Given the close relation of our business to social infrastructure, we are enhancing our business continuity plans (BCPs)
to ensure that the impact of risks does not disrupt ourbusiness and thereby significantly affect society. In
December 2006, we issued the Hitachi Group Guidelines forDeveloping Business Continuity Plans (Overview) inJapanese. In fiscal 2010 this was translated into English andChinese for distribution to all Hitachi Group companies
worldwide to ensure our response readiness for large
disasters and other risks.
When the Great East Japan Earthquake struck in March
2011, our BCPs enabled quick responses and swift decision
making. However, issues emerged, including identification of
secondary and other suppliers, cloud storage andmultiplexing of production information, and the need tosecure alternate transportation and fuel sources. Based on
the lessons learned from this disaster, in October 2011 wereleased and distributed new versions of the Hitachi Group
Guidelines for Developing Business Continuity Plans forindividual departments to further improve our BCPs.
By the end of fiscal 2011, Hitachi Group operations inJapan had completed their preparation and review of BCPs
for both large earthquakes and novel strains of influenza as
appropriate to their operations.
On top of these efforts, Hitachi, Ltd. has held annual
earthquake drills simulating a major seismic event at key
operations in Japan since fiscal 1998. In March 2017,
Hitachi Chemical held drills under the direction of its head
office general manager, with managers at the head officeand the Nabari Works striving to improve their risk
management skills and identify possible areas for improvement in their BCPs.
Hitachi appointed personnel with responsibility for risk
response policies at its main overseas bases in fiscal 2013.
By the end of that year, around 300 companies had
prepared BCPs with the goal of completing them for key
operations. These BCPs are aimed at strengthening ourability to respond to business risks, including large disasters,
novel strains of influenza, political instability, and social
disruption, as well as acts of terrorism. Moving forward, weintend to further expand the scope of our BCPs.

Improving Safety for Employees Sent toDangerous Regions
Responding to the hostage incident in Algeria in January
2013, then President Hiroaki Nakanishi reinforced his policy
in February 2013 of ensuring the safety of employees sent tocountries and areas at higher risk. Survey missions of
in-house and outside experts are now sent beforehand toareas at high risk of war, terrorism, and other threats. Even
after employees are dispatched to such areas, we conduct
additional local surveys every six months as a means ofconfirming the effectiveness of our safety policies. In fiscal
2016, with the threat of terrorism expanding around theworld, we introduced a range of safety measures, including
providing timely alerts to employees. This underscores ourcommitment to ensuring the safety of our employees
working around the globe. Hitachi is also contributing tosafety measures at other Japanese corporations operating
outside Japan. To help enhance collaboration between theprivate and public sectors in this area, Hitachi executives
participated in the Council for Public-Private Cooperation for
Overseas Safety organized by Japan’s Ministry of Foreign
Affairs. Since 2014 Hitachi has taken part in public-private
kidnap incident preparatory training exercises.

Hitachi, Ltd. Integrated Report 2017

Value Creation

Creating BCPs in Key Operations Worldwide

Management & GovernanceStable Provision of Products and Services

CEO Message

We have a deep involvement in social infrastructures inplaces where the suppliers who are our business
partners can be affected by major earthquakes and othernatural disasters.
These disasters can heavily impact not only ourbusiness operations and those of our suppliers but alsosociety as a whole. To minimize this impact, the procurement divisions in business units and key Group companies
in Japan have created procurement BCPs that (1) standardize
and use generic parts to make procurement as flexible aspossible; (2) cultivate multiple suppliers; (3) distributeproduction across several locations; (4) budget inventory
strategically; and (5) consider substitute products. To see
whether or not procurement BCPs would be effective, we
held desktop exercises to discuss in a group what should bedone during and after a disaster, making further improvements as a result.
In fiscal 2016, all major Group business sites withproduction lines (approximately 200 sites in total) took steps
to maintain and strengthen the procurement BCPs they had
created by the previous fiscal year, thereby contributing to
the continuation of Hitachi’s global operations.

Strategic Focus

Creation of Procurement BCPs

The entire Hitachi Group is reinforcing its risk
management system to address increasingly globalized
and complex risks.
Under Hitachi, Ltd.’s head of risk management, eachbusiness operation assigns an executive as its risk
management officer to manage risks mainly concerned withcompliance, export control, disasters, and crime, and torespond adequately in coordination among the entire Group.
Furthermore, Hitachi is building a comprehensive risk
management system that contains standards andprocedures to objectively evaluate different risks that may
affect business.

39

Performance

Reinforcement of Risk Management System

Our Business ModelRisk Management

Promoting Information Security

Basic Approach to Information Security Governance

Implementing Rigorous Information Security
Hitachi’s chief information officer (CIO) is appointed by thecompany’s president and has the authority and responsibility to implement and operate an Information Security
Management System (ISMS). In fiscal 2016, the role of theCIO was performed by Hitachi’s senior vice president andexecutive officer. The Information Security Committee,chaired by the CIO, determines policies and proceduresfor information security and personal information
protection. The Information Security Promotion Council
and other bodies convey decisions internally and to othercompanies in the Hitachi Group. Information security
officers at business sites and companies ensure thatthese decisions are implemented in the workplace.
The Hitachi Group emphasizes two points in information security and personal information protection:(1) Precautionary measures and prompt security
responses
We classify assets to be secured and take safeguarding
measures based on vulnerability and risk analyses. We
also have an emergency manual for security breaches,
based on the assumption that these are inevitable, andnot just possible.
(2) Promoting stronger ethical and security awarenessamong data users
We have prepared a program tailored to Hitachi’s various
personnel levels and are working to raise the prevailingsense of ethics and security awareness throughGroup-wide e-learning. We are also conducting audits toidentify and address problems early on.

Details, including a message from the CIO and alist of third-party assessments and certifications, arecontained in Information Security Report 2016.
Information Security Report 2016
http://www.hitachi.com/csr/download/pdf/securityreport_e.pdf

40

Hitachi, Ltd. Integrated Report 2017

Clearly designate assets to be protected
Evaluate information assets and conduct risk
analysis

Improve user literacy
Supply security
education materials
Educate managers andstaff

Information
assets to beprotected

Implement preventivetechniques
Widely implementadministrative measures
Deploy technologicalprocesses

Establish information security system
Develop rules (security policy)
Create managerial frameworkEstablish audit and follow-up system
Ensure solid feedback through extensive PDCA
cycles for prevention and accident response

Education on Information Security
Consistently maintaining information security requires all
parties to continually develop their knowledge of information handling and to remain strongly aware of the issues.
For this reason, we hold annual e-learning programs on
information security and personal information protection
for all directors, employees, and temporary employees.
Nearly all of the roughly 40,000 employees at
Hitachi, Ltd. participate in these programs. We offer avariety of courses that have different goals and are
tailored to different target audiences, including newemployees, new managers, and information systemadministrators. In 2012, we also began simulation
training to educate employees about the increasing
trend toward malicious targeted e-mail attacks andother cyberattacks. Employees are sent examples oftargeted e-mail to heighten their awareness of security
through direct experience.
Our educational programs, available to HitachiGroup companies in Japan and other global regions,provide Group-wide education on information security
and personal information protection.Global Information Security Management

Hitachi, Ltd. has formulated the Three Principles forPreventing Leakage of Confidential Information to ensure
the highest level of care for such information and toprevent leaks and other related incidents. Our policies
ensure that if an incident does occur, damage is promptly
minimized by contacting customers, reporting togovernment agencies, investigating causes, and acting toprevent any recurrence.
Hitachi Group companies take the following IT steps
to prevent information leaks: using encryption softwareand secure PCs; employing electronic document access
control and expiration processing software; maintaining ID
management and access control by building an authentication infrastructure; and filtering e-mail and visited
websites. In response to the recent spate of targetede-mail attacks and other cyberattacks, we are participating in an initiative to share information between theprivate sector and the government. We are alsoenhancing our IT organization by adding more layers to
our leak prevention procedures, including both entry andexit countermeasures.
To ensure the secure exchange of information with
our suppliers, we review their information securitymeasures based on Hitachi’s own standards before
allowing them access to confidential information. We haveprovided tools to suppliers (procurement partners) for
security education and for checking business informationon computers. In addition, we require suppliers to checkand remove business information from personal
computers to prevent leaks. In the May 2017 global
cyberattack, ransomware that functions like a network
worm affected parts of Hitachi’s in-house system,
temporarily disabling the sending and receipt of e-mails.
No information leaks were detected, however, and there
was no damage to customers or other outside parties
through e-mail sent from the Hitachi Group.

Hitachi Group companies worldwide reinforce theirinformation security in line with our Global Information
Security Administration Rules, which conform to theinternational ISO/IEC 27001 standard. These rules aredistributed from the parent company in Japan to Group
companies around the world. Other security measures
include secure shared services and support from ourregional headquarters in the Americas, Europe, Southeast
Asia, China, and India.

Our Business Model

Preventing Information Leaks

CEO Message

Thorough Information Security Audits
and Inspections

Value Creation

Strategic Focus

The Hitachi Group has developed its approach tosecurity based on the “plan-do-check-act” (PDCA) cycle
for its information security management system. We
conduct annual information security and personal
information protection audits at all Group companies andbusiness units.
The president appoints officers to conduct independent audits. These officers are not allowed to audit theirown units, underlining our commitment to fairness andobjectivity in auditing. There are 222 Hitachi Group
companies in Japan that conduct audits in the same way
as Hitachi, Ltd., and all results are subject to confirmation.
For Hitachi Group companies outside Japan, we use a“common global self-check” approach to ensure
Group-wide auditing and inspections. We implement
Confirmation of Personal Information Protection andInformation Security Management annually for thevoluntary inspection of business unit workplaces. We
conduct monthly Confirmation of Personal Information
Protection and Information Security Management
assessments at 654 operations (as of March 2017) that
handle important personal information. This regularcontrol mechanism ensures ample safety management
and implementation.

Management & GovernanceThree Principles for Preventing Leakage of Confidential
Information
Principle 1 As a general principle nobody can take Confidential
Information out of the Company’s premises.
Principle 2 Any person taking Confidential Information out of theCompany’s premises due to business necessity shallobtain prior approval from the Information AssetsManager.
Principle 3 Any person taking Confidential Information out of theCompany’s premises due to business necessity shallput in place relevant and appropriate measuresagainst information leakage.
Damage Caused by Ransomware, and Status of Recovery

Hitachi, Ltd. Integrated Report 201741

Performance

http://www.hitachi.com/New/cnews/month/2017/05/170517a.pdf