BUILDING A CYBER WORKFORCE
THROUGH THE U.S.-JAPAN ALLIANCEBUILDING A CYBER WORKFORCECONTENTS

THROUGH THE U.S.-JAPAN ALLIANCE

In 2021, the Maureen and Mike Mansfield Foundation convened
a working group of practitioners and scholars to address growing
concerns surrounding the severe lack of human capital in the field ofcybersecurity, with a particular focus on the U.S.-Japan relationship.
This project grew out of a significant desire to focus on cybersecurity
capabilities between the allied nations.
This working group was composed of 12 members, six from Japanand six from the United States, with experience and interest inadvancing cybersecurity as it pertains to the U.S.-Japan alliance.
Members included former military and government workers, as wellas many who are currently working in the cybersecurity field in one
way or another.

Executive Summary���������������������������������������������������������������������������������������������������������������� 4
Summarized Policy Recommendations; Outline of the program’s background assumptions.

The Nature of the Threat Faced by the United States and Japan in Cybersecurity �������� 6
Japan’s Updated National Security Strategy and its Implications������������������������������������ 8
Current Initiatives in U.S.-Japan Cybersecurity Cooperation ������������������������������������������ 9
Building a Framework�����������������������������������������������������������������������������������������������������������10
Building human capital in the field of cybersecurity with a particular focus on curricula,pipeline, etc., while avoiding overall technology cooperation.

Detailed Discussion of Policy Recommendations��������������������������������������������������������������11

Throughout a series of five online sessions, the working group
discussed the following topics: expertise entering the workforce;joint training and exercises; standardizing curricula and syllabi; theobstacles across information sharing; lack of standardized “language”
for cybersecurity; cultural barriers to joint action; collaboration
across sectors/domains that utilize cybersecurity; and utilizing
public-private partnerships to further collaboration between the twocountries.
This report details the current landscape of U.S.-Japan cybersecurity
cooperation and the threats faced by our nations, and offers policy
recommendations on strengthening the cyber workforce.

2

3

EXECUTIVE SUMMARYPOLICY RECOMMENDATIONS:
1.

The U.S.-Japan alliance should borrow from the experience of the Japanese
private sector in developing a base set of joint syllabi for the United States andJapan, based on the global common standard of the U.S. National Initiative for
Cybersecurity Education (NICE) framework.
a. Through this, the United States and Japan should establish a doubledegree program between Japanese and U.S. universities.

BASELINE ASSUMPTIONS:
1.

This brief assumes that readers will be fluent in the general language ofcybersecurity and policy but may not be experts themselves.

2. Our working group decided that we would look beyond a discussion of security
clearances.
3.

b. The goal is to provide a direct linkage of any syllabi to actual job roles incybersecurity.

The United States and Japan already have a strong relationship when it comes tocybersecurity, with many joint initiatives that could be leveraged to promote deeper
collaboration. President Biden and Prime Minister Kishida both understand theimportance of cybersecurity cooperation between the two nations and have madejoint statements regarding the importance of U.S.-Japan bilateral cooperation.

2. Create a common and standard vocabulary used to recruit for cybersecurity.
This will increase recruitment and individuals interested in applying forcybersecurity positions.

4. Recent world developments indicate that urgent U.S.-Japan cooperation withregard to cybersecurity is necessary.

3.

5.

Japanese universities should work to obtain an equivalent of a Center of
Academic Excellence (CAE) designation for universities. In particular, these
universities should focus on cyber defense, as opposed to cyber operations andresearch.

The United States and Japan can do more to work together to enhance theirindividual and collective cybersecurity capabilities. The two countries should use
their relative strengths to build human capacity in the field to increase national andinternational security.

4. The United States and Japan should further invest in the “sister cities” program
to encourage state-to-state and university-to-university collaboration andlearning.

6. As the world becomes more intertwined, especially digitally, threats surpass thedomestic and national levels, becoming global. As two leading liberal democracies,
the United States and Japan can become a joint force in global cybersecurity.

5.

7.

Increase the capabilities of training networks by using games (such as tabletop
exercises and simulations) and training to capture institutional knowledge,
complex systems, teaching. Such games will keep curricula and learning
immersive and up to date.

6. Embrace the power of online learning, while taking into consideration the
security risks, to provide mass training to people who need to be fluent, but
not expert, in cybersecurity. This would include those in leadership, who need
to be able to understand what their technical staff need.
7.

Increase the number of people who can serve as bridges between the twocountries in terms of coordination, collaboration, and expertise.

8. Foster a collaborative venture ecosystem.
9. Policy makers should spend more time thinking about issues at hand and lesstime in meetings. Identify a clear problem, gather a group of relevant experts,
practitioners, and/or scholars who can solve it, and then once solved build up
and out.

While the United States and Japan are linked very closely with certain
cybersecurity capabilities, there is also a standard set of barriers when it comes to
how the two counties operate within this realm. These include cultural barriers;
operational differences when it comes to public-private partnerships, security
clearances, and information sharing; structural differences; differences in standardsof career trajectory; and more.

8. Within its new National Security Strategy (NSS) released in December 2022, theJapanese government has committed to greater collaboration with international
partners, civilian agencies, and (unprecedentedly) critical infrastructure companies
when addressing cyber threats. This has specifically been extended to building
capabilities and resiliencies during peacetime.
9. Cybersecurity encompasses a very broad field with many different dimensions.
Various stakeholders and actors can be involved without being a programmer ornecessarily a cybersecurity specialist. This policy brief is narrowed to the questionof building human capital in cybersecurity, but even this one small issue hasinterconnections that cannot all be explored in one project. The Foundation looks
forward to future scholarship to further shared interests.

10. Create a pilot program on university-to-industry pipelines.

4

5

THE NATURE OF THE THREAT WE FACE
The increasing scale and scope of cyber-attacks asevidenced by the pervasive hack of U.S. government
systems in 20201 and the September 2022 reportsof disruptions across 20+ Japanese government
websites2 have clearly illustrated the need for a strong
cybersecurity posture from both the United States
and Japan.

ability to predict, deter, and counter emerging cyberthreats to both nations and the Indo-Pacific.
While cyber threats were previously identified
by vectors and means of aggression, Japan’s 2021
Cybersecurity Strategy explicitly named state actors
Russia, North Korea, and China as threats.6 Amid
this change in view from Japan and the state ofgeopolitics, Japan saw an 87% increase in ransomware
attacks in the first half of 2022.7

For example, the 2017 WannaCry cyberattacks
launched by North Korea affected entities globally;
it crippled law firms, rerouted ambulances, shut
In the modern, digitally interconnected geopolitical
down one of the largest communications operators
landscape, the impacts of cyberattacks
in Europe, damaged the UK Nationaland cyberwarfare will be felt by allies:
Health Service, and reportedly caused
JAPAN SAW AN
should either the United States or
up to $4 billion in damages.3 Japan
87% INCREASE IN
Japan be the target of an attack, thehad to halt production at the Honda
RANSOMWARE
other will likely be affected. Because
plant in Sayama, and many otherno amount of prevention can possibly
ATTACKS IN THE
countries in Asia were also targeted.4
stop every attack, the ability to recover
FIRST HALF OF 2022.
WannaCry and other cyber-attacks
and build resiliency is also important.
such as the attack on Mitsubishi
Enhanced coordination between
Electric attack in 2019, the Zoom
the
UnitedStatesand Japan can start from a more
service breach in 2020, and the Microsoft Exchange
ProxyLogon attacks in 2021 illustrate how intertwined robust, equipped, trained, and educated workforce
prepared to defend and respond to these inevitableglobal cybersecurity is.
attacks. Many responses to WannaCry were isolated
Unfortunately, we are suffering from an acuteand severely lacked the level of resilience needed
shortage of skilled personnel needed even to sustain
to respond and recover efficiently. Organizations,our current posture; with a gap of 2.72 million
companies, agencies, and governments need a
globally, 377,000 in the United States, and 40,000 incompetent workforce to help design and implement
Japan.5
security controls and responses, or the aftereffects ofcyberattacks will linger for ages to come.
Addressing this major workforce shortage will
increase the United States’ and Japan’s collective

Bill Chappell, Greg Myre, and Laurel Wamsley, “What We Know About Russia’s Alleged Hack of the U.S. Government and Tech Companies,” NPR, December
21, 2020. https://www.npr.org/2020/12/15/946776718/u-s-scrambles-to-understand-major-computer-hack-but-says-little
1“Japan probes possible involvement of pro-Russian group in cyberattacks,” Reuters, September 7, 2022. https://www.reuters.com/technology/japaninvestigating-possible-involvement-pro-russian-group-cyberattack-nhk-2022-09-06/
2

Tarah Wheeler and John, Lord Alderdice, “Cyber Collateral: WannaCry & the impact of cyberattacks on the mental health of critical infrastructure defenders,”
University of Oxford, October 2022. https://static1.squarespace.com/static/55faab67e4b0914105347194/t/633d5be5aeb3a41a99505e10/1664965606071/
The+impact+of+cyberattacks+on+critical+infrastructure+defenders.pdf
3“Honda halts Japan car plant after WannaCry virus hits computer network,” Reuters, June 21, 2017. https://www.reuters.com/article/us-honda-cyberattack/honda-halts-japan-car-plant-after-wannacry-virus-hits-computer-network-idUSKBN19C0EI)
4“A Resilient Cybersecurity Professions Charts the Path Forward,” (ISC)2, April 2022. https://www.isc2.org/-/media/ISC2/Research/2021/ISC2-CybersecurityWorkforce-Study-2021.ashx
5

LESSON FROM RUSSO-UKRAINE WAR: BUILD IN AND PRACTICE RESILIENCE
When discussing the threats we face, we cannot ignore the ongoing Russo-Ukraine
War, and what we can learn from the crisis. Dmitri Alperovitch (co-founder andformer CTO of CrowdStrike and chair of security-centric think tank Silverado Policy
Accelerator) laid out a critical lesson while speaking at the RSA Conference in June
2022:
“The reality is that a number of these Russian attacks are successful….However, theUkrainians are able to rebuild the networks within hours. So it’s really not a big deal
to see a network wiped out because they are ready for it. They’ve got backups ready togo, and they can rebuild it very quickly and very efficiently. And that’s something we
don’t practice here.” In the United States, recovering from a major attack can take anorganization weeks and “be truly devastating,” he added.
In a swiftly emerging world where digital conflicts are growing more numerous thantheir kinetic forebears, cyber resilience will make the difference between defensible
national sovereignty and imposed national concessions to authoritarian adversaries.8“Cybersecurity Strategy: Cybersecurity for All,” Government of Japan’s National center of Incident readiness and Strategy for Cybersecurity (NISC), September
2021. https://www.nisc.go.jp/pdf/policy/kihon-s/cs-senryaku2021-en-booklet.pdf
6“Japan saw 87% increase in ransomware attacks in first half of 2022,” Kyodo via The Japan Times, September 15, 2022. https://www.japantimes.co.jp/
news/2022/09/15/national/crime-legal/ransomeware-attacks-rise/7

6

Jessica Lyons Hardcastle, “Ukraine’s secret cyber-defense that blunts Russian attacks: Excellent backups,” The Register, June 8, 2022. https://www.
theregister.com/2022/06/08/silverados_alperovitch_viasat_attack/
8

7

JAPAN’S UPDATEDNATIONAL SECURITY STRATEGYThe United States and Japan face significant difficulties in sharing criticalinformation. Much of this stems from differences in technology, institutions,
legalities, and cultural factors, and how critical information is secured withineach society. While the governments of the United States and Japan havean agreement ensuring that Japan aligns its clearance granting process
and access to classified info in a manner similar to the U.S. Department of
Defense clearance process, the agreement is more specifically for classified
military information.9 Private sector players may have their own procedures
and measures for managing sensitive corporate data or, if they are supporting
government work, they will have clearances granted by the government andtherefore fall within the government clearance structure.
In light of this, Japan’s NSS states that it will “strengthen the foundationsof information security and cybersecurity so that Japan and the U.S. canfully employ their capabilities….Specifically, in order to be able to respondto emerging cyber threats at any time, Japan will first establish a mechanism
to continuously assess the information systems of government agencies,
to improve measures against cyber threats as necessary, and to constantly
manage vulnerabilities of government agencies’ information systems.” 10 Japan’s
NSS outlines specific ways in which Japan will establish this mechanism.
The working group, in line with the government of Japan, recognizes theimportance of security clearances and information sharing. Just recently,
on February 14, 2023, Japan’s Prime Minister Fumio Kishida requested that
preparations begin for legislation introducing a security clearance system not
only in the public sector but also in the private sector.11 Even short of resolving
any information sharing or security clearance difficulties, progress between the
United States and Japan can be achieved as outlined in the NSS. This report
includes recommendations aimed at building a more stable cyber workforce,
though we do not explicitly mention the information sharing difficulties.

CURRENT INITIATIVES

IN U.S.-JAPAN CYBERSECURITY COOPERATION

Although there are many cooperative cybersecurity initiatives between the United States and Japan, they often
live in their own silos, limiting their effectiveness. What’s more, many forums and working groups met only
once or twice without further effort or concrete deliverables or have been put on hold due to COVID-19. The
policy recommendations detailed below aim to bridge the gap between these existing programs and initiatives
by pulling the good ideas and collaboration out of their silos into a more collaborative space.

EXAMPLES OF EXISTING INITIATIVES, GOVERNMENT EXCHANGES, AND PARTNERSHIPS INCLUDE:

DIALOGUESGUIDELINES & PARTNERSHIPS• The U.S.-Japan Cyber Dialogue: led by
Japan’s Ministry of Foreign Affairs andcreated as a vehicle for closer alliancecooperation with the United States incyberspace• The Guidelines for Japan-U.S. Defense Cooperation, April
27, 2015: stipulates that “To help ensure the safe andstable use of cyberspace, the two governments will share
information on threats and vulnerabilities in cyberspacein a timely and routine manner, as appropriate. The two
governments also will share, as appropriate, informationon the development of various capabilities in cyberspace,including the exchange of best practices on training
and education. The two governments will cooperate toprotect critical infrastructure and the services upon which
the Self-Defense Forces and the United States Armed
Forces depend to accomplish their missions, including
through information sharing with the private sector, as
appropriate.” 15• Japan-U.S. Security Consultative
Committee (“2+2”): leaders from theUnited States and Japan meet yearly to
discuss the Alliance and respective views
on regional security issues, including
those related to cybersecurity• U.S.-Japan Policy Cooperation Dialogue
on the Internet Economy (led by
Japan’s Ministry of Internal Affairs andCommunications)12• JP-US-EU Industrial Control Systems
Cybersecurity Exercise (led by METI)13“Agreement between the Government of Japan and the Government of the United States of America concerning
Security Measures for the Protection of Classified Military Information,” Ministry of Foreign Affairs, October
29, 2005. https://www.mofa.go.jp/region/n-america/us/security/agree0708.html
9“National Security Strategy of Japan,” Cabinet Secretariat of Japan, December 2022. https://www.cas.go.jp/
jp/siryou/221216anzenhoshou/nss-e.pdf
10“Japan Eyes Security Clearance System for Economic Security,” Jiji Press via The Japan News, February 15,2023. https://japannews.yomiuri.co.jp/politics/politics-government/20230215-91211/
11

Image: pikisuperstar via freepik.com

8• The Quad Cybersecurity Partnership (May 2022)

FORUMS & WORKING GROUPS

UNIVERSITY PARTNERSHIPS• The Japan-U.S. IT Forum: between
the U.S. Department of Defense andJapanese Ministry of Defense• The Keio CCRC-Columbia SIPA Cyber Dialogue• Cyber Defense Policy Working Group:
intended to promote cyber cooperation
between their respective defense
establishments and governments• Exchange program between Georgia Tech University andKobe University/Tohoku University/Tokyo Institute ofTechnology• Japan-U.S. Information Assurance
Working Group: designed to “deepen
consultations between the SDF Joint Staffand US Forces in Japan” 14
Image Credit: Air Force Staff Sgt. Peter Reft

• The U.S.-Japan Competitiveness and Resilience (CoRe)
Partnership• U.S.-Japan Virtual Forum on
Cybersecurity Cooperation: Beyond theTokyo Olympics: Think-tank initiative• Exchange program between the University of Oklahoma
and the University of Electro-Communications• International Research Internship for Engineers in Tokyo
between Texas Tech University and Aoyama Gakuin
University• Kobe Master of Science in Information Technology –Information Security program at Carnegie Mellon, with
University of Hyogo (discontinued)“Joint Statement on the 12th U.S.-Japan Policy Cooperation Dialogue on the Internet Economy,” U.S. Department of State, November 18, 2021. https://www.state.gov/
joint-statement-on-the-12th-u-s-japan-policy-cooperation-dialogue-on-the-internet-economy/
12“JP-US-EU Industrial Control Systems Cybersecurity Week for the Indo-Pacific Region was Held,” METI, October 31, 2022. https://www.meti.go.jp/english/press/2022/1031_001.html
13

Stefan Soesanto, “Japan’s National Security and Defense Posture,” Center for Security Studies (CSS), ETH Zürich, September 2020. https://css.ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/Cyber-Reports-2020-08-Japans-national-cybersecurity-defense-posture.pdf
1415“The Guidelines for Japan-U.S. Defense Cooperation,” Ministry of Foreign Affairs, April 2015. https://www.mofa.go.jp/files/000078188.pdf

9BUILDING A FRAMEWORKCybersecurity is still a relatively new field, everchanging, updating, and growing. As such, there is
no standard language that defines how each country
works within the domain, despite cybersecurity beinga universally identified and prevalent need. Creatinga standardized way to think about cybersecurity
job roles and the associated curriculum, training
methods, and language would be beneficial to not
only the United States and Japan, but to otherallied nations as well. Standardizing the world ofcybersecurity overall would remove inherent barriers
such as inconsistent training, lack of relevant skills,
difficulties in cross-sector permeation, etc.

information about cybersecurity work in the UnitedStates and has served as a bedrock of knowledge forother countries as well.

Luckily, there are “frameworks” in place in eachnation that could further be utilized bilaterally.
For example, the United States has a head starton this with the Cybersecurity Framework andNational Initiative for Cybersecurity Education(NICE) led by the National Institute of Standards
and Technology (NIST) in the U.S. Departmentof Commerce. The Cybersecurity Framework is a
resource of standards, guidelines, and best practices
for managing cybersecurity risk while NICE serves
as a fundamental resource for describing and sharing

The NIST Cyber Security Framework (CSF) is
voluntary guidance, based on existing standards,
guidelines, and practices for organizations tobetter manage and reduce cybersecurity risk. In
addition to helping organizations manage andreduce risks, it was designed to foster risk andcybersecurity management communications
amongst both internal and externalorganizational stakeholders.16
The National Initiative for Cybersecurity
Education (NICE) Workforce Framework for
Cybersecurity (NICE Framework)17 provides aset of building blocks for describing the tasks,
knowledge, and skills that are needed to perform
cybersecurity work by individuals and teams.
Through these building blocks, the NICE
Framework enables organizations to develop
their workforces to perform cybersecurity work,
and it helps learners to explore cybersecurity
work and to engage in appropriate learning
activities to develop their knowledge and skills.

While Japanese workers tend to stay with a
United States, the frequent turnover of employees
single employer for the bulk of their career, duty
has made the NICE Framework harder for corporate
rotations every 2-3 years are common, particularly
entities to use.
for leadership-track personnel within government
The NICE Framework updates frequently and setsorganizations. This makes it difficult for employees
a standard that can be used globally; however, its
to develop strong cybersecurity skills, but on the
adoption is voluntary in nature.
other hand fosters a workforce
Many Japanese companies havewith institutional knowledge.
THE NICE FRAMEWORK
joined Japan’s Cross Sectors
Utilizing the NICE Framework
UPDATESFREQUENTLY
AND
Forum (CSF) and have agreed
allows organizations an
to use the NICE Framework,
SETS A STANDARD THAT CAN
opportunity to have checks andcontributing to a higher level of
BE USED GLOBALLY;
balances about the role fromcohesion within Japan on how
the start but does not eliminate
these organizations handle their
HOWEVER, ITS ADOPTION IS
the challenge of retaining
cybersecurity and hiring for
VOLUNTARY IN NATURE.
cybersecurity specialists incybersecurity.18 Unfortunately,fields that have rotation cycles.
though, since the CSF and NICE
If Japanese employees stay
Frameworkarevoluntary,
there is still a severe lackwithin an organization and rotate, there’s a hugeof cohesion even within the United States and Japan,
potential for rotations that can, over time, strengthenmuch less in terms of their bilateral cooperation.
the entire security culture of the organization. In the

Image designed by Freepik.

16“Cybersecurity Framework: Getting Started,” NIST, April 2022. https://www.nist.gov/cyberframework/getting-started

Note: NIST is currently updating the CSF to “version 2.0.”
Rodney Petersen et al., “Workforce Framework for Cybersecurity (NICE Framework),” NIST Special Publication 800-181 Revision 1, November 2020. https://doi.org/10.6028/NIST.SP.800-181r1
17

Image Credit: Jon Abulencia
Building a Cyber Workforce Through the U.S.-Japan Alliance at Tokyo University in Japan.

10“Japan Cross-Sector Forum: Cybersecurity Framework Success Story,” NIST, July 23, 2020. https://www.nist.gov/system/files/documents/2020/07/23/
Japan%20Cross-Sector%20Forum%20Success%20Story%20062920%20508.pdf
18

11

POLICY RECOMMENDATIONS
1.

Formal and Joint Subject Syllabi: Japanese companies
have developed syllabi to standardize cybersecurity
workforce development in the private sector, based on
the global common standard of the U.S. National
Initiative for Cybersecurity Education (NICE)’s
framework.
a.

2.

3.

students that the university can teach them the skills
they need to succeed in the field of cybersecurity. If
Japan adopted a similar program, students graduatingfrom a CAE-designated university would signal toemployers in both countries that job applicants have acertain shared set of skills.

Building on this development in the Japanese
private sector, the United States and Japan should
establish a double-degree program between
Japanese and U.S. universities to provide amaster’s degree from two universities on an
accelerated timeline. In doing so, students would
have the opportunity to study the same subject
from two national perspectives, gaining valuableknowledge from both countries in order to becomea key player in U.S.-Japan bilateral cybersecurity
cooperation in the future.

b.

This could be based on programs that have existed
in the past like the Carnegie Mellon partnershipwith the University of Hyogo.

c.

There needs to be a mechanism for any joint
syllabi to be quickly updated and maintained to bereflective of the actual needs of job roles as theseskill profiles change.

Common and Standardized Language: There is benefit
in standardizing the language used to recruit forcybersecurity. Creating a standard lexicon, based upon
the NICE framework, will increase recruitment andindividuals interested in applying for cybersecurity
positions. The United States and Japan should take thejoint framework developed based on NICE to create astandardized, shared definition for job duties andpositions. The two organizations who should take thelead on these efforts are NIST and Japan’s Informationtechnology Promotion Agency.
Center of Academic Excellence for University
Ecosystem: Further to the recommendation of creatinga joint set of syllabi and creating more double-degree
programs, Japanese universities should work to obtain
an equivalent of a Center of Academic Excellence(CAE)19 designation for universities. These universities
should focus on cyber defense, as opposed to cyber
operations and research. In the United States, thisdesignation signals that the university has met
requirements set by the National Security Agency andDepartment of Homeland Security, bringing prestige tothe university and signaling to potential

4.

5.

a.

Study abroad and educational exchange would
become smoother between designated schools,
encourage Japanese and English language
learning, and provide access to internshipexperiences. Existing partnerships, such as
those listed in the narrative above, should leadthe charge in furthering this collaboration.

b.

This ecosystem would incentivize employers
to create internship, apprenticeship, and othertypes of pipeline relationships with CAEdesignated universities.

Sister Cities for Cybersecurity Socialization: While
there are many high school, cultural, and businessexchanges in the sister cities framework, there could be
more university-to-university collaborations toencourage collaboration and learning in building acyber workforce. This program could build upon the
CAE program as well, including more professional nonacademic exchange programs, symposiums, and othersin this line at the private level.
Simulations, Games, and Training for Applied
Learning: The United States and Japan, starting
through the Department of Defense and the Japan Self
Defense Forces, should increase the capabilities of theirtraining network by using games to capture
institutional knowledge, train in complex systems, andkeep curricula and learning immersive and up to date.
These game constructs include: tabletop exercises toallow leadership teams to stress test their responseplans and identify weak spots; card games to evaluate
what responses to scenarios are possible with certain
resources; and computer simulations to train specificskills. Computer-based simulations can be tuned to thespecific parameters and conditions being explored inany given situation. This can provide a versatile
platform to rapidly iterate on cybersecurity scenariosand how to approach them.
Furthermore, there should be more growth and skillbuilding opportunities within organizations andcompanies. Routine cybersecurity trainings need to be
spearheaded by the organizations themselves,

19“National Centers of Academic Excellence in Cybersecurity,” National Security Agency/Central Security Service. https://www.nsa.gov/Academics/Centers-ofAcademic-Excellence/cae-co-centers

12

potentially including the streamlined and sharedlanguage of cybersecurity as outlined in previous
recommendations. Games can take time to update
and have very specific expected deliverables, so
training and education surrounding more current
events through accessible methods are important.
6.

7.

Baseline and Online Learning Across Organizational
Functions: The United States and Japan should
embrace the power of online learning, while taking into
consideration the security risks, to provide mass
training to people who need to be fluent, but notexpert, in cybersecurity. This would include thosein leadership who need to be able to understand what
their technical staff may need, creating an environment
conducive to growth. One example of this necessity is
the growing prevalence of cyber-enabled jobs, such as
in traditional IT.
Access to training through online services will
empower non-cybersecurity experts to be involved.
With increased accessibility, diversity in terms of who
is working and able to work in the field ofcybersecurity will increase as well. Standardized online
training between the United States and Japan would
create a pipeline of more people who have this baselineknowledge.
Transpacific Community Growth and Development:
The United States and Japan should increase
the number of people who can serve as bridges
between the two countries in terms of coordination,
collaboration, and expertise. Even though this type ofcollaboration is critical, the United States and Japan
have not invested enough resources in overcoming
basic issues of language barriers and communication.
There is a distinct lack of opportunities to learn about
Japanese government activities in English. An aspect of
this role is to be engaged in translating the Japanese
government’s cyber protocols and plans for a U.S.
audience.
a.

For example, there are people from Japanesecompanies being seconded to non-profit
organizations in DC to update cybersecurity
guidelines based on the NIST Framework. Theirrole in sharing NIST activities (in Japanese withthe government of Japan, Keidanren, and otherorganizations) and vice versa (in English to theUnited States) has been invaluable.
b.

There should be a priority placed on ensuring thatsuch bridge builders exist in greater numbers,
working in all directions with knowledge toenhance connective tissue.

8.

Foster Collaborative Venture Ecosystem: Given thegrowth and acceleration of cybersecurity imperatives,and constantly novel ways that bad actors activate
threats, innovation is critical to drive new advances in
the critical arena–with a lions’ share of this needed
innovation coming from startup communities. Venture
funding into cybersecurity startups has totaled $48.8
billion from 2021-22, the two highest-investment years
on record.20 There is an opportunity for Japanese andU.S. multinationals to collaborate(especially through corporate venture investment) in
fostering a community of startups on both sides of the
Pacific. In addition to mutual investment in emerging
technologies (i.e., VC), the countries should simplify
mutual adoption of leading technologies, including
removing barriers to bilateral data flows. Without easeof adoption, startups (many of which will be built on
cloud platforms) will not be able to reach scale.

9.

Action for Impact: Policy makers should spend
more time thinking about issues at hand and less timein meetings. Information sharing structures work bestwhen there is a clear purpose and need. We
recommend that policy makers: identify aclear problem; gather a group of relevant experts,
practitioners, and/or scholars who can solve it; andbuild up and out to branch out to focus on otherpressing issues.

10. Create a pilot program on university-to-industry
pipelines for cybersecurity where participatingorganizations would agree to generate and employ 100
new cybersecurity professionals per year. We
recommend that the U.S. Cyber and Infrastructure
Security Agency under the Department of Homeland
Security and Japan’s National Center of Incident
Readiness and Strategy for Cybersecurity (NISC)
convene a focused group of industry, academic, andgovernment personnel from each country to facilitate
these pipelines. MEXT should be a key player in thisfocus group.21

Jonathan Greig, “Venture capital financing of cyber companies slid to $18.5 billion in 2022,” The Record, Feb. 22, 2023. https://therecord.media/cybersecurity-vcinvestments-2022-momentum-report

20This recommendation builds on existing work in the United States (e.g. NSA is working with University of Texas San Antonio to create a pipeline of cyber talent toserve NSA and contractors in the region) and is intended to leverage the other recommended university and industry partnerships above

21

13

Image Credit: Jon Abulencia

This report was prepared by Mansfield Foundation staff.
We have attempted to accurately present the key findings
from the working group and capture the consensus of
the group. This report may or may not reflect the views of
any individual member of the group. The views expressedherein should not be attributed to any individual
participant or the organizations with which they areaffiliated. All members of the working group attended intheir personal capacity. Conversations were conducted offthe-record to ensure an open and supportive environment.
Building a Cyber Workforce Through the U.S.-Japan Alliance
From Left to Right: Robert Sheldon, Tatsuhiro Tanaka, Kazuo Noguchi, Rika Nakazawa, Benjamin Bartlett, Frank Jannuzi, Joseph Kelly, Juliane Doscher, Simone
Petrella, Tamara Klajn, Kelly Primrose

DIALOGUE PARTICIPANTS
Yu Abe, Deputy, Advocacy & Communications and Talent Development Team, STO, NTT Corporation
Benjamin Bartlett, Assistant Professor, Department of Political Science, Miami University
Chris Demchak, RDML Grace M. Hopper Chair of Cyber Security & member of the Cyber and Innovation
Policy Institute, U.S. Naval War College
Joseph M. Kelly, Professor of the Practice, Applied Research Lab for Intelligence and Security (ARLIS),
University of Maryland
Tamara Klajn, International Security Program Fellow, New America
Rika Nakazawa, Group Vice President, New Ventures & Innovation, NTT
Toshio Nawa, Executive Director and Senior Security Analyst, Cyber Defense Institute, Inc
Kazuo Noguchi, Senior Manager in R&D, Hitachi America, Ltd
Simone Petrella, Founder and CEO, CyberVista
Robert Sheldon, Director, Public Policy & Strategy, CrowdStrike
Major General (retired, JGSDF) Tatsuhiro Tanaka, Research Principal, Fujitsu System Integration
Laboratories LTD
Frank Jannuzi, CEO and President, Mansfield Foundation
Benjamin Self, Vice President, Mansfield Foundation
Juliane Doscher, Program Manager, Mansfield Foundation

ACKNOWLEDGEMENTS
Special thanks to Mansfield Foundation Director of Communications, Tim White, and former Mansfield
Foundation staff, Kelly Primrose, for their contributions to this project.

1415

1156 15th Street, NW Suite 1105
Washington, D.C. 20005
202-347-1994
www.mansfieldfdn.org