A Business Foundation that Supports Sustainable Growth

Promoting Information Security
Information Security Policies
Connectivity is increasing as internet of things (IoT) technology develops, giving rise to new value. At the same time, increasingly intricate
cyberattacks that previously targeted IT systems are widening their target range to include IoT and operational technology (OT). Managing
information security risks is one of the most critical issues for companies that aim to minimize the risk of business disruption caused by factors
such as leaks of information or operational stoppages.
Under these conditions, Hitachi is expanding its Social Innovation Business while practicing information security governance from thestandpoint that efforts aimed at strengthening cyber security measures are a key management issue in terms of both value creation and riskmanagement.

Information Security Framework

Specific measures aimed at preventing information leaks include PC

Previously at Hitachi, Ltd., the CIO , assumed responsibility for, andencryption, access control and ID management through theauthority over, the implementation and application of information

establishment of an authentication infrastructure and the creation ofsecurity and personal privacy protection measures. The CIO was also

multi-layered (entrance and exit) cyberattack defense measures.

*1

responsible for the formulation of information tactics in line withmanagement strategies, as well as IT investment policy. However, we

We also review and investigate the information security status ofsuppliers based on our internal standards.

appointed a new CISO*2 in October 2017 in an effort to strengthen andconsolidate information security governance throughout the Hitachi

Protecting Personal Information

Group. The CISO promotes information security for all of Hitachi’s

Hitachi, Ltd., has established a personal information protection

products and internal facilities. The CISO also serves as chairperson ofmanagement system based on its own Personal Information

the Information Security Committee, which determines policies andProtection Policy. Furthermore, Hitachi, Ltd. and 42 other Hitachimeasures related to information security and informs all Hitachi Group

Group companies* in Japan have received Privacy Mark accreditation

business sites and companies. Subsequently, these policies andand are working to safeguard personal information.

measures are implemented in the workplace by information security

As shown by the EU’s enforcement of the General Data Protectionofficers.

Regulation (GDPR) in May 2018, consumer privacy laws and*1 CIO: Chief information officer*2 CISO: Chief information security officer

regulations are evolving on a global basis. Hitachi’s GDPR initiatives
include identifying which operations are impacted by GDPR, evaluating
risks, implementing safety management in response to these risks andInformation Security Management

providing relevant training to all employees.

Information Security Management*As of March 31, 2019

We have established Global Information Security Administration Rules
that conform to the international ISO/IEC 27001 standard and areglobally promoting an ongoing information security management

Information Security Audits

system to strengthen our information security management.

Information security audits are independently carried out by thePreviously, these relevant policies had been distributed from the parent

information security chief auditor, who is appointed by the president

company in Japan to Group companies worldwide. However, starting

and CEO of Hitachi, Ltd. Hitachi Group companies in Japan conduct

in fiscal 2019, we have begun to further augment our security globally

audits in the same way as Hitachi, Ltd., which reviews all results. For

by stationing information security experts in the Americas, Europe,Hitachi Group companies outside Japan, we use a “common global

Southeast Asia and China.

self-check” approach. These audits and self-checks are conductedannually at all departments and Group companies.

Security Monitoring
At Hitachi, the SOC*1 monitors security 24/7, so cyberattacks can be

Information Security Education

detected and countermeasures initiated right away. The CSIRT*2Hitachi holds annual e-learning programs concerning informationcollects and develops security-related data and manages response tosecurity and personal information protection for all directors,

any security incidents.

employees and temporary employees. We also offer varied educational*1 SOC: Security Operation Center*2 CSIRT: Computer Security Incident Response Teamcourses on information security with different goals tailored to specifictarget audiences. In 2012, we began simulation training to educate

Preventing Leaks of Confidential Information

employees about e-mail phishing and other targeted malicious

Hitachi, Ltd., pays careful attention to the handling of confidential

cyberattacks.

information to prevent leaks and other related incidents.

68

Hitachi Integrated Report 2019

Fostering a Security Ecosystem aimed at Raising Cyber Security Resilience
Fostering a Security Ecosystem as a New Security Strategy
Recently, cyberattack techniques are becoming more sophisticated than ever before. Cyberattacks are also increasing in number and their range of targets
is steadily expanding. Hitachi has launched a new strategy for responding these threats. This strategy involves the construction of a security ecosystem.
The word “ecosystem” describes a state in which plants, animals and the environments in which they live depend on each other to maintainand preserve their own ecologies. As we applied this way of thinking to security, we came to the conclusion that mutual cooperation between
departments, even if their operations do not appear to be related, with the common goal of conducting security activities will ultimately enable
the maintenance and expansion of business activities throughout all of our organizations.

"Connection" [ Tsu-Na-Ga-Ru] within the Security Ecosystem
1. Between Things
In Japan, Society 5.0*1 has been established as an ideal future society for which we should all aim. Once attained, this society will create newvalue and resolve social issues through a variety of connections. To make Society 5.0 and these connections a reality, our environment will
become one in which things such as devices and systems connect with each other, as represented by the IoT.
In May 2017, Hitachi was infected by WannaCry ransomware*2. This infection was the result of testing equipment that was not maintainedwith an “awareness regarding the necessity of security countermeasures” and had an impact on all Hitachi locations worldwide. Although we
had already been applying security countermeasures to internal IT environments, this incident taught us about the additional need for security
countermeasures in production and manufacturing areas that had previously been insular.
Under these conditions, Hitachi has launched comprehensive global cybersecurity countermeasures (formulated principles and guidelines
specific to each environment, etc.) that will cover all types of environments as a wide range of things develop interconnectivity.
2. Between People and Organizations
Moving forward, all corporate business units must mutually cooperate to connect things that had previously been separate while also ensuring
security. To support this goal, we are regulating adherence to countermeasures and are holding seminars and workshops targeting communicationthat transcends organizational and positional barriers. These efforts help us promote activities that connect people and organizations by reignitingawareness regarding individual roles and intensifying cooperation between employees working in the same environments.
3. Within Society
These connections will not be confined to Hitachi. We believe in theFoster a security ecosystem throughout society

necessity of forming communities in which industry, academia andgovernment working to promote cybersecurity transcend established

Within companies andacross industries

frameworks to share important data, such as information regarding

Foster a security ecosystemthat encompasses all ofsociety

Graduate schools,universities, technicalschools, etc.

threats and issues faced when implementing countermeasures.
Accordingly, Hitachi has proactively launched activities aimed at

Industry

Academia

relating society. Examples of these activities include companies andorganizations applying the expertise they acquire from theaforementioned communities to their own security management
cycles and further expansion of data sharing.

Government

Aiming to Raise Security Resilience throughout Society
In pursuit of Society 5.0 and to raise cybersecurity resilience*3, Hitachi

Ministries and agencies, ISAC and CSIRT communities, etc.

will promote to foster a security ecosystem that encompasses society in
its entirety, enabling people to live more safely and securely. We will
construct this ecosystem through cooperation within the corporate
world, as well as collaboration with industry, academia and government.

Aiming to raise cybersecurity resilience*1 Society 5.0: According to the Cabinet Office website, Society 5.0 is a society centered on people that simultaneously supports economic development and the resolution of social issues through the high-level merging of cyber space (virtual space) with the real world (real space).
*2 Ransomware: A type of computer virus that places certain limits on computer systems following infection and demands monetary or other compensation in exchange for their removal*3 Resilience: The ability of organizations to adapt to complex and changing environments (from JIS Q 22300, an industrial standard released by the Japanese Standards Association)69