prevention related ministries as well as
response conditions information and carried out reciprocal information sharing with the
Cabinet Secretariat (NISC).
(2) Cabinet Secretariat (NISC)
Is integrated with the Cabinet Secretariat (NISC) and carries out reciprocal sharing ofvarious related information and recovery method related information with responsible
ministries for CIIP, CIIP supporting agencies from which requests for cooperation werereceived in advance as well as cyberspace-related operators.
(3) Responsible ministries for CIIP
In addition to roles during normal times, shall also cooperate with system for IT crisis
response as necessary.
(4) CII operators
In addition to roles during normal times, shall also construct system for IT crisis response as
stipulated by CII operators.
(5) CEPTOAR
In addition to roles during normal times, shall also construct system for IT crisis response as
stipulated by each CEPTOAR.
(6) the CEPTOAR council
In addition to roles during normal times, shall also construct system for IT crisis response as
stipulated by each CEPTOAR.

21

III. POLICIES FOR CIIP
3. ENHANCEMENT OF INCIDENT RESPONSE CAPABILITY

3. ENHANCEMENT OF INCIDENT RESPONSE CAPABILITY
During the term of this Basic Policy, in addition to cross-sectoral exercises in the Second
Basic Policy, relevant exercises and trainings in order to improve IT incident response
capability and verification, are positioned as part of a policy of strengthening IT incident
response systems. And the Basic Policy attempts to maintain and improve capability for CIIP
as a whole by understanding the mutual relationships among these exercises and trainings andlinking them.
Among the exercises and trainings, based on the achievement until now, the Basic Policy
aims at continuing to enhance the positioning of cross-sectoral exercises as core means ofstrengthening the IT incident response system in CII sectors. In detail, the cross-sectoral
exercises should be mutually linked and complement the CEPTOAR training and otherexercises and training implemented by responsible ministries for CIIP, and enhance thevertical-directional systems within each CII sector and the horizontal-directional systems
between CII sectors in order to reap synergistic benefits.
In addition, because rapid crisis management becomes necessary in order to prevent spreadof damages, stakeholders implement measures and support policies to improve the IT incident
response capability of CII operators, while continuing to clarify the roles and enhancecooperation between stakeholders.

3.1 Improvement of cross-sectoral exercises
During the term of this Basic Policy, the Cabinet Secretariat continues to implement thecross-sectoral exercises, which are the only initiative in Japan, while constantly improving
them in order to contribute to the maintenance and improvement of protective capability for
CII through the promotion of the relevant exercise results to the entire CII sector.
In implementing cross-sectoral exercises, in line with the 3 objectives given in the Second
Basic Policy, those are "formation of a common awareness of cross-sectoral threats","improving the response capability of one's own sector by understanding the response
conditions of other sectors" and "acquiring policies for operating public-private information
sharing more effectively", the Basic Policy aims to enhance cross-sectoral exercises using
accumulated operation methods and results in order to contribute to the enhancement of theincident response system.
3.1.1

Planning of cross-sectoral exercises

During the term of this Basic Policy, the Cabinet Secretariat surveys plans for exercises
including participation of stakeholders closely related to the maintenance of IT systems

22

III. POLICIES FOR CIIP
3. ENHANCEMENT OF INCIDENT RESPONSE CAPABILITY

possessed by CII operators, as well as knowledge and issues obtained through exercise
operation issues from other policies, and latest trends related to risk sources which are a causeof IT outages, in order to improve continually cross-sectoral exercises.
In addition, the Cabinet Secretariat carries out verification aimed at improvement of theexercise results assessment process, in order to contribute to the further enhancement ofverification related to CII operator measures for CIIP, IT outage early recovery process and
IT-BCP.
The Cabinet Secretariat provides knowledge and issues obtained through the exercises asbasic data to other policies in this Basic Policy.
3.1.2

Promotion of lessons learned from cross-sectoral exercises

During the term of the Second Basic Policy, the number of exercise participants steadily
increased, and the percentage of participants who assessed the exercises as meaningfulexceeded 80%. The Basic Policy aims at the promotion of exercise results in CII sectors
through promoting new participation from individuals who had not yet participated in theexercises. However, as there is a limitation of participation increase to some degree, it isnecessary to promote increasing the number of participation and provide activities targeting CII
operators that do not participate in the exercises, in order to further propagate and promote
exercise results to overall CII.
For this activity, the Cabinet Secretariat creates and releases explanation materials regarding
the merits of exercises which can contribute to the promotion of increase understanding byexecutives and senior managers, and make appeals to overall CII sectors, and thereby promote
implementation of exercises in each CII sector and at each CII operator.
In addition, the Cabinet Secretariat promotes survey the arrangement and sharing of
implementation, assessment and advising methods accumulated from past exercises in order tocontribute to the support of exercise implementation by individual CII operators.
3.1.3

Response to IT outages from physical causes

In actual IT incident response, it may include IT outages resulting from physical causes, anddepending on the circumstances it may be necessary to share information not only with thevarious ministries and business information security departments, but also with disaster andcrisis management departments.
Hereafter, the Cabinet Secretariat, when making response to relevant IT outages subject toverification, when necessary in creation of scenarios, study the conditions for utilization ofknowledge from the disaster prevention related ministries and cooperation with the crisis
management supervisors at responsible ministries for CIIP and CII operators.

23

III. POLICIES FOR CIIP
3. ENHANCEMENT OF INCIDENT RESPONSE CAPABILITY

3.1.4

Cooperation with responsible ministries for CIIP

It is expected to work to maintain and improve effective and efficient protective capability
for CII by implementing these exercises and training to reciprocally cooperate with andcomplement the cross-sectoral exercises, while exercises and training contributing to CIIP
implemented by the responsible ministries for CIIP have different expected results from thecross-sectoral exercises implemented by the Cabinet Secretariat.
For this reason, the Cabinet Secretariat and responsible ministries for CIIP consider
conditions for clarification and mutual cooperation of verification purposes and the main
targets for the exercises implemented by each exercises in order to improve the response
capability of CII operators.
As an example of verification survey items, it would be possible to target information
sharing and collaborative response between CII operators, CEPTOAR, responsible ministries
for CIIP and the Cabinet Secretariat as verification targets in cross-sectoral exercises, and totarget IT incident response procedures using actual systems at CII operators and contact
systems in each sector for checking and verification in exercises by the responsible ministries
for CIIP.

3.2 CEPTOAR communication training
The Cabinet Secretariat continues CEPTOAR training based on the procedures for
information sharing to and from NISC for the purpose of maintenance and improvement ofprotective capability of the "vertical-directional information sharing" systems in each sector
between CEPTOAR and responsible ministries for CIIP.
In implementation CEPTOAR training, the Cabinet Secretariat aims to enhance substantialtraining content while also incorporating requests from CEPTOAR and to realize information
sharing training which is suited to actual conditions, bearing in mind response during IT
outages.
In addition, the Cabinet Secretariat considers collaboration, as necessary, such as setting
conditions based on the verification details of cross-sectoral exercises between cross-sectoral
exercises and CEPTOAR training, because the participation of a large number of CII operators
can be expected in CEPTOAR training.

24III. POLICIES FOR CIIP
4. RISK MANAGEMENT

4. RISK MANAGEMENTCII operators should establish objectives related to information security and deploy theobjectives within their organizations in order to achieve business goals such as stable provisionof CII services to the people and business continuance.
On the other hand, as the social and technological environments surrounding CII continuallychange, the dependence on cyberspace of information systems used in the CII and of the datautilized in these systems continues to increase.
In these conditions, the effects of IT failures caused by risk sources, such as the threats andvulnerabilities lurking in cyberspace, also increase, and if and IT failure did occur, it could
make provision of CII services difficult.
For this reason, it is necessary for CII operators to carry out not only comprehensive
management of risks deriving from risk sources related to information security but also just thesymptomatic measures for IT failures, aimed at achieving business goals.
In order to focus on risk management methods at CII operators, the "common threat
analysis" and "development of risk communication" (one of the policy of "response toenvironmental change") in the Second Action Plan are more comprehensively considered andactivities related to risk management carried out by each CII operator are newly implemented.

4.1 Basic view of risk management
Risk management should be independently implemented by each CII operator. However, incircumstances where each stakeholder does not have common risk management views or terms
for information sharing and discussion, there is a possibility that the activities in this Basic
Policy will not be effectively utilized in the risk management of each CII operator.
For this reason, it is preferable for each stakeholder to utilize the internationally standard
views of management and related terminology definitions for information security etc. in theterm of this Basic Policy.
13

In detail, the Cabinet Secretariat, as far as possible, utilizes views based on the framework
noted in Table 3 below and the terminology definitions used in the framework in the activities
implemented by the Cabinet Secretariat and in related materials.

13

Refer to JIS Q 31000:2010 and "Risk Management - Principles and Inventories for Risk Management / Risk Assessment methods
and tools" released by ENISA (European Union Agency for Network and Information Security).

25

III. POLICIES FOR CIIP
4. RISK MANAGEMENT

Table 3. Risk management process (example)
Risk management
Establishing the context of organization
Risk assessment
Risk identification
Risk analysis
Risk assessment
Risk treatment
Risk acceptance
Risk communication and consultation
Monitoring and review

In addition, it is expected that CII operators will utilize the guidebooks
Cabinet Secretariat in their own organization's risk management.

14

created by the

However, this activity does not require each stakeholder to conform with international
standards, but rather is aimed at contributing to an increase in the level of information security
and more optimized risk management already being implemented at CII operators by referringto the views and terminology definitions applied by the Cabinet Secretariat.

4.2 Support for risk management
Risk management is generally optimized by each CII operator individually to suit theirorganization. On the other hand, in risk assessment

15

and risk communication and16

consultation , there are some activities which cannot be handled easily by only CII operator,
such as cross-sectoral study/analysis and opinion exchanges.
For this reason, the Cabinet Secretariat carries out cross-sectoral activities as follows, andsupports risk management implemented at CII operators by sharing the results of cross-sectoral
studies/ analyses and providing opportunities for cross-sectoral opinion exchanges.
4.2.1

Risk assessment

The Cabinet Secretariat analyzes conditions and trends of major facilities and technologies
in regard to changes in the environments surrounding CII sectors, as well as risk sources
inherent to major facilities and technologies and new risks derived from the risk sources(hereinafter referred to collectively as "new risk sources and risks").
In addition, the Cabinet Secretariat analyzes the influence of effects of IT outages.
In detail, the following activities are carried out, also taking into account viewpoints of the14

In "5.3.3 5.3.3 Preparation of guidance to apply international standards", it is specified that guidebooks, etc. which interpret
international standards, shall be prepared as necessary.
15
According to JIS Q 31000:2010, this is defined as "overall process of risk identification, risk analysis and risk evaluation".
16
Refer to "4.2.2 Risk communication and consultation" for definition.

26

III. POLICIES FOR CIIP
4. RISK MANAGEMENT

efficiency of each study/analysis and mutual reflection with other policies, and the results ofthe studies/analyses are provided to CII operators.
(1) Environmental change studies
In the environmental change studies implemented in the Second Action Plan, it turned outthat the adoption ratios of cloud, smartphone/tablet device and remote maintenance were high17

and the adoption of BYOD and big data would increase going forward in CII sectors.
In this Basic Plan, based on these changes, the Cabinet Secretariat carries out environmental
change studies including analysis of new risk sources and risks as well as condition surveys for
new technologies and systems which are expected to introduce to CII sectors into mid to longterm, such as M2M and smart communities. In addition, the Cabinet Secretariat carries out thisstudy across years, because these changes will be appeared over time. With regard to thesestudies, new risk sources and risks which could have a major effect, even if they are common
across specific sectors (ex. Control systems, accounting systems and information systems) will
also be targeted.
In the event new risk sources and risks are identified through these studies, or in the event
new CII sectors are added, detailed investigation and analysis of commonality across these
sectors shall be carried out as necessary.
(2) Interdependency analysis
As utilization of IT continues to develop in each CII sectors and interdependent relationships
between sectors continue to grow, the understanding of interdependency in CII sectors
becomes more important for effective recovery measures in the event of an IT outage.
For this reason, in this Basic Policy, the Cabinet Secretariat carries out interdependency
analysis, including restudy or reanalysis based on the results from the First Action Plan and theSecond Action Plan in the event of changes in interdependency due to environmental changes
or addition of new CII sectors.
In addition, as the degree of IT dependency in CII sectors is closely related tointerdependency analysis, IT dependency studies as detailed studies of interdependency
analysis shall also be periodically implemented.
In the event new CII sectors are added, IT dependency studies will also be carried out as apart of interdependency analysis.
4.2.2

Risk communication and consultation

Risk communication and consultation is defined as "continual and iterative processes thatan organization conducts to provide, share or obtain information and to engage in dialogue

17

Bring Your Own Device. A situation where, in a business or other setting, employees access company information, using theirpersonal information devices to view, edit and otherwise manipulate the required information for work.

27

III. POLICIES FOR CIIP
4. RISK MANAGEMENT

with stakeholders regarding the management of risk".

18

The Cabinet Secretariat supports risk communication and consultation implemented bystakeholders related to CII protection for the purposes of contributing to the development ofcross-sectoral information and opinions exchanges among them.
In detail, the CEPTOAR council and cross-sectoral exercises are utilized to provide
opportunities for information and opinion exchange maintaining cooperation with eachstakeholder.
This activity also promotes the collection of information necessary for the study/analysis in
this policy.

4.3 Establishing a process of synergizing the relevant policies
The Cabinet Secretariat shall provide the results of studies and analysis in this policy as basic
data for other policies for the purpose of contributing to the other policies in this Basic Policy.
In addition, new risk sources and risk required cross-sectoral measures appeared from resultsof the implementation of other policies are subject to the studies/analyses of this policy.

18

Refer to JIS Q 31000:2010.

28

III. POLICIES FOR CIIP
5. ENHANCEMENT OF THE BASIS FOR CIIP

5. ENHANCEMENT OF THE BASIS FOR CIIP
As the social and technological environments etc. surrounding CII continue to constantly
change, as shown in Figure 1, it is necessary to enhance common foundation activities which
support the entire Basic Policy, for maintenance of the effectiveness of measures for CIIP. The
activities include establishment of basic plan, human resource development/assignment,
external explanations of measures for CIIP and identification of issues for risk sources resulting
from IT related environmental change.
Therefore, during the term of this Basic Policy, the Cabinet Secretariat prepares guides oninternational standards, etc. related information security and relevant regulations related to CIIP
in order to allow stakeholders to reference suitable, related regulations, etc. as necessary, in
addition to continuing the cooperation with other stakeholders, public relations activities andinternational cooperation from Second Basic Policy.
The Cabinet Secretariat also provides the knowledge obtained through the implementation ofthis policy for application in other policies for the purpose of contributing to the other policies
in this Basic Policy.

5.1 Public relations activities
In order to minimize the effects of IT outages to the smallest degree possible, it is important
to not only raise the standard of measures for CIIP implemented by CII operators, but also toensure that the people are able to calmly respond to such outages based information on thesituation.
Therefore, each stakeholder attends to continue to provide explanations to the people
through the publicity of the activities based on this Basic Policy, in order to contribute to a calm
response from the people.
In order to raise the level of measures for CIIP implemented by CII operators, it is important
to obtain a wide range of cooperation and support for the initiatives based on this Basic Policy.
The Cabinet Secretariat continues to carry out public relations activities through publicity
through websites and newsletters, lectures and other means. When doing these activities, thepublicity should be structured so as to achieve awareness and understanding of the initiatives ofthis Basic Policy.

5.2 International cooperation
In cyberspace, risks have been growing in borderless domain, it is required to further
respond to these global risks which have no national boundary, and it becomes necessary to29

III. POLICIES FOR CIIP
5. ENHANCEMENT OF THE BASIS FOR CIIP

positively contribute to capacity building so that our country would improve the level ofinternational measures for CIIP as well as ourself.
Therefore, the Cabinet Secretariat cooperates with responsible ministries for CIIP and theCIIP supporting agencies and continue to enhance international cooperation through active
utilization of bilateral, inter-regional and multilateral frameworks such as those with the US
and Europe, ASEAN and Meridian. When doing these activities, it actively provides caseexamples, best practices and other items obtained through international cooperation todomestic stakeholders.
In addition, diversified and multilateral international cooperation is also expected at CII
operators as a result of the deployment of initiatives related to measures for CIIP being
deployed to other companies in the same industry overseas, identification of overseas trends,
etc.

5.3 Maintenance of reference of standards and guides
To maintain the effectiveness of measures for CIIP, it is important that stakeholders are able
to reference relevant documents and regulations where necessary when examining means to doso. The initiatives of the Cabinet Secretariat related to the preparation of these regulations etc.
are as follows.
5.3.1

Issuance of the reference book for CIIP

The Cabinet Secretariat compiles relevant documents including the Cybersecurity Strategy
and this Basic Policy for common reference by stakeholders, and issue the compiled
documents as the "Collection of regulations related to measures for CIIP" for the purpose ofequalizing the knowledge base of stakeholders involved in CIIP.
5.3.2

Systematic arrangement of relevant standards and guides

For related regulations for CIIP, the Cabinet Secretariat, with the cooperation of the otherstakeholders, arranges domestic and overseas related regulations and clearly states the results inorder to refer appropriate version when necessary.
5.3.3

Preparation of guidance to apply international standards

As the social and technological environments etc. surrounding CII continue to constantly
change, in order to quickly and flexibly respond to these changes, it may be effective in casethat the stakeholders utilize appropriate relevant regulations identified from the resultscompiled from "5.3.2 Systematic arrangement of relevant standards and guides", particularly
the international standards, etc.
However, when attempting to utilize the international standards, etc. which set out general30III. POLICIES FOR CIIP
5. ENHANCEMENT OF THE BASIS FOR CIIP

principles based on the above compiled results, reinterpretation may be necessary for items thatwould not be able to directly apply to.
The Cabinet Secretariat, with the cooperation of other stakeholders, compiles guides asnecessary in order to allow for the relevant international standards etc. to be applied to fast andflexible response.
In keeping with the fact that international guidebooks, etc. related to CIIP do not currently
exist, the Cabinet Secretariat considers proposal of the guidebooks, etc. compiled as part of thispolicy to the various countries of ASEAN and for ISO and other international standards as ameans of global contribution.
5.3.4

Promotion of assessment and certification system for CIIP
19

The Cabinet Secretariat, with the cooperation of other stakeholders, support the expansionof third party certification systems for control equipment and systems regarding thecircumstances of the adoption of assessment and certification which conforms withinternational standards related to control equipment and systems under further consideration.

19

Implemented with cooperation from the Technological Research Association Control System Security Center (CSSC) whichworks on the adoption of third party certification systems for control equipment and systems.

31

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
1. ACTIVITIES BY CABINET SECRETARIAT

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
The information security policy groups indicated in this Basic Policy are supported byindependent measures which it is preferable for CII operators to handle, and policies which it ispreferable for government organizations etc., centering on the Cabinet Secretariat, to implement.
It is expected that stakeholders will each promote measures for CIIP using the following as abasis.
1. ACTIVITIES BY CABINET SECRETARIAT(1) Maintenance and promotion of the safety principlesa) During the first fiscal year of this Basic Policy and as necessary thereafter, implement
studies related to the amendment of the Guidelines for safety principles afterstrengthening links to other policies and officially release the results.
b) As necessary, implement studies related to the changes in social trends and newly
obtained knowledge after strengthening links to other policies and officially release theresults.
c) Support the continued improvement of the CII sector safety principles through a) and b)
above.
d) Continue to obtain the cooperation of the responsible ministries for CIIP, implement
studies every year to determine the conditions of the continued improvement of thesafety principles in each CII sector and officially release the results.
e) Continue to obtain the cooperation of the responsible ministries for CIIP, implement
studies every year on the conditions of the promotion of the safety principles andofficially release the results.
(2) Enhancement of information sharing systema) Increase promotion and revise when necessary through operation of the information
sharing system during normal times and during IT crises.
b) Collect information to be provided to CII operators and share information from NISC inan appropriate and timely manner.
c) Continue to obtain the cooperation of the responsible ministries for CIIP, periodically
implement studies, hearings, etc. in order to determine the conditions, etc. of each
CEPTOAR's functions and activities.
d) Introduce advanced CEPTOAR functions and activities.
e) Continue cooperating with CEPTOAR participating in the CEPTOAR council andimplement support for management and activities.
f) Prepare environments required for enhancement of CEPTOAR council activities, and32

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
1. ACTIVITIES BY CABINET SECRETARIAT

accumulate and share know-how.
g) Build individual cooperation with cyberspace-related operators as necessary, andimplement appropriate and timely information sharing from NISC during IT outages.
(3) Enhancement of incident response capabilitya) Determine other ministries' IT outage handling exercises and training information,
investigate cooperation conditions.
b) Continue to obtain the cooperation of the responsible ministries for CIIP, periodicallyand when requested by CEPTOARs, provide opportunities for verification (CEPTOAR
training) of CEPTOAR information communication functions.
c) Plan cross-sectoral exercises scenarios, implementation methods and verification issues,
etc. and implement cross-sectoral exercises.
d) Study measures for improving cross-sectoral exercises.
e) Utilize the opportunities for cross-sectoral exercises, determine the conditions of risk
analysis results verification, early recovery procedures implemented by CII operators
during IT outages, and IT-BCP etc. studies, and provide the results to exercise
participants, etc.
f) Collect, accumulate and provide knowledge related to cross-sectoral exercise
implementation methods, etc.
g) Diffuse and spread knowledge related to CII protection gained from cross-sectoral
exercises.
(4) Risk managementa) Cultivate a shared awareness among stakeholders by presenting guidebooks whichinterpret international standards, definition usage and standard views for risk
management.
b) Support risk management at CII operators through the study and analysis of this policy.
c) Provide the results of the studies and analysis in this policy as basic data to be reflectedin the safety principles.
d) Support the risk communication and consultation of CII operators through CEPTOAR
council and cross-sectoral exercises.
(5) Enhancement of the basis for CIIPa) Carry out public relations activities through publicity through websites and newsletters.
b) Implement public relations activities through lectures, etc.
c) Enhance international cooperation through active utilization of bilateral, inter-regionaland multilateral frameworks.

33

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
2. ACTIVITIES BY RESPONSIBLE MINISTRIES FOR CIIPd) Actively provide case examples, best practices and other items acquired throughinternational cooperation with domestic stakeholders.
e) Compile relevant documents for common reference by stakeholders, and issue acollection of regulations for the purpose of equalizing the knowledge base of
stakeholders involved in CII protection.
f) Arrange and visualize related regulations.
g) Compile guidebooks as necessary in order to allow for international standards etc. to be
applied to fast and flexible response.
h) Support the expansion of third party certification systems for control equipment andsystems.

2. ACTIVITIES BY RESPONSIBLE MINISTRIES FOR CIIP
(1) Maintenance and promotion of the safety principlesa) Provide information, etc. related to the safety principles which can be newly positioned
as the Guidelines for safety principles to the Cabinet Secretariat.
b) When the organization determining the safety principles, in addition to implementing
periodic analysis and verification of the safety principles, amend the safety principles asnecessary.
c) When not the organization determining the safety principles, support the analysis andverification of the safety principles for each CII sector.
d) Carry out promotion of safety standards for CII operators including environmental
arrangement for packaging measures.
e) Cooperate with building an understanding of the conditions of the safety principles
implemented by the Cabinet Secretariat every year.
f) Cooperate with studies of the conditions of the promotion safety principles implemented
by the Cabinet Secretariat every year.
(2) Enhancement of information sharing systema) Continue to cooperate with the Cabinet Secretariat and operate the information sharing
system.
b) Maintain a close information sharing system with CII operators.
c) Carry out information sharing to the Cabinet Secretariat of reports related to IT outages
received from CII operators.
d) Cooperate with studies and hearings implemented by the Cabinet Secretariat for
determining the conditions of activities and functions of each.

34

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
2. ACTIVITIES BY RESPONSIBLE MINISTRIES FOR CIIPe) Support the development of CEPTOAR functions.
f) Support the CEPTOAR council.
g) Implement opinion exchanges, etc. when requested by the CEPTOAR council.
(3) Enhancement of incident response capabilitya) Cooperate when the Cabinet Secretariat provides opportunities for verification(CEPTOAR training) of information communications functions.
b) Cooperate with planning of cross-sectoral exercises scenarios, implementation methods
and verification issues, etc. and implementation of cross-sectoral exercises.
c) Participate in cross-sectoral exercises.
d) Support participation in CEPTOAR and CII operator cross-sectoral exercises.
e) Cooperate with study of measures for improving cross-sectoral exercises.
f) As necessary, utilize results of cross-sectoral exercises in policies.
g) Cooperate with mutual collaboration between exercises and training which contributes
to CII protection implemented by the responsible ministries for CIIP and cross-sectoral
exercises.
(4) Risk managementa) Provide to the Cabinet Secretariat information related to the application required forstudy and analysis in this policy or information needed for the relevant study andanalysis.
b) Apply to the studies and analysis policies in this policy.
c) Support the risk communication and consultation of CII operators.
(5) Enhancement of the basis for CIIPa) Cooperate with the Cabinet Secretariat and enhance international cooperation throughactive utilization of bilateral, inter-regional and multilateral frameworks.
b) Cooperate with the Cabinet Secretariat and actively provide case examples, bestpractices and other items acquired through international cooperation with domestic
stakeholders.
c) Cooperate with the Cabinet Secretariat and arrange and visualize related regulations.
d) Cooperate with the Cabinet Secretariat and compile guidebooks as necessary in order toallow for international standards etc. to be applied to fast and flexible response.
e) Cooperate with the Cabinet Secretariat and support the expansion of third party
certification systems for control equipment and systems.

35

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
3. ACTIVITIES BY INFORMATION SECURITY RELATED MINISTRIES

3. ACTIVITIES BY INFORMATION SECURITY RELATED MINISTRIES(1) Enhancement of information sharing systema) Continue to cooperate with the Cabinet Secretariat and operate the information sharing
system.
b) Collect information, etc. related to attack methods and recovery methods and carry out
information sharing to the Cabinet Secretariat.
c) Implement opinion exchanges, etc. when requested by the CEPTOAR council.

4. ACTIVITIES BY CRISIS MANAGEMENT MINISTRIES(1) Enhancement of information sharing systema) Continue to cooperate with the Cabinet Secretariat and operate the information sharing
system during IT crises.
b) Collect disaster information, terrorism related information, etc.
c) Carry out information sharing to the Cabinet Secretariat as necessary.
d) Implement opinion exchanges, etc. when requested by the CEPTOAR council.
(2) Enhancement of incident response capabilitya) Implement support measures for improving IT outage response capability whenrequested by CII operators.

5. VOLUNTARY ACTIVITIES BY CII OPERATORS(1) Maintenance and promotion of the safety principlesa) When the organization determining the safety principles, in addition to implementing
periodic analysis and verification of the safety principles, amend the safety principles asnecessary.
b) When the organization determining the safety principles, cooperate with building an
understanding of the conditions of the safety principles implemented by the Cabinet
Secretariat every year.
c) Study environmental arrangement for packaging measures and implementing measures
for CIIP based on the safety principles.
d) Identify issues from operation of measures for CIIP, internal and external audits,
environmental change studies/analysis results related to IT, exercises/training andresponse to IT outages, and continually amend safety principles through risk assessment.

36

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
5. VOLUNTARY ACTIVITIES BY CII OPERATORSe) Cooperate with studies of the conditions of the promotion safety principles implemented
by the Cabinet Secretariat every year.
(2) Enhancement of information sharing systema) Continue to cooperate with the CEPTOAR council, CEPTOARs and the responsible
ministries for CIIP, and operate the information sharing system.
b) Carry out information sharing to the NISC as necessary during IT outages.
c) Collect information, etc. related to attack methods and recovery methods.
d) Carry out supplemental information sharing based on consensus with the CIIP
supporting agencies.
e) Implement activities in the CEPTOAR council.
(3) Enhancement of incident response capabilitya) Utilize, etc. verification (CEPTOAR training) etc. information communication functions
provided by the Cabinet Secretariat and enhance own information sharing system.
b) Cooperate with planning of cross-sectoral exercises scenarios, implementation methods
and verification issues, etc. and implementation of cross-sectoral exercises.
c) Participate in cross-sectoral exercises.
d) Cooperate with study of measures for improving cross-sectoral exercises.
e) Utilize the results of cross-sectoral exercises for early recovery method and IT-BCP etc.
initiatives as necessary in the event of own IT outages.
(4) Risk managementa) Promote and enhance risk management in own organization.
b) Utilize the basic information provides as the results of the study and analysis of thispolicy in own organization's risk assessment.
c) Develop risk communication and consultation between stakeholders directly involved inmeasures for CIIP.
d) Propose environmental changes and risk sources which are difficult to analyze oneself
but for which there is a value for conducting study and analysis as targets for the study
and analysis of this policy.
e) Participate in the discussion and examination of the study and analysis of this policy.
(5) Enhancement of the basis for CIIPa) Promote diverse and multilateral international cooperation through the deployment ofinitiatives related to measures for CIIP being deployed to other companies in the same
industry overseas, determination of overseas trends, etc.
b) Cooperate with the Cabinet Secretariat and arrange and visualize related regulations.

37

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
6. VOLUNTARY ACTIVITIES BY CEPTOARc) Cooperate with the Cabinet Secretariat and compile guidebooks as necessary in order toallow for international standards etc. to be applied to fast and flexible response.
d) Cooperate with the Cabinet Secretariat and support the expansion of third party
certification systems for control equipment and systems.

6. VOLUNTARY ACTIVITIES BY CEPTOAR(1) Enhancement of information sharing systema) Continue to cooperate with the CEPTOAR council, CII operators and the responsible
ministries for CIIP, and operate the information sharing system.
b) Carry out information sharing from NISC to CII operators in accordance with theinformation handling rules for information provided from the Cabinet Secretariat.
c) Carry out supplemental information sharing based on consensus with the CIIP
supporting agencies.
d) Enhance and develop CEPTOAR functions.
e) Cooperate with studies and hearings implemented by the Cabinet Secretariat for
determining the conditions of activities and functions of each.
f) Participate in the CEPTOAR council.
(2) Enhancement of incident response capabilitya) Carry out periodic verification of information communication functions.
b) Support participation and development of results in CII operator cross-sectoral exercises.
c) Participate in cross-sectoral exercises.
(3) Risk managementa) Support independent initiative for the CII operators which make up own CEPTOAR.

7. VOLUNTARY ACTIVITIES BY THE CEPTOAR COUNCIL(1) Enhancement of information sharing systema) Continue to cooperate with each CEPTOAR and operate the information sharing system.
b) Carry out arrangement of information to be shared and sharing methods.
c) Promote cross-sectoral information sharing through sharing of specific examples ofmutual understanding and best practice.
d) In order to strengthen cooperative relationships with stakeholders, hold opinion
exchanges to promote sharing of the situational awareness of both parties based on

38

IV. ACTIVITIES TO BE TAKEN BY STAKEHOLDERS
8. VOLUNTARY ACTIVITIES BY CIIP SUPPORTING AGENCIES

requests from government organizations or based on own proposals.
(2) Enhancement of incident response capabilitya) Participate in cross-sectoral exercises as necessary.

8. VOLUNTARY ACTIVITIES BY CIIP SUPPORTING AGENCIES(1) Enhancement of information sharing systema) Continue to cooperate with the Cabinet Secretariat and operate the information sharing
system.
b) Collect information, etc. related to attack methods and recovery methods and carry out
information sharing to the Cabinet Secretariat.
c) Carry out supplemental information sharing based on consensus with the CII operators
carrying out the information sharing or the CEPTOAR.
d) Cooperate with the examination of enhancement of analysis functions implemented by
the Cabinet Secretariat.
e) Implement opinion exchanges, etc. when requested by the CEPTOAR council etc.
(2) Enhancement of incident response capabilitya) Provide information, related to IT outage case examples required for cross-sectoral
exercises to the Cabinet Secretariat.
(3) Enhancement of the basis for CIIPa) Cooperate with the Cabinet Secretariat and enhance international cooperation throughactive utilization of bilateral, inter-regional and multilateral frameworks.
b) Cooperate with the Cabinet Secretariat and actively provide case examples, bestpractices and other items acquired through international cooperation with domestic
stakeholders.
9. VOLUNTARY ACTIVITIES BY CYBERSPACE-RELATED OPERATORS(1) Enhancement of information sharing systema) Cooperate with initiatives for preparing information to be subject to sharing by the
Cabinet Secretariat and the sharing methods for said information.
b) Carry out proactive information sharing to the Cabinet Secretariat as necessary during IT
crises.

39

V. ASSESSMENT, VERIFICATION AND REVISION
1. GOALS TO BE ACHIEVED DURING THE TERM OF THIS BASIC POLICY

V. ASSESSMENT, VERIFICATION AND REVISION
For assessment of this Basic Policy, verification of results during the term of the Basic Policy iscarried out from 2 viewpoints consisting of verification of the progress each fiscal year from a"view of measuring output", which looks at what kind of output each initiative has generated, andverification of results during the term of the Basic Policy from a "view of measuring outcomes",
which looks at what degree society has actually moved closer to the ideal future image as a resultof the initiatives of this Basic Policy. During this, use objective indexes as much as possible forprogress verification and for verification of results carry out comparison with the goals of thisBasic Policy which are the ideal future image.
In addition, the "verification" in this Basic Policy, shall refer to the use of indexes toobjectively verify actual conditions related to progress of each of the initiatives.
1. GOALS TO BE ACHIEVED DURING THE TERM OF THIS BASIC POLICY
The future images that can be expected to be realized through the initiatives based on thisBasic Policy are as follows.
* The independent initiatives of each stakeholder based on the stakeholder's own awarenessprevail in the codes of conduct of each stakeholder and the resulting behavioral patterns
form a culture of information security.
* Communication for enhancing measures for preventing IT outages is carried out between
stakeholders on a daily basis, and continual improvements are carried so that experience
gained in the event of an IT outage can be reliably utilized in future measures.
* The CII protection initiatives cooperatively carried out by stakeholders are widely known
to the public providing a sense of security. In addition, there is substantial communication
between a wide variety of stakeholders allowing for calm coping in the event of an IT
outage.
* These types of initiatives are officially released as a Basic Policy which undergoes periodic
assessment and is appropriately revised as necessary.
* Each of the stakeholder initiatives is reliably established as an item which supports
continued development of society.
Hereafter, detailed future images are described.

1.1 For all stakeholders
Detailed future images common to all stakeholders are as follows.
* The stakeholder possesses an accurate awareness of its own conditions and independently
establishes its own activity goals.

40

V. ASSESSMENT, VERIFICATION AND REVISION
1. GOALS TO BE ACHIEVED DURING THE TERM OF THIS BASIC POLICY* All required initiatives are progressing and periodic verification is carried out on the
progress of the stakeholder's own measures and policies. The stakeholder is also able tomaintain an understanding of the activity conditions of and proactively cooperate withother stakeholders.
* In response during IT outages, it is understood who should be collecting what kinds ofinformation, who should be sharing what kinds of information and what the stakeholder
themselves should be doing in accordance with the scale of the IT outage.
* In addition to being able to carry out independent response, the stakeholder is able tocooperate with other stakeholders when necessary to carry out controlled response.

1.2 For CII operators
Detailed future images for CII operators are as follows.
* There is sufficient saturation of the following items related to "information security
governance".
- Measures for CIIP are examined not just from information system construction andoperation perspectives, but also from a business management perspective.
- A system exists which allows for the appropriate involvement of each of the parties
responsible for system construction and operation and business management.
- There is an understanding of the measures to be implemented based on the CII
services which require protection and service maintenance level.
- Efforts are made to carry out external explanations of measures for CIIP.
- A sense of values is cultivated in which carrying out information sharing to thegreatest degree possible in order to improve the standard of measures for CIIP isviewed positively.
- There is an awareness that the occurrence of IT outages is not something to be hidden
but should instead be shared with stakeholders involved in measures at CII operators.
* There is sufficient saturation of the following items related to "issue identification", "riskassessment" and "improvement of measures".
- Based on this Basic Policy, stakeholders cooperate to carry out measures for CIIP
related to CII protection and are aware of remaining risks in their own measures andthe extent of those risks.
- Risk changes related to risk sources and IT outages resulting from developments ofvarious measures and environmental changes are suitably detected, measures are
independently advanced for each and necessary adjustment is carried out.
- Appropriate measures are able to be enacted even in the event of an IT outage and as aresult the risk of the IT outage having a serious effect on the public welfare and41

V. ASSESSMENT, VERIFICATION AND REVISION
1. GOALS TO BE ACHIEVED DURING THE TERM OF THIS BASIC POLICY

socioeconomic activities is minimized to the greatest degree possible.
- These initiatives server as one driving force for the continued improvement of themeasures.
* There is sufficient saturation of the following items related to "information sharing".
- There is an understanding of IT outage conditions, relevant information is sharedexternally through each sector's CEPTOAR and CEPTOAR council as necessary,and official or unofficial cooperation is carried out.

1.3 For Cabinet Secretariat
Detailed future images for the Cabinet Secretariat are as follows.
* Works as a comprehensive coordination function for advancing more effective measures.
Diverse information which contributes to measures for CIIP is able to be collected throughthe policy groups of this Basic Policy and cooperation is carried out with stakeholders
based on the relevant information.
* Has obtained an understanding of risks related to serious risk sources and IT outages inparticular, and quickly implements organic cooperation and coordination aimed atstudying and realizing resolutions in the event the management of such is difficult for CII
operators alone.

42

V. ASSESSMENT, VERIFICATION AND REVISION
2. CONTINUAL IMPROVEMENT BASED ON ASSESSMENT AND VERIFICATION DURING EACH FISCAL YEAR

2. CONTINUALIMPROVEMENT

BASED

ON

ASSESSMENTAND

VERIFICATION DURING EACH FISCAL YEAR
In order to steadily advance the initiatives based on this Basic Policy and carry out continual
improvement, confirmation and verification shall be carried out on the progress of the Basic
Policy. In continual improvement, each stakeholder shares the experiences they gain throughtheir initiatives with the stakeholders as a whole, and focus is on utilizing these experiences toreciprocally improve each other's initiatives. IT outages should be avoided, however it isimportant to recognize that experience protecting against IT outages and experience limiting
the scope of the effects in the event of an IT outage serve as provisions for the future.
While obvious, the party for which the IT outage occurs must bear responsibility for anddetermine the cause of the IT outage and strive to improve their own initiatives. However, in
the assessment and verification of this Basic Policy, the principal focus is not placed on
assigning responsibility and investigating causes, but rather on identifying lessons that can beused to improve future initiatives, and utilizing these to improve the initiatives of all
stakeholders.

43

V. ASSESSMENT, VERIFICATION AND REVISION
3. METHODOLOGY FOR ASSESSMENT AND VERIFICATION DURING EACH FISCAL YEAR

3. METHODOLOGY FOR ASSESSMENT AND VERIFICATION DURING
EACH FISCAL YEAR
The confirmation and verification carried out each fiscal year from "view of measuring
output" is carried out with a focus on the policy groups for individual measures for CIIP inaccordance with this Basic Policy. Because all of the measures for CIIP policy groups based on
this Basic Policy are all multilayered among multiple stakeholders, a wide variety of items canbe imagined as indexes for use in verification, however broad categorizations will be set ofindexes used for comprehensive confirmation and verification of measures by CII operatorsand indexes used for confirmation and verification of policies by government organizations.
For the indexes for each measure for CIIP policy group, it is important to appropriatelyinterpret the meaning of the values rather than to be overly-focused on the quantity or any
fluctuations.
The confirmation and verification carried out each fiscal year from "view of measuring
output" is carried out with a focus on the policy groups for individual measures for CIIP inaccordance with this Basic Policy. Because all of the measures for CIIP policy groups based on
this Basic Policy are all multilayered among multiple stakeholders, a wide variety of items canbe imagined as indexes for use in verification, however broad categorizations will be set ofindexes used for comprehensive confirmation and verification of measures by CII operatorsand indexes used for confirmation and verification of policies by government organizations.
For the indexes for each measure for CIIP policy group, it is important to appropriatelyinterpret the meaning of the values rather than to be overly-focused on the quantity or any
fluctuations.
In addition, confirmation and verification of own measures by individual CII operators shallbe considered an independent process, and in general it is preferable for the CII operator tocarry out implementation every fiscal year.

3.1 Indexes for the assessment and verification of activities by CII operators
As the party with the most fundamental responsibility for the stable provision of CII services,
CII operators must deal with measures for CIIP on a daily basis. In order to continually andsteadily improve this initiatives and in order to make the support provided by the government
for the initiatives of the CII operators more effective, it is important to objectively verify the theoutcomes of the measures for CIIP.
The comprehensive confirmation and verification of the measures is the confirmation andverification of the conditions of the occurrence of IT outages for each CII sector based on the"preventing serious effects on the public welfare and socioeconomic activities due to IT

44

V. ASSESSMENT, VERIFICATION AND REVISION
3. METHODOLOGY FOR ASSESSMENT AND VERIFICATION DURING EACH FISCAL YEAR

outages" which is the goal of this Basic Policy. The applicable CII services and service
maintenance levels are as shown in "ANNEX 2. CII SERVICES AND SERVICE
MAINTENANCE LEVELS". Detailed indexes are figures from all IT outage case sectors
recognized by the Cabinet Secretariat.
The measures of individual CII operators include independent measures based on the
management decisions of each, and it is therefore inadequate to assess measures throughcomparison with IT outage conditions for each CII operator or each sector. For this reason, it isreasonable that assessment of measures should be carried out through self-assessment by the
CII operators, and that each CII operator should work towards their own improvement. In
addition, if possible, it is preferable that the conditions of the implementation of theself-assessment be made clear.

3.2 Indexes for the assessment and verification of activities by governmentorganizations
The policies of this Basic Policy are as shown in "III. POLICIES FOR CIIP", however these
are all items for which government support is carried out to improve the effectiveness ofmeasures for CIIP by CII operators. During the term of this Basic Policy, the method forverifying the effectiveness of each policy was revised while continuing to follow the indexes
used in the Second Basic Policy.
The confirmation and verification of policies is the verification of the contribution to themeasures for CIIP of CII operators for each measures for CIIP policy, and the detailed indexes
are as follows.
3.2.1

Maintenance and promotion of the safety principles

The outcomes expected from "maintenance and promotion of the safety principles" are thestakeholders being involved in measures for CIIP understanding the measures which they are
required to implement themselves and the further development of index and safety principle
items and the reliable practical application of the items for the purpose of having the required
initiatives carried out under periodic self-assessment. For this reason, indexes are set which
focus on the development of the indexes and safety principle items and the reliable
implementation of initiatives based on the safety principles of the CII operators.
<Detailed indexes>* Number of measure items recorded in the index* The ratio of CII operators carrying out periodic self-assessment based on the safety
principles, etc. determined through studies on the promotion of the safety principles* Opinions and requests from CII operators on indexes

45

V. ASSESSMENT, VERIFICATION AND REVISION
3. METHODOLOGY FOR ASSESSMENT AND VERIFICATION DURING EACH FISCAL YEAR

3.2.2

Enhancement of information sharing system

The outcomes expected from "enhancement of information sharing system" are the ability toreceive the information required by CII operators through complete enhancement of the
independent activities of each CEPTOAR and CEPTOAR council in addition to information
sharing based on the latest information sharing system as well as information sharing to andfrom NISC. For this reason, indexes are set which focus on the development of information
shared with the prepared information sharing system.
<Detailed indexes>* Number of cases of information sharing to and from NISC by the Cabinet Secretariat* Number of occasions of information exchanges by CEPTOAR council and cross-sectoral
exercise stakeholders* Number of cases of information sharing in the CEPTOAR council
3.2.3

Enhancement of incident response capability

The outcomes expected from "enhancement of incident response capability" arecontributions to the improvement of management capability technical aspects and verificationof the validity of information sharing to and from NISC between stakeholders required forverification of CII operator implemented early recovery procedures during IT outages and
IT-BCP through participation in exercises and training centering on cross-sectoral exercises.
For this reason, indexes are set which focus on the contribution to CII operator initiatives ofknowledge gained through participation in exercises and training in addition to the promotionof exercise results, construction of realistic exercise environments and cross-sectoral exercises.
<Detailed indexes>* Number of participants in cross-sectoral exercises* Ratio of participants who assess the information obtained through exercises as having
contributed to the measures for CIIP of the organization to which they belong* Participation in exercises and training implemented both inside and outside theorganization, including cross-sectoral exercises
3.2.4

Risk management

The outcomes expected from "risk management" are the promotion and enhancement of risk
management implemented by CII operators. For this reason, indexes are set which focus on
consultation as well as risk assessment and risk communication supported by the Cabinet
Secretariat from among the risk management processes implemented by CII operators.
<Detailed indexes>* Number of cases of interdependency analysis and environmental change studies
implemented by the Cabinet Secretariat* Number of occasions of provision of opportunities for information exchange by46

V. ASSESSMENT, VERIFICATION AND REVISION
3. METHODOLOGY FOR ASSESSMENT AND VERIFICATION DURING EACH FISCAL YEAR

CEPTOAR council and cross-sectoral exercise stakeholders
3.2.5

Enhancement of the basis for CIIP

The outcomes expected from "enhancement of the basis for CIIP" are: for "public relations
activities", obtaining the greatest degree of understanding from the public in relation to theframework of the Basic Policy and expanding the scope of those cooperating with this Basic
Policy beyond just stakeholders; for "international cooperation", support and development ofopportunities for information exchanges with various countries through bilateral, inter-regionaland multilateral frameworks; and for "preparation of norms, standards and regulations, etc. forreference", the usage of the prepared regulations, etc. by CII operators. For this reason, indexes
are set which focus on the development of opportunities to publicize this Basic Policy andinternational cooperation as well as the status of the preparation of the regulations, etc.
<Detailed indexes>* Number of times information is dispatched through newsletters, etc.
* Number of times lectures, etc. related to the Basic Policy are held
* Number of times information exchanges etc. are held through bilateral, inter-regional andmultilateral frameworks* Conditions of preparation of guidebooks etc. which contribute to CII protection* Expansion conditions of third party certification systems for control equipment andsystems47

V. ASSESSMENT, VERIFICATION AND REVISION
4. RIVISION OF THE BASIC POLICY BASED ON THE ASSESSMENT OF THE OUTCOMES

4. RIVISION OF THE BASIC POLICY BASED ON THE ASSESSMENT OF
THE OUTCOMES
The assessment carried out from the "view of measuring outcomes" is carried out incomparison with the goals of this Basic Policy which are the ideal future image. During this, inconsideration that the various initiatives based on this Basic Policy are mutually related and torealize output and outcomes, assessment is not carried out for each individual initiative, butrather for overall initiatives which contribute to the maintenance and improvement ofprotective capability for CII, and so is thus carried out comprehensively and analytically for theframework of this Basic Policy.
When carrying out assessment of the framework of this Basic Policy, it is important to carryout assessment after appropriately determining the conditions which cannot be completely
determined through only the individual output and outcomes of policy groups. For this reason,in order to collect the supplementary information required for assessment, supplementarystudies shall be carried out one per fiscal year in principle.
In addition, for assessment management, as it is difficult to examine improvement measures
immediately even if changes are tracked each year, so in principle 1 time per 3 years
assessment shall be carried out by the Cybersecurity Strategic Headquarters, and the studies
and examination required shall be carried out by the CII Expert Committee throughcooperation from the responsible ministries for CIIP.
As such, for the revision of the Basic Policy based on the assessment of outcomes as well, in
principle 1 time per 3 years the assessment shall be carried out by the Cybersecurity Strategic
Headquarters, and the studies and examination required shall be carried out by the CII Expert
Committee through cooperation from the responsible ministries for CIIP.
The limitation of 1 time per 3 years shall not apply in the event of any events occurringoutside the assumptions of this Basic Policy such as serious changes in social trends.

48

ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATION SHARING FROM NISC"
1. INFORMATION RELATED TO IT FAILURES, ETC

ATTACHMENT: "INFORMATION SHARING TO NISC" AND"INFORMATION SHARING FROM NISC"
1. INFORMATION RELATED TO IT FAILURES, ETC"Information related to IT failures, etc." is an extensive variety of information which
contributes to measures for CIIP related to IT failures, including IT outages, signs and"Hiyari-Hatto".Information related to IT failures, etc. includes 3 aspects of (1) proactive
prevention of IT outages, (2) prevention of the spread damages and quick recovery from IT
outages, and (3) prevention of recurrence through analysis and verification of IT outage causes,
and must be provided suitably and appropriately to CII operators by government organizations,etc., and enhancement of a system for sharing this type of information among CII operators andinterdependent CII sectors.
The various aspects of information related to IT failures, etc. include the following.
a) Proactive prevention: Information related to causes of IT failures (including protective
measures, etc.)b) Prevention of spread, and recovery: Information which contributes to effect propagation
prediction and recovery after IT outagesc) revention of recurrence: Collaborative collection of information which contributes to
ex-post analysis as well as analysis and verification results
In addition, by signs and "Hiyari-Hatto", although the phenomenon is not actualizing, whenit actualizes, resulting in IT failure is also considered. Therefore, it is required like the IT failure
to also make an omen into the object of information sharing.
Therefore, the scope of information sharing in this basic policy is as being shown in the
figure 2.
figure 2. Scope of information sharing
CII services
IT outage

Actualization ofphenomenon

IT failures
Signs and "Hiyari-Hatto"

49

phenomenon of necessity
for information security

influence degreeof a phenomenon

Exceed the service
maintenance levels

Other services

ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATION SHARING FROM NISC"
2. INFORMATION SHARING TO NISC FROM CII OPERATORS

2. INFORMATION SHARING TO NISC FROM CII OPERATORS

2.1 In case of "information sharing to NISC"
Occasions when information sharing to NISC is necessary shall be situations where IT
failures, including IT outages, signs or Hiyari-Hatto are confirmed, situations where reportingis required by laws, etc., or situations CII operators have determined that sharing of
information is appropriate.
In the event it is uncertain whether or not the above are applicable, it is recommended thatthe responsible ministries for CIIP or Cabinet Secretariat be consulted.

2.2 Contents of "information sharing to NISC"
The details of information sharing to NISC shall be the on demand reporting of identified
events and causes at the time of the report. It is acceptable if the information at this time isfragmentary or indefinite because the complete picture has yet to be identified.
In addition, the setting of common classifications and categories for IT failures, etc. required
when information sharing to NISC is carried out from the responsible ministries for CIIP to the
Cabinet Secretariat, shall be carried out with consideration for the operability etc. of each CII
operator.

2.3 Framework for "information sharing to NISC"
The procedures for sharing of information to NISC from CII operators to the Cabinet
Secretariat through the responsible ministries for CIIP are as follows.
a) CII operators shall share information to the responsible ministries for CIIP in accordance withthe contact system illustrated in "ANNEX 5. COMMUNICATION CHANNELS UNDER ITOUTAGES".
b) The responsible ministries for CIIP liaison shall share the information received from the CII
operator of the relevant sector to the Cabinet Secretariat.
c) The Cabinet Secretariat shall appropriately manage the shared information, and handle theinformation within the information sharing scope specified by the information source.

2.4 Handling of "information sharing to NISC"
For the handling of information shared to NISC, the Cabinet Secretariat and the responsible
ministries for CIIP that received the information shall in principle, where not otherwise
specified by law or agreed to by the CII operator submitting the information, handle said
information as the information (voluntarily provided information) prescribed in Article 5 Item

50

ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATION SHARING FROM NISC"
2. INFORMATION SHARING TO NISC FROM CII OPERATORS

2 of the Act on Access to Information Held by Administrative Organs (Law 42 of 1991). In
cases where the relevant information is subject proviso in the same item, the information may
be publically disclosed.

51

ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATION SHARING FROM NISC"
3. INFORMATION SHARING FROM NISC TO CII OPERATORS

3. INFORMATION SHARING FROM NISC TO CII OPERATORS

3.1 Scope of CII operators subject to "information sharing from NISC"
The scope of provision of information to CII operators from the Cabinet Secretariat shall be
the CII sectors which the Cabinet Secretariat deems the information relevant to, from among
the information sharing scope specified by the information provider in advance. In cases where
the Cabinet Secretariat deems it is necessary to share information outside of the information
sharing scope specified by the information provider, it shall be able to coordinate the change ofthe sharing scope with the information provider.

3.2 Contents of "information sharing from NISC"
Information sharing from NISC shall be carried out for information considered to beeffective for CII operator measures for CIIP from a wide range of information which iscollected and analyzed from information provided by responsible ministries for CIIP,
information security related ministries, CIIP supporting agencies and cyberspace-related
operators.
In addition, if the information provided from the CII operators is applicable to a) or b) below,
information sharing shall be carried out after employing appropriate measures such asprocessing the information so that the providing CII operator cannot be identified in order toprevent the CII operator providing the information from suffering any disadvantage as a result.
a) If the obtained information is regarding a security hole, program bug, etc. and it is recognizedthat said information could cause problems at other CII operators.
b) If there is a cyber-attack or advance notice of such an attack, if there are predicted damages froma disaster, or when it is otherwise recognized that the information poses a risk to the criticalinformation systems of other CII operators.

3.3 Framework for "information sharing from NISC"
The procedures for sharing of information from NISC to CII operators from the Cabinet
Secretariat through the responsible ministries for CIIP are as follows.
a) When the Cabinet Secretariat shares information from NISC, such sharing shall be carried out
through liaisons to the Cabinet Secretariat for each sector under the jurisdiction of the
responsible ministries for CIIP. At this time, the individual receiving the information shall enact
appropriate identification methods for the information to allow for the information to be easily
and so that the information classification and scope of handling according to the information's
degree of importance, content, and other factors, can be recognized at a glance.
b) The responsible ministries for CIIP liaison shall convey the information to the CEPTOAR pointof contact (PoC).

52

ATTACHMENT: "INFORMATION SHARING TO NISC" AND "INFORMATION SHARING FROM NISC"
3. INFORMATION SHARING FROM NISC TO CII OPERATORSc) The CEPTOAR shall convey the information to the CII operators which make up the
CEPTOAR.
d) In particularly urgent cases, such as early warning information, etc., regardless of steps a) to c),
the Cabinet Secretariat shall directly provide the information to the CEPTOAR or individual CII
operators and report to the individual critical infrastructure operators or scepter directly from the
Cabinet Secretariat, and simultaneously report to the responsible ministries for CIIP liaison.
However, normalization of identification methods shall be carried out in accordance with step a).

3.4 Cooperation for "information sharing from NISC"
In the collection of information provided to CII operators through responsible ministries for
CIIP and in sharing of information to CII operators, the Cabinet Secretariat shall cooperate with
the information security related ministries, CIIP supporting agencies and cyberspace-related
operators as follows.
a) Collect a wide range of information provided by information security related ministries and CIIP
supporting agencies.
b) Collect additional information etc. related to IT outages from cyberspace-related operators asnecessary.
c) Request cooperation from CIIP supporting agencies and cyberspace-related operators in thecollection and analysis of information as necessary.
d) For information during IT crises, collection and sharing of information under an information
sharing system composed of the Cabinet Secretariat, crisis management ministries and thedisaster prevention related ministries in addition to information sharing system during normal
times.

3.5 Improvement of the quality of the information to be shared
Attempts will be made to improve the quality of the information provided while continuing
to take the following points into account.
a) Improve accuracy by comparing information.
b) Determine the degree of importance and priority of information according to a).
c) Impact forecasts for other CII sectors for IT outages which occur as a result of CII sector service
outage/decline and IT outages which occur as a result of risk sources common across sectors.

53

CII sectors
Information andcommunication
services
Financial services

Banking
services
Life insurance
services
Generalinsuranceservices
Securities
services

Aviation services

54
Railway services
Electric power supply
services
Gas supply services
Government andadministrative services
Medical services
Water services

Applicable CII operators (Note 1)
Applicable critical information system examples (Note 2)
Examples of IT outages and effects- Major electronic communications operators - Network systems
・Electrical communications outages- Major terrestrial base broadcast operators- Operation support systems
・Outages etc. related safe and stable provision of electrical- Major cable television operators- Organization/operation systems
communications services
・Broadcast service outages- Banks, credit unions, labor credit unions,- Accounting systems- Outages of deposit payments, fund transfers including bankagricultural cooperatives, etc.
- Financial securities systems
transfers and loans- International systems- Financial settlement agencies- Financial settlement outages- External connection systems- Electronic credit record agencies- Outages of information provision related to electronic records and- Financial institution internetwork systems- Life insurance services
fund settlements- Electronic credit record agency systems- General insurance services- Insurance claim payment outages- Insurance service systems- Securities firms- Securities trading outages- Securities trading systems- Financial product exchanges- Corporate bond/stock transfer outages- Exchange systems- Money transfer agencies- Financial product clearing outages etc.
- Money transfer systems- Financial product clearing agencies etc.
- Clearance systems etc.
- Major scheduled air transport operators- Flight systems- Flight delays and cancellations- Reservation/boarding systems- Obstacles to safe flight of airplanes, etc.
- Maintenance systems- Cargo systems- Ministry of Land, Infrastructure, Transport - Air traffic control systems
and Tourism (air traffic control/weather)- Meteorological information systems- Major railway operators including JR- Railway traffic control systems- Railway traffic delays and cancellations
companies and major private railway- Power supply control systems- Obstacles to safe railway transport, etc.
companies- Seat reservation systems- General electric power supply services,- Control systems- Power supply outages
Japan Atomic Power, Electric Power- Operation monitoring systems- Obstacles to safe operation of power plants
Development- Major gas supply operators- Plant control systems- Gas supply outages- Remote monitoring and control systems- Obstacles to safe operation of gas plants- Various ministries and government offices - Various ministry and local government information- Obstacles to government and administrative service operations- Local government
systems (handling of e-government and- Leak, theft and alteration of personnel information
e-municipalities)- Medical facilities- Medical examination record management systems, etc. - Obstacles to work in medical examination support departments(Excluding small scale facilities)(electronic patient record systems, remote diagnostic
imagining systems, electric medical equipment, etc.)- Water service operators and city water- Water utility and water supply monitoring systems- Outages of water supply
service providers- Water utility control systems, etc.
- Supply of water of unsuitable quality, etc.
(Excluding small scale facilities)

ANNEX 1. SCOPE OF CII OPERATORS AND CRITICAL INFORMATION SYSTEM EXAMPLES

ANNEX 1. SCOPE OF CII OPERATORS AND CRITICAL INFORMATION SYSTEM EXAMPLES

- Major logistics operators

Chemical industries- Major petrochemical facilities

Credit card services
Petroleum industries- Major credit card services operators etc.
- Major petroleum refinery facilities andpetroleum wholesalers- Collection and delivery management systems- Cargo tracking systems- Warehouse management systems- Plant control system- Credit card authorization system etc.
- Sales order management system- Product management system- Shipping management system etc.

- Shipping delays and cancellations- Difficulties tracking cargo location- Plant outages- Long-term suspend of long-term product supply- Outages of credit card authorization- Outages of the petroleum products supply- Obstacles to safety operation of refinery plants etc.

Note 1The operators listed here are CII operators for which measures should be implemented on a priority basis, and review of the applicable operators shall be carried out based on changes in the business environment andprogressive dependence on IT, when the Basic Policy is revised.
Note 2The details of the applicable critical information systems are stipulated by CII operators based examples of IT outages and their effects.

55

ANNEX 1. SCOPE OF CII OPERATORS AND CRITICAL INFORMATION SYSTEM EXAMPLES

Logistics services

CII sectors
Information and communication services

56
Banking services

Financial services

CII services (including procedures) (Note)
Service maintenance levels
Explanation of services (including procedures)
Name
Applicability/standards
Remarks(Relevant laws)- Electrical- Use of electrical communication facilities to- No trouble should occur causing continued loss - In accordance with Article 58 of the Ordinance forcommunication
act as an intermediary for othersof service for 2 hours or more for 30,000 or
Enforcement of the Telecommunications Business Act
services
communications and providing other electrical more users due to outages or deterioration ofcommunications facilities for thequality of service provision as a result ofcommunications of other parties (Article 2 ofelectrical communications facility trouble
the Telecommunications Business Act)- Broadcasting services - Electrical communications broadcast aimed at - No trouble should occur causing continued- In accordance with the Ordinance for Enforcement of
direct reception by the public (Article 2 of the outages of broadcasting for 15 minutes or longer the Broadcast Act from Item 1 to Item 3
Broadcast Act)
as a result of trouble with base broadcasting
facilities- No trouble should occur causing continued
outages of broadcasting for 15 minutes or longer(2 hours or more for relay station wirelessfacilities) as a result of trouble with basebroadcasting facilities and specified terrestrial
base broadcasting facilities- CATV services- Electrical communications broadcast aimed at - No trouble should occur causing continued loss - In accordance with Article 157 of the Ordinance fordirect reception by the public (Article 2 of the of service for 2 hours or more for 30,000 or
Enforcement of Broadcast Act
Broadcast Act)
more users as a result of broadcasting outages
resulting from cable television facility trouble- Deposits- Receipt of deposits or periodic deposits- No delay or outages of deposit repayment- Refer to the "Comprehensive Guideline for Supervision- Loans(Article 10, paragraph 1, item 1 of theshould occur as a result of IT failuresof Major Banks, etc."- No delay or outages of execution of loan
- Excluding situations where no practical effect occurs as- Exchange
Banking Act)
agreements should occur as a result of IT- Lending of loans or discounting of bills
a result of quick substitution by other systems/equipment
failures(for example, even if a number of ATMs were
(Article 10, paragraph 1, item 2 of the- No delay or outages of currency exchange (bank suspended, if other ATMs or windows were available at
Banking Act)
- Currency exchange (Article 10, paragraph 1,transfer) should occur as a result of IT failures
the same or neighboring branches)
item 3 of the Banking Act)
- Financial settlements- Financial settlements (Article 2, paragraph 5 - No delay or outages of financial settlements- Refer to the "Comprehensive Guideline for Supervisionof the Act concerning Financial Settlements)
should occur as a result of IT failuresof Settlement/Money Transfer Agencies"- Excluding situations where no practical effect occurs as
a result of quick substitution by other systems/equipment

ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELSANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELS

Life
insurance
GeneralinsuranceSecurities services

57

CII services (including procedures) (Note)
Service maintenance levels
Explanation of services (including procedures)
Name
Applicability/standards
Remarks(Relevant laws)- Electronic records, etc. - Electronic records (Article 56 of the- No delay or outages of information provision- Refer to "Guideline for Administrative Processes Vol 3.:
Electronically Recorded Monetary Claims
related to electronic record and fund settlement
Financial Companies (12 Electronic credit record agency
Act)should occur as a result of IT failures
relationships)"- Information provision related to fundsettlement (Articles 62 and Article 63 of theElectronically Recorded Monetary Claims
Act)- Insurance claim etc.
- Receipt of insurance claim etc. payment- No delay or outages of insurance claim etc.
- Refer to "Comprehensive Guidelines for the Supervision
payments
demands
payment should occur as a result of IT failuresof Insurance Companies"- Insurance claim etc. payment screenings- Excluding situations where no practical effect occurs as- Insurance claim etc. paymentsa result of quick substitution by other systems/equipment- Insurance claim etc.
- Accident reception- No delay or outages of insurance claim etc.
- Refer to "Comprehensive Guidelines for the Supervision
payments- Damage investigations etc.
payment should occur as a result of IT failuresof Insurance Companies"- Excluding situations where no practical effect occurs as- Insurance claim etc. paymentsa result of quick substitution by other systems/equipment- Negotiable securities- Negotiable securities trading, market- No delay or outages of disposal of securities- Refer to the "Comprehensive Guidelines for Supervision
trading etc.
derivatives trading or foreign market
received for guarantee, cancellation payments,of Financial Instruments Business Operators, etc."
etc. should occur as a result of IT failures- Transaction mediation, derivatives trading (Article 2, paragraph8,- Excluding situations where no practical effect occurs as
item 1 of the Financial Instruments andcommission anda result of quick substitution by other systems/equipment
Exchange Act)
representation for(for example, situations where if the order system is- Mediation, commission or representation for
negotiable securities
suspended outside of market hours, replacement systems
negotiable securities trading, market
trading etc.
are quickly activated which are equivalent to thederivatives trading or foreign market- Negotiable securities
concerned system allowing for orders in time for market
derivatives trading (Article 2, paragraph 8,
etc. settlement
hours.)
item 2 of the Financial Instruments andcommission
Exchange Act)- Negotiable securities etc. settlement
commission (Article 2, paragraph 8, item 5 of
the Financial Instruments and Exchange Act)
- Establishment of- Provision of market facilities for the trading of - No delay or outages of trading of negotiable- Refer to Article 112 Item 7 of the Cabinet Officefinancial productnegotiable securities or market derivatives
securities or market derivatives trading, etc.
Ordinance on Financial Instruments Business, etc.
markets
trading, and other work related to theshould occur as a result of IT failuresestablishment of financial product markets(Article 2, paragraph 14 and 16 and Article 80
and Article 84 of the Financial Instruments
and Exchange Act)
- Money transfer- Work related to transfer of corporate bonds,- No delay or outages of transfer of corporate- Refer to the "Comprehensive Guideline for Supervision
services
etc. (Article 8 of the Act on Book-Entry
bonds or shares should occur as a result of IT
of Settlement/Money Transfer Agencies"
Transfer of Company Bonds, Shares, etc.)
failures- Excluding situations where no practical effect occurs as
a result of quick substitution by other systems/equipment

ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELSCII sectors

58

ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELSCII services (including procedures) (Note)
Service maintenance levels
Explanation of services (including procedures)
Name
Applicability/standards
Remarks(Relevant laws)- Financial product debt - Liability assumption work through- No delay or outages of financial product- Refer to the "Comprehensive Guideline for Supervision
underwriting
underwriting or renewal of debt based on
settlement should occur as a result of IT failures of Settlement/Money Transfer Agencies"- Excluding situations where no practical effect occurs as
negotiable securities trading etc. targeted
transactions (Article 2, paragraph 28 of thea result of quick substitution by other systems/equipment
Financial Instruments and Exchange Act)
Aviation- Air transportation- Work providing transport of passengers or- No obstacles should be caused for transport of- Handled in the agreement related to "CEPTOAR in theservices
services for passengers cargo for charge using airplanes based onpassengers on scheduled flights due to IT
aviation services sector"
and cargodemands of other people (Article 2 of the
failures
Civil Aeronautics Act)- Air traffic control- Appropriate usage of airspace and space andservicesmooth maintenance of air traffic (Article 95-2of the Civil Aeronautics Act)
- Distribution of- Distribution of forecasts, warnings, etc.
meteorological
adapted for airplane use (Article 14 of theinformation
Meteorological Service Act)- Reservations, ticketing, - Air traveler reservations, air cargoboarding/loading
reservations- Airline ticket issuance, fee collection
procedures- Airline passenger check-in and boarding, aircargo loading- Flight maintenance- Airplane inspection and maintenance- Flight plan creation- Creation of flight plans and submission to
Japan Civil Aviation Bureau
Railway- Passenger transport- Work providing transport of passengers or- No obstacles should be caused for transport of- In accordance with Article 5 of the Railway Accident
services
servicescargo for charge using railways based onpassengers on as a result of suspended trains due Reporting Code (Private railway accident etc. reports)
demands of other people (Article 2 of theto IT failures
Railway Business Act)
- Ticketing, entry and- Seat reservation, boarding ticket checks onexit procedures
boarding and exiting the train
Electric power - General electric power - Work supplying electric power to meet
- No supply problem incidents of over 10 minutes - In accordance with Article 3 of the Electricity related
supplysupply service
general demand (Article 2 and Article 18 offor supply power of 100,000 kilowatts or more
Reporting Codeservicesthe Electric Business Act)should occur as a result of IT outages
Gas supply- General gas supply- Work supplying gas through piping to meet
- No supply problem incidents effecting supply to - In accordance with Article 112 of the Gas Ordinance forservices
service
general demand (Article 2 of the Gas Business 30 or more houses should occur as a result of IT Enforcement of the Gas Business Act
Act)outages
CII sectors

59

Note

Services which make absolutely no use of IT are outside the scope of application.

ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELSCII services (including procedures) (Note)
Service maintenance levels
Explanation of services (including procedures)
Name
Applicability/standards
Remarks(Relevant laws)
Government - Local government- Local administration, other administration- No obstruction of the protection of resident Ｉ
andadministration services work carried out in accordance with laws orrights and gains should occur as a result of IT
administrative
government ordinances (Article 2, paragraph 2 failures
servicesof the Local Autonomy Act)
- System recovery should be accomplished withina time period allowing for guarantee of resident
safety and security
Medical- Medical examination- Examination and treatment- No danger to human life shall occur as a result - All efforts must be made to maintain the level of medical
servicesof incorrect operation of medical equipment.
examination and treatment regardless of the degree of IT
dependence.
- No obstruction of the continued provision of
medical care should occur as a result of IT
failures.
Water services - Supply of water- Work supplying drinking water through- No interruption or decrease of water supply,- Important system problems refers to problems withthrough water services
piping or other structures to meet generalabnormal quality water supply or serious
control systems (water purification plant monitoring anddemand (Article 3 and Article 15 of the Water problems in systems should be caused forcontrol systems, pumping station operation systems,
Supply Act)supply of water as a result of suspended IT
water mobilization systems, etc.) which have a serious
failures
impact on water supply in the event of a system
shutdown- In accordance with "appropriate implementation ofhealth risk management and provision of information
related to damages to water supply facilities and water
quality incidents" (October 25, 2013) "6.(2) In the eventof information system outages in water supply"
Logistics- Logistics services- Transport and storage of cargo- No interruption of cargo transport or loss of- Handled in the "agreement related to information
servicescargo should occur as a result of IT failures
sharing and analysis functions in the logistics sector(CEPTOAR)"
Chemical- Petrochemical- Production, processing and trade of- No major interruption of supply ofindustries
industries
petrochemical productpetrochemical industries should occur as a resultof IT failures
Creditcard - Credit card
- Approval at the time of the use in the- No delay, outage of service or misapply of credit
services
authorizationintermediation of comprehensive credit
card authorization should occur as a result of IT
purchases (Article 2, paragraph 3, item 1 andfailures2, and Article 35-16, paragraph 2 ofInstallment Sales Act)Petroleum- Petroleum products- Import, refine , distribute and sale of- No interruption of petroleum supply should
industries
supplypetroleumoccur as a result of IT failures
CII sectors

Event Categories

Event Example

Description

Signs, Hiyari-Hatto

Signs such as cyber-attack warnings or Hiyari-Hatto (potentially serious damage)without occurrence of events that threaten confidentiality, integrity or availability such as
minor mistakes or receipt of malware attached to suspicious emails

Events that threaten
confidentiality

Information leakage

Events that threaten confidentiality, such as the leakage of organization's confidential
information

Events that threaten
integrity

Data corruption

Events that threaten integrity, such as website defacement or corruption of organization's
confidential information

Events that threaten
availability

Problems inusing systems

Events that threaten availability, such as loss of stable operation of control systems or
inability of viewing websites

Events that have notoccurred yet

Events that have occurred

60

Events that can lead tothose above

Malware infections

Infection of systems by malware

Execution ofunauthorized code

Execution of unauthorized code exploiting the vulnerability of systems

System intrusions

Intrusions into systems caused by cyber-attacks

OthersEvents other than those above

Cause Categories

Cause Examples

Deliberate causes

Receipt of suspicious emails, fraudulent of user IDs, mass access such as DoS attacks, unauthorized acquisition of
information, internal fraud, lack of appropriate system operation, etc.

Accidental causes

Mistaken user operation, mistaken user management, execution of suspicious files, viewing of suspicious websites,
unsupervised work by outsourcing contractor, failure of equipment, vulnerabilities, cascading effect from othersectors’ failures, etc.

Environmental causes
OthersDisasters, illnesses, etc.
Threats and vulnerabilities other than those above, unknown causes, etc.

ANNEX 3. CATEGORIES OF EVENTS AND CAUSES FOR INFORMATION SHARING TO NISC

ANNEX 3. CATEGORIES OF EVENTS AND CAUSES FOR INFORMATION SHARING TO NISC

Crisis management ministries

Information security ministries(NPA, FDMA, JCG, MOD)

(NPA, MIC, MOFA, METI, MOD)
Attack/Recovery
info. etc.
Request for cooperation
Attack/Recovery info. etc.

Security support
Organizations

National center of Incident readiness and Strategy for Cybersecurity (NISC)(IPA, JPCERT/CC, NICT etc.)

Early warning/
Recovery
info. etc.

Damage Reporton a voluntary basis

Outage/attack
info. etc.

Responsible ministries for CIIP (5 ministries)

Request for cooperation
Attack/Recovery info. etc.

IT / ICS / Security
Vendors(FSA, MIC, MHLW, METI, MLIT)

61

CII sectors
CEPTOAR council
Early warning/
Recovery
info. etc.

CEPTOAR 1
Early warning
Outage/attack
Recovery
info. etc.

Outage/attack
info. etc.

CEPTOAR 2
CEPTOAR X Secretariat (industry groups etc.)
Outage/attack info. etc.

Company A Company B

Company C Company D Company E

Recovery
info. etc.

ANNEX 4-1. INFORMATION SHARING SYSTEM (NORMAL CIRCUMSTANCES)

ANNEX 4-1. INFORMATION SHARING SYSTEM (NORMAL CIRCUMSTANCES)

Disaster prevention
related ministries

Crisis management ministries(NPA, FDMA, JCG, MOD)

Information security ministries(NPA, MIC, MOFA, METI, MOD)

Damage/Response conditions
info. etc.

Damage/terrorism
related info. etc.

Attack/Recovery
info. etc.
Request for cooperation
Attack/Recovery info. etc.

Cabinet Secretariat (Incident response / crisis management)

Security support
Organizations

National center of Incident readiness and Strategy for Cybersecurity (NISC)(IPA, JPCERT/CC, NICT etc.)

Early warning/
Recovery
info. etc.

Damage Reporton a voluntary basis

Outage/attack
info. etc.

Responsible ministries for CIIP (5 ministries)

Request for cooperation
Attack/Recovery info. etc.

IT / ICS / Security
Vendors(FSA, MIC, MHLW, METI, MLIT)

62

CII sectors
CEPTOAR council
Early warning/
Recovery
info. etc.

CEPTOAR 1
Early warning
Outage/attack
Recovery
info. etc.

Outage/attack
info. etc.

CEPTOAR 2
CEPTOAR X Secretariat (industry groups etc.)
Outage/attack info. etc.

Company A Company B

Company C Company D Company E

Recovery
info. etc.

ANNEX 4-2. INFORMATION SHARING SYSTEM (IT CRISES)

ANNEX 4-2. INFORMATION SHARING SYSTEM (IT CRISES)CII sectors

Existing communication channels

Financial services

63

Information and(1) CII operators->Government
communication services- Reporting of business outages etc. to the Minister of Internal Affairs andCommunications in accordance with the Telecommunications BusinessAct- Reporting of broadcast outages incidents, serious wireless communications
disturbances, etc. to the Ministry of Internal Affairs and Communications(2) Government->CII operators, Between CII operators- Reporting and sharing of virus outbreak and other emergency information
within the industry and with the Ministry of Internal Affairs andCommunications
Banking(1) CII operators->Government
services- Reporting of service delays and outages to the Prime Minister (Financial
Life insurance
Services Agency) in accordance with industry laws
services(2) Government->CII operators, Between CII operators
Generalinsuranceservices
Securities
services
Aviation services(1) CII operators->Government- Reporting of airplane accidents to the Minister of Land, Infrastructure andTransport in accordance with the Civil Aeronautics Act(2) Government->CII operators, Between CII operators- Establishment of IT outage related point of contact- Sharing of information related to aviation service security systems torelevant agencies (by airport)
Railway services(1) CII operators->Government, Government->CII operators- Reporting of railway operation accidents etc. to the Minister of Land,
Infrastructure and Transport in accordance with the Railway Accident
Reporting Code
- Preparation of an IT outage related contact system(2) Between CII operators- NoneEmergency communication channels under IT outages(1) CII operators->Government- Implemented using existing contact system(2) Government->CII operators- Implemented using the T-CEPTOAR, broadcast CEPTOAR and cable TV CEPTOAR
contact system- Implemented using existing contact system(1) CII operators->Government- Implemented using existing contact system(2) Government->CII operators- Implemented using banking services etc. CEPTOAR contact system- Implemented using securities services CEPTOAR contact system- Implemented using life insurance services CEPTOAR contact system- Implemented using general insurance services CEPTOAR contact system- Implemented through other industry associations, etc.
(1) CII operators->Government- Implemented using the existing incident reporting system in the event of an incident- Implemented using aviation services sector CEPTOAR contact system for IT outages not
resulting in accidents(2) Government->CII operators- Implemented using aviation services sector CEPTOAR contact system- CII operators directly contacted through point of contact(1) CII operators->Government, Government->CII operators- Implemented using the existing incident reporting system in the event of an incident- Implemented using railway services CEPTOAR contact system

ANNEX 5. COMMUNICATION CHANNELS UNDER IT OUTAGESANNEX 5. COMMUNICATION CHANNELS UNDER IT OUTAGESExisting communication channels

Electric power supply
services(1) CII operators->Government- Reports related to supply problem incidents to the Minister of Economy,
Trade and Industry in accordance with the Electricity related ReportingCode(2) Government->CII operators, Between CII operators- Establishment of IT outage related point of contact(1) CII operators->Government- Reporting of gas supply problem incidents over a certain size to the
Minister of Economy, Trade and Industry in accordance with theOrdinance for Enforcement of the Gas Business Act(2) Government->CII operators, Between CII operators- Notification within the same industry in the event of the occurrence of gas
supply problems as a result of disasters in accordance with the Japan Gas
Association "relief measures outline"(1) Various ministries and government offices->Cabinet Secretariat- Information sharing to NISC in accordance with "Regarding
communications related to government information systems during
emergencies" (April 17, 2000)(2) Cabinet Secretariat->Various ministries and government offices- Information sharing from NISC in accordance with "Regarding
communications related to government information systems during
emergencies" (April 17, 2000)(3) Local government->Government- Information sharing from NISC in accordance with "Regarding responsereporting and preparation of an emergency contact system for theoccurrence of information security incidents (Notification)"(4) Government ->Local government- Information sharing from NISC in accordance with "Regarding responsereporting and preparation of an emergency contact system for theoccurrence of information security incidents (Notification)"(1) CII operators->Government, etc.
(2) Government, etc.->CII operators

Gas supply services

Government andadministrative services

64
Medical services

Water services(1) CII operators->Government, etc.
(2) Government, etc.->CII operators

Emergency communication channels under IT outages(1) CII operators->Government- Implemented using existing contact system(2) Government->CII operators- Implemented using the contact system for information sharing and analysis functions
related to IT outages in power supply- CII operators directly contacted through point of contact(1) CII operators->Government- Implemented using existing contact system(2) Government->CII operators- Implemented using gas supply services CEPTOAR contact system- Implemented through CII operators(1) Various ministries and government offices->Cabinet Secretariat, Cabinet
Secretariat->Various ministries and government offices- Implemented using the internal government contact system(2) Local government->Government, Government->Local government- Implemented using local government CEPTOAR contact system- Implemented using existing contact system(1) CII operators->Government, etc.
(2) Government, etc.->CII operators- Implemented using medical services CEPTOAR contact system(1) CII operators->Government, etc.
(2) Government, etc.->CII operators- Implemented using the water supply CEPTOAR IT outage information handling related
guideline contact system

ANNEX 5. COMMUNICATION CHANNELS UNDER IT OUTAGESCII sectors

Logistics services

Chemical industries

Credit card services

Petroleum industries

65

Existing communication channels

Emergency communication channels under IT outages(1) CII operators->Government- Reporting of accidents etc. to the Minister of Land, Infrastructure andTransport in accordance with various industry laws(2) Government->CII operators- Designated public agencies stipulated in the Cabinet Office Disaster
Countermeasures Basic Act(1) CII operators->Government- Reporting etc. to presiding ministries and related ministries in accordancewith the relevant laws(2) Government->CII operators(1) CII operators->Government- Implemented using the existing incident reporting system in the event of an incident- Implemented using logistics CEPTOAR contact system for IT outages not resulting in
accidents(2) Government->CII operators- Implemented using logistics services CEPTOAR contact system(1) CII operators->Government- Implemented using existing contact system- Implemented using chemical industries CEPTOAR contact system(2) Government->CII operators- Implemented using chemical industries CEPTOAR contact system(1) CII operators->Government- Reporting etc. to presiding ministries and related ministries in accordance with the relevant
laws(2) Government->CII operators- Implemented using credit card services CEPTOAR contact system(1) CII operators->Government- Implemented using petroleum industries CEPTOAR contact system(2) Government->CII operators- Implemented using petroleum industries CEPTOAR contact system(1) CII operators->Government- Reporting etc. to presiding ministries and related ministries in accordancewith the relevant laws(2) Government->CII operators- Information sharing in the sectors(1) CII operators->Government- Reporting etc. to presiding ministries and related ministries in accordancewith the relevant laws(2) Government->CII operators- Information sharing in the sectors

ANNEX 5. COMMUNICATION CHANNELS UNDER IT OUTAGESCII sectors

ANNEX 6. DEFINITIONS / GLOSSARIESANNEX 6. DEFINITIONS / GLOSSARIES
CEPTOAR

CEPTOAR council

CII

CII operators

CII sectors

CII services

CIIP
agencies

supporting

Crisismanagement
ministries
Critical information
systems

Cyberspace-related
operators

Disasterprevention
related ministries
Guidelines for safety
principles

Hiyari-Hatto
Information security
related ministries
Information sharing

Capability for Engineering of Protection, Technical Operation, Analysis and Response.
Functions which provide information sharing and analysis at CII operators, andorganizations which serve as these functions.
The council composed of representatives of each CEPTOAR which carries out
information sharing between CEPTOARs. An independent body, not positioned underother agencies, including government organizations.
The backbone of national life and economic activities formed by businesses providing
services that are extremely difficult to be substituted. If the function of the services issuspended, deteriorates or becomes unavailable, it could have a significant impact on thenational life and economic activities.
Operators designated in "Applicable CII operators" in "ANNEX 1. SCOPE OF CIIOPERATORS AND CRITICAL INFORMATION SYSTEM EXAMPLES" and groups
composed of those designated operators.
"information and communication services", "financial services", "aviation services","railway services", "electric power supply services", "gas supply services", "government
and administrative services (including local government)", "medical services", "water
services", "logistics services", "chemical industries", "credit card services" and"petroleum industries".
Services and/or a set of procedures provided by CII operators necessary to utilize thoseservices designated in "ANNEX 2. CII SERVICES AND SERVICE MAINTENANCELEVELS" in each CII sector, taking into account that the extent of impact to national lifeand economic activities.
The National Police Agency Cyber Force, National Institute of Information andCommunications Technology (NICT), National Institute of Advanced Industrial Scienceand Technology (AIST), Information-Technology Promotion Agency (IPA), Telecom
Information Sharing And Analysis Center Japan (Telecom-ISAC Japan), and Japan
Computer Emergency Response Team Coordination Center (JPCERT/CC).
The National Police Agency (NPA), Fire and Disaster Management Agency (FDMA),Japan Coast Guard (JCG) and Ministry of Defense (MOD).
Information systems required to provide CII services, designated in each CII operator,
taking into account of the degree of impact to its CII service. Examples shown in"ANNEX 1. SCOPE OF CII OPERATORS AND CRITICAL INFORMATION SYSTEM
EXAMPLES".
System vendors, which are engaged in the design, construction, operation andmaintenance of information systems required for providing CII services, security
vendors, which provide measures for CIIP such as antivirus software of those information
systems, and platform vendors, which provide the platforms which serve as foundations,
including hardware and software of those information systems.
The government organizations and ministries stipulated Article 2 Item 3 of the Disaster
Countermeasures Basic Act (Act No. 223 of 1961) which carry are related to informationcollection during disasters.
Measures for CIIP, which contain high-priority items and/or advanced items expected asa reference, collected with an overlook on all the CII sectors, in order to contribute topreparation and revision of safety principles.
Main section is approved by the Cybersecurity Strategic Headquarters. Measures section
contains detail measures as an example.
Unexpected and unpredictable events which did not lead to IT failures, but which had thepotential to directly cause IT failures.
The National Police Agency (NPA), Ministry of Internal Affairs and Communications(MIC), Ministry of Foreign Affairs (MOFA), Ministry of Economy, Trade and Industry(METI) and Ministry of Defense (MOD).
The mutual sharing of information such as experience, knowledge and know-how bytransferring to associates and communicating among organizations and members. It
includes both information sharing to NISC and information sharing from NISC.

66

ANNEX 6. DEFINITIONS / GLOSSARIES

Information sharing
from NISC
Information sharing to
NISC
Information systems
IT-BCPIT crises

IT failures
IT outage
Measures for CIIP
Responsible ministries
for CIIP

Safety principles

Stakeholders

The provision of information for contributing to measures for CIIP from the Cabinet
Secretariat to CII operators.
The provision of information related to IT outage, IT failures and Signs/Hiyari-Hatto at
CII operators from the CII operators to the Cabinet Secretariat.
All systems based on IT such as systems for business processing, control field equipment,
monitoring and control systems.
Business continuity plan (including relevant manuals) related to the information systems
to provide CII services, and other Business continuity plan.
IT outages which require intensive response by the government such as the establishmentof the Cabinet Response Office at the Crisis Management Center in the Prime Minister's
Office.
Events that information systems for CII do not or cannot perform as expected at the timeof their design.
IT failures which lead to fall short of the "service maintenance levels" as shown in"ANNEX 2. CII SERVICES AND SERVICE MAINTENANCE LEVELS".
A wide range of activities for preventing IT outages from affecting the national life andeconomic activities.
Financial Services Agency (FSA), Ministry of Internal Affairs and Communications(MIC), Ministry of Health, Labour and Welfare (MHLW), Ministry of Economy, Tradeand Industry (METI), and Ministry of Land, Infrastructure, Transport and Tourism(MLIT).
Collective measures for CIIPs including "regulations" stipulated by the government incompliance with sector-specific laws, "recommendations” and "guidelines" developed by
the government according to sector-specific laws, "standards" and "guidelines" in thewhole-sector developed by sector-specific groups to respond to sector-specific laws andpublic expectations, and "internal policies" prepared by CII operators themselves to
respond to sector-specific laws and expectations of public and customs. However, safety
principles do not include the "Guidelines for safety principles".
The Cabinet Secretariat, responsible ministries for CIIP, information security related
ministries, crisis management ministries, CII operators, CEPTOAR, CEPTOAR council,
CIIP supporting agencies and cyberspace-related operators.

67