Information Security Report 2022

Hitachi GroupINDEXCISO Interview・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・1
Hitachi's Approach to Information Security ・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・4
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・6
Information Security Management・Information Security Management Systems・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 6
Initiatives for Security Human Resource Development・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 12
Action to Strengthen Global Information Security ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 14
Action to Strengthen Information Security in M&A・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 16

Cybersecurity Initiatives ・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 18
Cybersecurity Management・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 18
Cybersecurity Countermeasures・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 24
CSIRT Activity in the Hitachi Group・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 26

Initiatives for Data Protection ・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 30
Initiatives for Personal Information Protection・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 30
Privacy Protection Initiatives・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 36

Internal and External Activity Related to Information Security・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 38
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 40
Working to Raise Information Security Awareness・

COLUMN

Product Security Technologies to Protect Clients' Businesses・
・
・
・ 42

・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・44
Third-Party Evaluation and Certification・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・ 47
Overview of the Hitachi Group ・Summary of this report:●Scope and time period covered by this report: Hitachi Group information security initiatives up to and including FY 2021
●Report publication date: October 2022

CISO Interview“One Hitachi” Initiatives for Swift and Flexible Information
Security Response— Recently we've seen many news reports ofadvanced countermeasures on a daily basis? Whenransomware attacks on companies,

we consider the current state of security, we need tomunicipal systems, and hospitals. What's

be aware that the same could happen to us.

your view of this situation? And what is mostimportant for people involved in security as
they develop countermeasures?

— What impact do attacks targetingvulnerabilities in products or services haveon the progress of the Lumada business?

Ransomware attacks have been getting
increasingly sophisticated and diverse in the last year.

We expect the kind of attacks targeting products

Everyone is at risk of attack from anywhere in theand services which are happening now to occur inworld, and companies' overstretched supply chains

more diverse cases, as we greatly expand andare the starting points for attacks in growing numbers

advance our data usage and collaborative creationof cases. What's more, the current tense international

business through our Lumada business. For any

situation appears to be accelerating the frequency ofclient, there's one-time business, but there are also

attacks.

ser vices that can continue to provide solutions.

When developing countermeasures, it's important

Hitachi must build solid frameworks for extent of ourto have an overview of information security within its

responsibility for the characteristics of each business.

context of international conditions and historical

What we already do is that if we find some level ofbackground. Why is Japan under cyber attack, andvulnerability, we contact the client concerned andwhy is Hitachi a target? I think that finding the facts ofhave them tackle the problem, or tackle it for them.

an attack and countering it require recognition that

For the solutions and software we provide to our

Hitachi, as a company, bears an important social roleclients, we are aware that the question of the rightthat goes beyond the business of a single enterprise.
There was a case a few days ago in which a cyberat tack on a supplier to one of Japan's leading
manufacturers caused a system failure that forced allth e c o m p a ny's f a c to r i e s i n J a p a n to s u s p e n doperations. What was the causal factor that invited
such a severe situation, despite the implementation of

Hitachi, Ltd.
Vice President and Executive Officer, CTrO/CISO

Masashi Murayama
Mr. Murayama joined Hitachi in 1985. Drawing on his experienceas the leader of the Project Management Promotion Office
Smart Transformation Project Initiatives Division, beginning in
2016, Murayama drove strategic and structural reform as CPO
and general manager of Value Chain Integration. Appointed torole of Managing Executive Officer in 2019 and CISO in 2020.

1CISO Interview“One Hitachi” Initiatives for Swift and Flexible Information
Security Response

form in which to maintain information security is a major

and things to observe in national ranges.

issue for Hitachi as a company, from the perspective ofsocial responsibility.

— What is most important as the core of security
management, in the context of increasingly— Information leaks can occur as a result of
human-factor risks, rather than cyber attacks,

wide-ranging and complex cyber attacks andthe trends in data protection regulation?

so what kind of response is required?
It's important to start from the premise that risks will
The two types of human risks are due to malice oralways emerge and security will inevitably be broken

i n a d ve r te n t e r ro r s. M a l i c i o u s r i s k s c a n o n l y b e

down. So rather than just pursue robustness, we needcountered by thorough ethical education to raise eachto decide in advance how to respond when we getperson's awareness. As for inadvertent errors, I believe

attacked, and establish security that's able to respond

it is the responsibilit y of the company to provide

flexibly to diverse risks.

systems which absolutely minimize the potential for

In Sumo, wrestlers of small stature employ an array oferrors, because human beings do make mistakes. The

techniques to take on the biggest opponents, androle of the company is to provide secure PCs, build safe

sometimes they win. I think the same is true of security

network environments, and otherwise develop places

management. If they run headlong into huge risks, they

where employees can work with safety and peace ofwill just get knocked away. We have to respond with themind.

idea of flexibility to overcome rigidity, thinking carefully

The culture of shame is deeply rooted in Japanese

about how to avoid getting knocked away, and having

companies, but there is no place for shame about

scenarios for attacks from the side, or from above, or

security. Building an open corporate culture—so that iffrom below. Security with flexibility can use that sinuous

your own PC causes a problem, you can repor t itstrength to take down powerful risks. If we prepare andimmediately—limits the spread of damage.

refine various response methods for risks, and thenpractice every day, as if they were fire drills, we will be— While many diverse factors are raising risks ofable to gauge the situation swif tly and respond.

information leaks, what is your view of theFirefighters envisage all kinds of situations that could

European GDPR*1 and the global movement tohappen at the site of a fire, and they practice for them

reinforce data protection regulations?

repeatedly, so they can make quicker decisions in an
emergency. Alongside flexibility, that swift action is a key

The perspective of compliance is indispensable whenpoint to minimize the damage caused by a risk.

we consider the impact of cyber attacks on companies
and society. When we consider the fact that data isinterlinked beyond nations and regions, the Hitachi— What does an organization need to do to act
faster?

Group as a whole must think about how to respond2

g l o b a l l y. F o r ex a m p l e, t h e r e a r e H i t a c h i G r o u pUnder a global system, in particular, the key point iscompanies in countries and regions around the world,

how quickly information is shared in the first stage after

but if each company has its own different interpretation

an incident occurs. Just as initial response is vital whenof the GDPR, it becomes meaningless. Therefore, if thea fire breaks out, when the Hitachi Group is hit with an

Hitachi Group clarifies its unified interpretation and holds

incident somewhere in the world, contacts must go out

common policies for handling it, and then places

immediately, to share the situation and put a stop to thespecialist teams in each region, we can get checked byr i s k q u i c k l y. B u t i n a c o n v e n t i o n a l p y r a m i d a lnative staff with regional specializations. In short, weorganization, information sharing is like a bucket relay inmust consider how to handle the laws of each country

a sense, so it's hard for water to move up, and theand region in three broad layers: things to observe atvolume dwindles as it does, with speed dropping as

the global level, things to observe in regional ranges,

well. We need information to move swiftly, straightt h r o u g h f r o m t h e s i te o f t h e i n c i d e n t u p to to pthings like properly applying patches, using multifactor

management, within an organizational structure that's

authentication, changing passwords regularly, anda s fl at a s p o s s i b l e. A n oth e r th i n g we n e e d i s toincorporating biometric authentication.

strengthen lateral connections for information sharing
within regional units. That means, for example, if an— What future course of action and decisions do

incident occurs in a country in Europe, information can

you see for Hitachi Group's security strategy?

be shared rapidly among Group companies in Europe.
We have placed ISEs* 2 in our sites in the Americas,

The Hitachi Group is a corporate group consisting ofEurope, China, India, and elsewhere in Asia, and I wantnumerous companies, but going forward we'll be doing

to expand them on the basis of their functions. We've

business as a single company, under “One Hitachi”. In

still got a long way to go, but I want to accelerateline with that business policy, I think the most important

information sharing in the two directions of a “verticalthing is for us to tackle information security as “Oneaxis” that starts from headquarters, and a “horizontal

Hitachi”. I want to accelerate the construction of idealaxis” that starts in regional sites.

security by setting policies for Hitachi as a whole, withthorough validation of sharing and speed based on— What is the position of information security
wit hin t he Hit ac hi G rou p's 2 0 24 Mid-term

common measures, rather than each company acting
on its own.

Management Plan?
The 2024 Mid-term Management Plan newly adds ourstance of “supporting people and society with data andtechnology to achieve a sustainable society”. We must
consider security management based on the current
situation of fading barriers between inside and outside
the company. There's a mountain of challenges, such as
how to strengthen security for products and services
and how to enhance the security of entire supply chains,
and we'll go on tackling them head on.
Cyber attacks and other information leakage risks,
due to malice or error, could happen anywhere in theworld. That's why we must basically prepare ourselves
to respond to whatever happens, detect the problem asquickly as possible, and then apply analysis andmeasures ever y time to prevent recurrence. Also,
measures in a single company won't be sufficient, so it's
important to extend them laterally to other companies.
The places we can't see are the most dangerous forthis kind of information security risk. There are some
aspects, including supply chains, where it's difficult toapply security at exactly the same level, but we as
Hitachi must carry on asking our external partners to do※1 GDPR：General Data Protection Regulation※2 ISE：Information Security Expert
Lumada is a trademark or registered trademark of Hitachi, Ltd.
in Japan and other countries.

3

Hitachi's Approach to Information Security
The advance of digitalization generates new value, but there is the growing risk that increasingly
sophisticated cyber attacks could impede the continuation of business, through threats such as
information leaks and shutdowns. Minimizing that risk through risk management around information
security is one of a company's most important tasks.
Given that background, Hitachi, aiming to become a global leader with our social innovation business,positions cybersecurity measures to address the value creation and risk management aspects as a key
management issue, as we work on information security.

Promoting information security as risk management
The rapid advance of digitalization and the complex
global changes in political and economic conditions arechanging the business environment on a daily basis.
Hitachi monitors and analyzes this business environment
and practices risk management to address the aspectsof th e r i s ks H i tac h i s h o u l d b e re ad y fo r a n d th eopportunities we should seize, based on social issues,
our competitive advantages, management resources,and other considerations. We aim to create profit
opportunities while controlling risks.
R e c e nt cy b e r at tac ks a re g a i n i n g i n l eve l a n dsophistication, and their scope is widening, to coverproduction and manufacturing environments anddevelopment environments, which are OT fields, as wellas the usual internal IT systems. There are also attacks
targeting the products and ser vices we provide toc u s to m e r s, a n d o u r s u p p l y c h a i n s. A s a r e s u l t,
everywhere around the world is increasingly likely to be
attacked, and many incidents have major repercussions
on business continuity, including information leakage
and factor y shutdowns. Data protection laws, as
exemplified by China's set of three cybersecurity anddata laws, are being reinforced around the world, anddata leaks due to cyber attacks are a rising risk from theperspective of a company's legal compliance. Given thisbackground, Hitachi recognizes information security as amajor risk, and handles countermeasures aggressively
as a management issue.

Hitachi's Information Security Vision
In digital society, while the enormous amount ofdiverse data creates value, there are also major threats
to safety and security. In addition, with the recent
C OV I D -19 p a n d e m i c, wo r k s t y l e s h ave c h a n g e ddramatically, such as with the promotion of working from
home, and the future form of security must also change
dramatically. Targeted attacks are becoming moresophisticated and diverse than ever, and existing attack

Figure 1‐❶

Hitachi's Information Security Vision

GovernanceContinue and steadily implement security measures that have positioned cyber security as a management issues. There isno such an absolute security, thus we must build resilience to enable capability of recovery quickly in the case of
emergency-state. (for securing business continuity)

Co-Creating
Security

To protect us against the evolving and increasing cyber attacks, expanding internal communication and building
security ecosystem together across the entire society

Jibungoto

Each employee acquire correct understanding of security and empathize the importance, and foster the mindset,
Jibungoto, to take an action as own matter.

Improve the security resilience4

methods are now being used in combination, forexample, using ransomware threats to steal information.
In such a situation, Hitachi is now promoting various
efforts to improve cyber resilience, based on the three
approaches of “Governance,” “Co-Creating Security,”and “Jibungoto(Ownership),” for a “next normal” society.
(Figure 1‐❶)

Acquire adaptability / flexibility
Cyber resistanceHitachi Group will implement security measures
ste ad i l y a n d c o nti n u o u s l y to c o u nte r th e ti d e ofincreasingly advanced and complex cyber attacks. As
part of that effort, we have started applying zero-trust
security measures as we move our IT platforms to thecloud, as an IT infrastructure countermeasure. Given thetrend toward cloud-based work systems and workstylereform, we are aiming for optimal security that uses a
h y b r i d o f c l o u d—w h i c h w i l l b e t h e m a i n s t r e a marchitecture going forward—as the foundation, and ourconventional perimeter-t ype systems. In realizingz e r o -t r u s t s e c u r i t y, w i t h t h e s e c l o u d - b a s e d I T
architectures as the standard, we are promoting
au the ntic ation, e ndpoints, a nd cy b e r inte grate dmonitoring as key components.

■ Jibungoto: security awareness-raising initiatives■ Co-creating Security: work on building a security
ecosystem
Responses to security incidents require cooperation
between all departments, including PR, personnel, andlegal affairs, not just the IT department. As the range ofmatters addressed by security measures broadens, theMonozukuri Group, Quality Assurance Department,
Procurement Department, and other departments mustalso collaborate well to ensure full functionality. Hitachisees this kind of security ecosystem as vitally important,and is working to build it.
Our approach is that the elements of this ecosystem
structure: “things,” “people and organizations,” and“society,” must be connected.
DX requires an environment in which things likedevices and systems, exemplified by IoT, are connected.

Figure 1‐❷

To maintain security in a world where connections areb e in g m ad e b et we e n th in g s th at u ntil n ow we reunconnected, we are building a system of connected
people and organizations to promote countermeasuresin which dif ferent organizations work together topromote security measures.
Connections are not just needed within Hitachi. It is
now essential to share threat information and issues
encountered when implementing countermeasures withenterprises, governments, academia, and other entities
e n g a g e d i n c y b e r s e c u r i t y i n i ti ati ve s to c re ate acommunity not bound by traditional constraints. Hitachi
encourages each enterprise and organization to feedback the knowledge it gains from the community into its
own security measures, creating further connections insociety. (Figure 1‐❷)

We estimate that vulnerabilities in security awarenesswill be targeted, as employees have been working fromhome due to the recent COVID-19 pandemic. Working
outside the office in an unfamiliar environment can lower
their defenses, and with nobody around to act as a voiceof reason, risk is ever present.
This means that improving each employee's security
awareness will be the last defense. In addition to ourexisting strict governance, we have started activities toraise security awareness by encouraging employees totake the initiative and act independently. This does notmean making security feel like an obligation. Rather, ourgoal is to get employees interested in the issues, havethem share our commitment from the heart, and take
“Jibungoto (ownership)” of security.

Hitachi's Approach to Information Security■ Governance: zero trust security initiative

Illustration of the security ecosystem

Industry
People andorganizations

Government
People andorganizations
Goods

Academia
People andorganizations
Goods

Goods
IoT
IoT

IoT

Society5

Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Information Security Management Systems
Hitachi sets information security policies, establishes various rules and promotion frameworks based onthese policies, and works on information security management in order to protect the information
assets to be protected. Those assets include information entrusted to us by customers, the systems
which store such information, and the information systems that run social infrastructure services.

Information security policy
As an organization that contributes to Japan's
reputation on the global stage, Hitachi acknowledges
that security risks are business risks, and makes every
ef for t to ensure information security by defining asecurity policy that meshes with the wider management
policy of the enterprise.
(1) Formulating administrative rules for information
security and ensuring their continual improvement
Hitachi acknowledges that information security
initiatives are a key issue for management and business
operations, and will formulate administrative rules for
information security that comply with the law and otherregulations. Hitachi will also establish a company-wide
information security management framework with
Hitachi, Ltd. executives at its core, and ensure its
enforcement. Hitachi will maintain information security
from organizational, personal, physical, and technicalperspectives, and ensure its continuous improvement.
(2) Protection and ongoing management of
information assets
Hitachi implements safe management measures thatappropriately protect information assets from threats totheir confidentiality, integrity, and availability. Hitachi also
implements appropriate control measures to ensurebusiness continuation.

(3) Legal and regulatory compliance
Hitachi complies with laws and other regulations
re l ate d to i nfo r m ati o n s e c u r i t y, a n d e n s u re s i ts
administrative rules for information security conform tothese laws and regulations. In the event of a legal or
regulator y violation, Hitachi takes the appropriate
punitive action as defined in the employee work rules
and other relevant policies.
(4) Education and training
H i t a c h i a i m s to i m p r ove i n fo r m a t i o n s e c u r i t yawareness among its executives and workers andconduct education and training in relation to information
security.
(5) Preventing incidents and taking action when
they occur
Hitachi endeavors to prevent information security
incidents, and if such an incident were to occur, to takeappropriate action without delay including preventing its
recurrence.
(6) Ensuring business processes are optimized
within the corporate group
According to (1) to (5), Hitachi will endeavor to build
frameworks that ensure proper business processes
within the corporate group consisting of Hitachi and
Hitachi Group companies.

Information security promotion framework
Within the Hitachi Group, Hitachi, Ltd. HQ (corporate)
is responsible for governance of the group as a whole.
Governance is instituted by way of instructions passed
down through lines of control to each Hitachi, Ltd.
business unit (hereinafter BU and office and to eachGroup company. Governance of the Hitachi Group as awhole is achieved by each BU and Group company
applying the same controls to the Group companies(subsidiaries) that they manage.This framework applies
not only within Japan but also overseas.
The company president nominates a chief information

6

security officer who has authority and responsibility inrelation to information security, and an informations e c u r i t y a u d i t o f fi c e r w h o h a s a u t h o r i t y a n d
responsibility in relation to information security audits.
The chief information security officer establishes aninformation security committee which guides policy
regarding information security, personal information
p rote c ti o n p o l i c i e s, tr a i n i n g p l a n s, a n d va r i o u smeasures.
The matters decided by the information security
committee are disseminated to each organization

through information security promotion meetings
attended by representatives of all BUs and offices.
In principle, the head of the BU and the of ficemanager serve as the information security officer of the
BU and office. Information security officers appoint
Information Security Execution Officer and Personal
data Protection Manager to support implementation, inorder to manage and control personal information

Figure 2‐❶protection and information security.
A n info r m atio n a s set m a n ag e r is p l ac e d in a ll
divisions, and allocates responsibilities in relation to thehandling of information assets including personal
information.
Similar organizations are established in Group
companies which act to promote information security
through cooperation. (Figure 2‐❶)

HQ (corporate)

BU

BU

Group company

Group company

Group company

Group company

Group company

Group company

Hitachi, Ltd.
CEO

Chief information security officer (CISO*)

Information security audit officer

Internal Control

Hitachi, Ltd.

Information Security Management

Information security promotion framework

Company president
Information security officer

Information security committee

Audit officer

Chairperson (and CISO)
Information security education director
Committee members: Representatives of businessoffices and heads of HQ management divisions
Information security promotion meeting

BU
OfficeInformation security officer

Chief information security audit officer

Information Security Manager
Personal data Protection Manager
Information security promotion division
External liaison division
Cybersecurity officer
Information systems manager
Information asset manager*CISO: Chief Information Security Officer

7

Governance

Co-Creating Securuty

Jibungoto

Information Security Management

System of rules for information security
Hitachi has established the rules in the following tablebased on its information security policies. (Figure 2‐❷)
Group companies have established similar regulations
to promote information security.
■ Basic regulations“Information Security Management Rules” define thebasic matters that must be complied with in relation to
the formulation, implementation, maintenance, andongoing improvement of information security
management systems.
We promote our cybersecurity measures worldwide
according to our information security countermeasure
standards, which comply with US government standard
SP800.
In 2021, we enacted the Hitachi Group Privacy
Principles as a common code of conduct for personal
information protection throughout the Hitachi Group.

Furthermore, in our “Personal information protection
policy” and “Regulations for Personal Information
Management,” we have set rules equivalent to the JIS
standard (JIS Q 15001) in order to manage personali n f o r m a t i o n a t a h i g h e r l e v e l t h a n t h e Pe r s o n a lInformation Protection Law.
“Regulations for Confidential Information Management”
d e fi n e th e h a n d l i n g p ro c e d u re s u s e d to p rote c t
confidential information.
■ Individual regulations
The “Rules on website creation and information
disclosure” define the matters that must be compliedwith in order to disclose and use information correctly on
websites.
The “Rules for the Management of Entry/Exit andRestricted reas” define measures to maintain physicalsecurity, such as rules governing building access.

Information security management cycle
We have built a framework to run PDCA
(Plan-Do-Check-Action) cycles in our information
security management as a whole, including personal
information management. This framework defines
information security management cycles which runt h r o u g h t h e s t a g e s of “ P l a n”, s e t t i n g r u l e s a n dmeasures, “Do”, which implements measures, “Check”,
which monitors and assesses, and “Action”, whichmakes ongoing improvements.

Figure 2‐❷

In the “Plan” stage, we set information security
policies and measures, plan information securit y
education, and formulate audit plans for personal
information protection and information security.
In the “Do” stage, we deploy security measures within
the company and operate them. We are working toensure thorough knowledge of security measures andraise each employee's awareness through information
security education and awareness activities.

Information Security・Regulations related to personal information protection

Category

Figure 2‐❸

PDCA image diagram

Name of regulation
Information Security Management Rules
Hitachi Group Information Security Policy
Information Security Standards

Basicregulations

Hitachi Group Privacy Principles
Personal Information Protection Policy

Formulating policies and measures
Proposing education plans andaudit plans
Extending and operating measures
Implementing educational andpublicity activities

Regulations for Personal Information Management
Regulations for Confidential Information Management
Rules on website creation and information disclosure
Individual
regulations

Rules for the Management of Entry / Exit and Restricted Areas
Criteria for consignment of personal information handling

8

Implementing corrective
measures
Inspecting operational status
Implementing audits andfield surveys

In the “Check” stage, periodic security operation
status inspections, audits according to the audit plan,a n d o n-s i te i n s p e c ti o n s by s e c u r i t y ex p e r ts a reconducted.

The “Action” stage takes corrective action based on
the results of audits, on-site investigations, etc. (Figure
2‐❸)

Figure 2‐❹

Hitachi, Ltd., makes its educational content available
to Group companies inside and outside Japan, andwo r ks towa rd s d e e p e n i n g th e u n d e r s t a n d i n g ofinformation security and personal information protectionof the Hitachi Group as a whole.
■ Drill-based training for spear phishing email
attacks
Cyberattacks based on spear phishing emails are adaily occurrence. Every employee must be trained in how
to respond appropriately when targeted by such an attack.
We have implemented training on targeted attack
emails for all employees including group companies, andfrom FY 2020 we have expanded these efforts globallyand have started training our local subsidiaries. Thesedrills involve sending emails that approximate those sentby actual spear phishing attackers, giving employees
insight into the nature of such emails and how to
respond if they receive one. This practical approach toeducation enhances the ability of Hitachi employees to
respond appropriately in the event of a real attack.

Internal Control■ Information security training
An organization's ability to maintain informations e c u r i t y a n d p r o te c t p e r s o n a l a n d c o n fi d e n t i a linformation depends on its workers understanding theimportance of information security and making it part oftheir personal ethos as they go about their daily tasks.
Hitachi conducts annual training by e-learning of all
executives, workers, and temporary employees on thesubjects of information security and personal information
protection. Approximately 35,000 employees and otherworkers of Hitachi, Ltd., receive this training each year,
and at te ndance has re ached 10 0%. Hitachi also
formulates an annual information security training plan,and implements it using a diverse range of education
programs tailored to specific subjects and purposes. For
example, one program might target specific group ofpeople like newly hired employees and another those in
new managerial. (Figure 2‐❹)
positions, while another might of fer specialized
e d u c a t i o n to p e o p l e i n r o l e s s u c h a s p e r s o n a linformation protection manager.

Information Security Management

Educating workers on information security

Information security training target personnel and content

Category

Target audience

All staff education

・All employees
・Temporary employees
・Employees on secondment

The importance of personal information protection and confidential information
management, and the latest trends in information security

Executives and managers

Trends in personal information protection and the latest Hitachi initiatives

Newly-appointed section
manager or equivalent

Knowledge someone in a management position must possess in relation topersonal information protection, confidential information management, andinformation security, and Hitachi's initiatives in relation to personal information protection.

Newly-appointed assistantmanager or equivalent

Personal information protection, confidential information management, information security knowledge
necessary as a manager or equivalent, and Hitachi's efforts to protect personal information

New employees

The fundamentals of personal information protection, confidential information
management, and information security.

People responsible forprotecting personal information

Practical exercises and the specialized knowledge a person responsible forprotecting personal information must possess, such as internal and management
rules and real-world operating procedures.

Information asset manager

Knowledge required for an information asset manager to carry out their role asa manager of information assets including personal information in their division.

Tiered education

Specialized
education

Description

9Governance

Co-Creating Securuty

Jibungoto

Information Security Management

Management assessment and monitoring
Hitachi conducts regular audits and on-sitea s s e s s m e n t s to e v a l u a te a n d m o n i to r w h e t h e r
information security measures are being implemented
appropriately.

■ Personal information protection and information
security audit
Hitachi, Ltd., and all Group companies within Japan
conduct an annual audit of their personal information
protection and information security status. The audit ofHitachi, Ltd., is carried out by independent auditors
a p p o i n te d b y t h e C E O. To e n s u r e f a i r n e s s a n d
objectivity, the audit process is mutual audit.
Personal information protection and information
security audits confirm the following items.
Information security regulations, management of
information assets, and conformity of information
security measures
Personal information protection and conformity
between JIS Q 15001 and the personal information
management system
Conformity status of personal information protection
management system and JIS Q 15001
All Group companies in Japan undergo the same
audits as Hitachi, and Hitachi confirms the results.
■ On-site risk assessment
With an ever-expanding global presence, the Hitachi

Figure 2‐❺

Group makes its home in many countries and regions,counting headquarters, sales offices, service centers,
and manufacturing sites among its business entities.
T his e nvironme nt inevitably give s rise to dive rse
in-Group network environments and facilities and varied
installation and usage environments for IT equipment
and cloud environments, etc. There is alsoc o mmu nic atio n w i th ou ts id e pa r ti e s v ia inte r n etconnections, information storage media (USB storage),and other means. Preparing for security risks such as
spear phishing and malware infection is very important.
To address the risk that comes with changes to thebusiness environment, Hitachi has strengthened its
assessment framework that uses expert security teams.
Specifically, a security team will visit the workplace of a
BU or Group company and implement enhancementsfrom the following perspectives:(1) Carry out assessments of all products and internal
facilities that connect to the network of the HitachiGroup based on the latest security trends.
(2) Identify issues that might present a security risk andpropose effective countermeasures on site. (Figure 2‐❺)Since FY 2017, we have assessed a total of around
120 sites, identified a large number of security risks, andgiven advice on necessary measures. We also takefeedback from the problems that we encounter acrossthe company and incorporate it into the measures.

On-site risk assessment flow

Operational status(Surveys, standards,records)
Status report
On-siteWrittenreportCheck
list
Assessor
Summarization ofperspectives

Site check
Office10

Improvement

Countermeasures,
recommendations

Information Security Management■ Vulnerability check on public servers
Cyber attacks in recent years have found vulnerable
servers which are open to the internet and exploitedthem as entr y points to access internal networks,

leading to ransomware and other malware infections,and to thefts of personal and confidential information.
We regularly perform vulnerability checks on theservers that exposed to public using vulnerability searchsites such as Shodan.
We're working to reduce security risks by checking forany gaps compared to self checks run by the server
administrator.

Internal Control

The outlook is for the impact of COVID-19 to fade in
FY 2022, so we started to visits and on-site assessmentsof overseas Group companies, which are thought tohave relatively high securit y risks, and makeassessments.
Fro m F Y 2022 we a l s o sta r te d a s s e s s m e nt ofcompanies acquired through M& A. We will grasps e c u r i t y r i s k s a n d m a ke s u g g e s t i o n s to e n a b l e
countermeasures earliest possible.

11Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Initiatives for Security Human Resource Development
To ensure the effective implementation of security measures in the products and services provided tocustomers, the Hitachi Group promotes company-wide human resource development from a security
perspective.

Our Approach to Security Human-Resources Education
In response to the intensification of cyberattacks inrecent years, the Hitachi Group has promoted humanresource development from a security perspective toensure the security of the products and services it
provides to its customers. You can see the three
categories of human resource development on the right.
This initiative targets not only high-level security experts,
but also the technicians involved in the development
and operation of products and services and the users of
in-house IT services. (Figure 2‐❻)

• Security experts who possess considerable security
skill and shoulder the security burden of the HitachiGroup• Human resources responsible for security measures inrelation to the design, development, and operation of
products and services provided to customers, and thatof production and manufacturing sites• Basic human resources who understand thefundamentals of security and can respond appropriately
when a security incident occurs

Educational programs for each category of human resources
We are developing educational programs tailored tothree categories of human resources, and effectively
promoting human resource education according to theobjectives of each category.

■ Security expert
The approach to human resource development for
security experts includes high-level training techniquessuch as cyber range exercises, and the provision ofcommunity sites that support information sharing and

Figure 2‐❻

Three security HR categories and training measures

Category of human resource

Attributes

Training approaches

Human resources whose duties revolvearound security, who have a high skill
level in relation to security, and whoshoulder the burden of Hitachi's security

・Provision of specialized training suchas cyber range exercises
・Security specialist certification

Human resources responsible
for security measures of
products and services

Human resources who can implement theappropriate security measures in thedesign, development, operation,
manufacturing, and production
environments for products and services

・Provision of training related to security
measures associated with their work
・Visualization of training status

Basic human resources

Human resources who understand thefundamentals of security and are capableof an appropriate initial response when asecurity incident occurs

・Provision of basic security course andentry-level training for cyberattacks

Security
expertSkill level

Size of each category

12

cooperation. Hitachi established its Hitachi Certified IT
Professional framework for security experts in August of
2014. T his ce r tific ation f ra mewor k for Hitachi IT
profe ssionals conforms to the IPSJ Model for IT
Professional Certification. Under this certification model,
information security specialists (HISSP: Hitachi Certified
Information Security Specialist) who have the necessary
security skills and are on the appropriate career path arediscovered, trained, and evaluated. Hitachi has now
certified more than 1,300 such experts.

Figure 2‐❼■ Basic human resources
The development of basic human resources targets
many people with the objective of raising the security
awareness of the company as a whole and enhancing
its security countermeasures. In addition to imparting
fundamental security knowledge, this initiative ingrains
the appropriate initial response when a cyberattack orother security incident occurs. Training for basic humanresources includes the Basic Knowledge e-learning
Program for Cybersecurity Countermeasures and theCommunication Training for Cybersecurity Response
provided since FY 2016 and taken by more than 6,000
people. Hitachi also provides e-Learning programs on
security fundamentals for people who require
introductory training. The societal changes brought
about by COVID-19 mean that group training is now
carried out online. The Communication Training for
Cybersecurit y Response of fered to basic humanresources in a workshop format has also moved online
since FY 2020. (Figure 2‐❼)

Information Security Management

key PSIRT personnel to handle actions to strengthen
security systems for products and services.

Internal Control■ Human resources responsible for security
measures of products and services
Human resources responsible for security measuresof products and services are those who promote thenecessar y security measures as part of their work
providing the product or service. These people areresponsible for carrying out the appropriate security
measures during the design, development, operation,and maintenance of products and services, and when
preparing the environments in which this work takes
place. Also important is the development of security
human resources focused on production andmanufacturing. These human resources are provided
with education to promote an understanding of security
me asure s according to company re gulations.
Environments must be created and operated in a waythat maintains the safety in the design and developmentof products and ser vices and at production andmanufacturing sites, while allowing neither of theseenvironments to adversely affect the other. To this end,
Hitachi is engaged in improving the skill of its workers in
relation to security measures for IT and OT.
We have also started measures such as developing

Education for Basic human resources

Basic Knowledge e-Learning Programfor Cybersecurity Countermeasures
Training for learning behavior andimpact when a cyberattack occurs【Basic knowledge】(1) Matters to note in your daily work,(2) Responding
to cyberattacks, (3) Matters to note during
development, (4) Collecting vulnerability information
and assessing countermeasures, (5) Preparing for asecurity incident【Hands-on learning】(1) Information leakage from a spear phishing attack,(2) Damage to business from ransomware infection,(3) Damage caused by a vulnerability in a web
application, (4) Damage due to malware

Communication Training for
Cybersecurity Response (workshop)
Training in understanding the situation
when an incident occurs anddetermining a course of action【Response process】

Experience the speed and accuracy required in the(1) Observe, (2) Orient, (3) Decide, and (4) Act stages【Communication skills】

Understand the importance of knowing your role andresponsibilities when (1) reporting, (2) notifying, and(3) discussing, and the importance of accurately
describing an event using the 5W1H method13

Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Action to Strengthen Global Information Security
Information security initiatives are essential to the Hitachi Group's presence on the global stage. To
ensure reliable implementation of security countermeasures, Hitachi is strengthening its global
governance by posting information security experts in various regions to entrench global security
governance.

Enhancing governance through information security experts
subsidiaries in their region.
ISEs (Information Security Experts) work together withorganizations responsible for security to enhance
governance in their region. (Figure 2‐❽)
To establish regional communities, open lines ofcommunication, and foster security awareness, ISEs
hold cybersecurity workshops and online seminars, andpublish a security newsletter, as an adjunct to traditionallines of governance via parent companies, supporting
better governance of local subsidiaries. (Figure 2‐❾)

Hitachi's lines of governance for information security
entails the security management divisions of the HitachiGroup sharing policies with and giving countermeasure
instructions to BUs and Group companies, who in turn
direct their overseas subsidiaries to implement them.
To support the advancement of information security
at a global level, Hitachi has in 2019 posted ISEs
(Information Security Experts) in various regions andbegun activity intended to entrench governance. As of
2020, Hitachi has posted ISEs in the Americas, Europe,Asia, China, and India who are suppor ting loc al

Figure 2‐❽

Governance strengthening system of Information Security Experts (ISE)

Hitachi, Ltd.
HQ (corporate)

BU

BU

Group company

Group company

Group company

Group company

Group company

ISEs support the promotion of information security in Group companies in their region
Americas region
ISE Team

Figure 2‐❾

Europe region
ISE Team

Asia region
ISE Team

India region
ISE Team

China region
ISE Team

Main activities of information security experts (ISEs)

Key ISE activity
Formulating and implementing security plans in cooperation
1. with organizations responsible for security

Support for security awareness activities with an awareness5. of “Jibungoto(Ownership)”

Ascertaining the level of cybersecurity maturity and the reach of
2. governance and supporting companies in their efforts to improve6.

3. Establishing security communities in various regions

Participating in outside conferences to gain insight into the
7. latest trends

Holding workshops for people responsible for security of
4. overseas subsidiaries

14

Working together with impacted divisions in relation to local
laws and regulations

Figure 2‐❿

manufacturing, product security, third-party vendors,
and compliance.
Hitachi visualizes and analyzes the results of thesurvey of executives of overseas subsidiaries, and uses
the results of this process to develop concrete plans toimprove the entrenchment of governance. It also sharesthe visualized data with the people who manage andcontrol security for BUs and Group companies. Here, it
finds effective use as context for security activity in thePlan, Do, Check, and Act stages of the PDCA cycle.
(Figure 2‐❿)
We promote PDCA implementation from the two
perspectives of management and the workplace.

Internal Control

The Hitachi Group promotes better IT governance byconducting self-assessment and third-party assessmentof IT a nd se cur it y c ounte r m e a sure s f rom a fie ld
perspective.
Hitachi sur veys the executives of overseas
subsidiaries to assess their knowledge of security
governance initiatives. This of fers insight into thematurity level of security governance from amanagement perspective that goes beyond a
conventional field perspective.
This sur vey covers a range of themes including
governance frameworks, human resource development,
in-house IT securit y, securit y for production and

The process of global security status monitoring and assessment feedback

Share and instruct

Parent company
Enhance andimprove
Evaluation
perspective

Monitoring

Executives
perspective

Evaluatematurityof security
governanceLocal
subsidiary

Executives

Self-assessment(IT and security)

Security officer

Information Security Management

Security status visualization and PDCA activity

Evaluation method

Evaluation items

Survey of
executive knowledge

・Governance framework
・Human resource development

Information security
management division ISE
knowledge assessment
interviewSelf-evaluation of
implementation of
IT and security measuresfor people responsible
for security in the field

On-siteperspective

On-sitesecurity risk
assessment

Identify gaps between
self-evaluationand on-site inspection

・Incident management
・Compliance・IT governance

Divisions responsiblefor information
security

Global information
security
expert committee
Sharing level ofgovernanceentrenchment andpromoting greater
entrenchment

・IT security
・IT configuration management
・Compliance・Checking of self-evaluation items
・Identifying residual risk
・Checking status of measures
to enhance robustness

ISE

15

Governance

Co-Creating Securuty

Jibungoto

Information Security Management
Action to Strengthen Information Security in M&A
Hitachi is working to reinforce information security governance in companies which newly join the
Hitachi Group, to minimize the security risks which arise as we actively pursue M&A.

Policy on reinforcing information security governance in M&A
The Hitachi Group actively pursues M&A as a way to
expand our business. M& A generates new value by
integrating companies with differing corporate cultures.
On the other hand, we must minimize the information
security risks that occur as we integrate policies andsystems.
If we discover an information security incident after
acquisition, there is the risk of major impact that could
extend beyond the acquired company to the entire

Hitachi Group (affecting corporate value, sales activities,
and more). Therefore, it is essential for us to identify any
information risks as soon as possible and control themappropriately. Starting at an early stage of the M& A
process, it is important to enforce in the company to beacquired an understanding of, and compliance with,
Hitachi rules, and to apply controls and management
based on Hitachi policies.

Information security risk assessment during M&A
Our risk assessment during M&A is divided into twophases: before and after the contract is signed.
① Information security risk assessment performed
before contract signing (Day 0).
We analyze the information security of the acquiredcompany on the basis of published information andinformation provided to us in advance. This analysis
covers mat ters such as information securit yorganizations and systems, the readiness of rules,
policies, and standards, the characteristics of thebusiness and its adaptation to the legal system of thecountr y or region, and the occurrence of any
cybersecurity incidents and responses to them.
② Securit y assessment per formed af ter contract
signing (Day 0).

Figure 2‐⓫

Information security risk assessment and security assessment

Reach basic agreement▼
M&A
process

Pre-deal

Day 0 (Execute contract)▼

Due diligence①Evaluation of information security risk
● Risk of costs occurring due to cybersecurity attacks● Risk of leakage of confidential information● Risk of violation of national laws on the handling of personal data
● Responses to cyber attacks and other security incidents

16

We select the sites to assess on the basis of thesituation, characteristics, etc. of the countries andregions where the acquired company does business.
Next, we have the company perform a self assessmentof the selected site, addressing risk assessment items
which we have prepared for each subject field on thebasis of Hitachi rules. After that, Hitachi headquarters
makes a direct visit to the assessed site and checks the
local situation, to get a more detailed grasp of the resultsof the self assessment. Finally, if there are any matterswhich do not comply with Hitachi rules, we have thecompany prepare a corrective plan, and follow up until
the correction is complete. (Figure 2‐⓫)

Day 1 (Closing)▼

Prepare Closing

Migration②Security assessment● Mutual understanding of implementation methods corresponding to
the nation or region and business characteristics, etc.
● Self assessment of security risks according to Hitachi rules● Hitachi headquarters checks the on-site reality of the self assessment results● Correction and follow-up for non-complianceCybersecurity risks and information security risks

Development andvalidation environment

In-house IT environment

Production/manufacturing
environments

Products and services

Data protection

Common items (supply chain, governance)

Internal networks

Devices such asexternal public servers

Devices not connected
to internal networks

Internal IT devices(PCs, servers, etc.)

Information Systems Department management

Figure 2‐⓭

Devices for use
in development

Devices for use
in production

Devices for use
in validation

Devices for use
in manufacturing

Devices for use
in demonstrations

Devices for use
in inspection

Information Security Management

Figure 2‐⓬■ Target fields and assessment items for security
assessment
Hitachi sees all devices and systems used in productdevelopment and manufacturing, the environments
which deliver products and services to customers, andother areas as subject to cybersecurity risks, not just thePCs and servers (internal IT environments) employeesu s e i n r e g u l a r o f fi c e w o r k . W e a l s o c h e c k t h emanagement methods and the leak countermeasuresr e l a te d to p e r s o n a l i n f o r m a t i o n p r o te c t i o n a n d
confidential information management. (Figure 2‐⓬)
The assessment items for securit y assessment
consist of 10 categories, based on internal security
standards (Hitachi rules) that were formulated withreference to ISMS and the NIST SP-800 Series, andtaking information security incidents in recent years into
account. (Figure 2‐⓭)

Internal Control■ Hitachi's Approach to Security Risk Assessment
Regardless of the size of the company when it isacquired, it is important to correctly grasp the existenceof information security risks at an early stage in thenegotiation. We must assess what kind of risks arepresent according to the business activities and service
content, but if there are clearly risks such as information
leakage, we must consider passing on the acquisition
cost and the IT system migration costs.
If a severe information security risk is discovered that
require s corre ction, we must deliberate with theacquired company about specific measures to reducethat risk in the future, and move forward with planned
improvement measures.
Hitachi practices information sharing with the wholegroup, alongside feedback, while also building controls
and systems for appropriate control of each company's
risk situations, and maintaining a comprehensive
overview.

Protection of
personal information
Service provisionenvironments

GDPR compliance
Confidential information
management

Individual management by Individual management by Individual management by
each organizationeach organizationeach organization

10 categories of security assessment items

Vulnerability
countermeasures

GovernanceAccount and accessprivilege management

Security incident
response

10 categories
of security
assessment

IT configuration
management
Softwaremanagement

Supply chain

Cloud management

Network security

Data protection17

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
Cybersecurity Management
The diversification of cyberattack techniques means incidents come from many sources and theirimpact can be magnified. To deal with these risks, Hitachi has expanded the scope of security risk
management. A traditional focus on in-house IT environments in an OA context has been expanded toinclude the development, verification, production, and manufacturing environments, supply chains, anddevelopment processes for products and services, ultimately reducing business risk.

Initiatives to enhance cybersecurity countermeasures
A s I T p e r m e a te s p r o d u c t i o n, m a n u f a c t u r i n g,
development, testing, and other business operations,
there is an increasing need to respond to attacks
outside the traditional office automation environment, as
well as cybersecurity measures for products, services,and procurement. (Figure 2‐⓮)

Figure 2‐⓮

For this reason, since 2018, we have been working tostrengthen cybersecurity measures for internal OA,
development and testing, environmental systems inproduction and manufacturing, and process systems inproducts, services and supply chains. Various initiatives
are underway to strengthen cybersecurity measures ineach area. (Figure 2‐⓯)

Expanding the scope of cybersecurity countermeasures

Areas where security
countermeasures apply
to products themselves
Products/services

Areas where security countermeasures apply
to the environments in which things and services are created= Areas requiring in-house risk countermeasures
Production/
manufacturing environments

Development/
testing environments

Manufacturing
environment

Development
environment

Production
environments

Testingenvironments

Inspection
environment

Demonstration
environment

In-house OA environment

Under information systems
divisions group control

Under human capital
general affairs group control

Products/systems

Services provided
to third parties

In-house OA environment
In-house IT environments(Printers, entry/exit management etc.) (no GWAN connection)
In-house OA environment(PCs, servers, etc.)

Hitachi global
corporate network

Publicly accessible
server environments

Supply chain

Expansion of scope(acknowledge importance of countermeasures)

Figure 2‐⓯

Summary of actions to enhance cybersecurity countermeasures in various areas

Target divisions

Area

IT

In-house OA
Development andtesting

Environment

Manufacturing andproduction
Products andservices
Processes
Supply chain

18

Focus on corporate IT (OA systems)

Design anddevelopment
Manufacturing
andproduction
Quality assurance
for design anddevelopment
Procurement

Overview
・Formulating and disseminating requirements for connection to and isolation from the in-house OA environment
・Formulating and disseminating guidelines for creating in-house OA environments and environments for securely connecting to them・Formulating and disseminating guidelines for creating manufacturing and production environments based on IEC 62443
which is a series of standards related to protecting control systems from cyberattacks
・Formulating quality management policies for the security of products and services
・Formulating and disseminating requirements for product design, development, and maintenance processes
・Formulating requirements for cybersecurity countermeasures for business partners and evaluating them based on evaluation
processes

Promotion framework
cybersecurity countermeasures in BUs and Group
companies.
E a c h d i v i s i o n d i s s e m i n a te s a n d e n f o r c e s i t scybersecurity countermeasures under the direction of
the cybersecurity officer. (Figure 2‐⓰)

HQ (corporate) is planning measures to enhancecybersecurity by establishing subcommittees for eacharea under the auspices of the cybersecurity expert
committee.
The policies of each subcommittee are rolled out via
the cybersecurity of ficers whose role is to enforce

Figure 2‐⓰
Cybersecurity
promotion framework

Internal Control■ Security enhancement in development/validation
environments
Development/testing environments include various
environments for purposes such as development,
testing, research, and demonstrations. We also use
connections with customers' environments and to theinternet, as well as cloud environments. Securit yrequirements vary between environments, but we have
prepared guidelines for configuring and connecting eachenvironment safely, and we are working on applying theguidelines across the Hitachi Group. Development forms
will go on changing due to factors such as use of thecloud and work ing from home, so we review ourguidelines on a regular basis, and work to maintain andenhance security. (Figure 2‐⓱)

■ Security enhancement in in-house OA
environments
Security enhancement in in-house OA environments
means setting standards for vulnerability
countermeasures and network security, etc. to protect
the networks, IT devices, and information systems used
in internal office work from security risks, and requiring
each BU and Group company to periodically check andcorrect the state of countermeasures. As a common
measure for all companies, we have started monitoring
the status of vulnerability countermeasures for eachdevice and following up with users and administrators,
and we are expanding the range of application of thisaction.

Cybersecurity Initiatives

Initiatives to strengthen security for each environment

Cybersecurity Expert Committee: HQ (corporate)
In-house IT

Development and testing

Manufacturing andproduction

Products and SI

Supply chain

IT divisions

Security divisions

Manufacturing andproduction innovation divisions

Quality assurance divisions

Procurement divisions

Cybersecurity countermeasures
enforcement function

Cybersecurity officers
Design and production
technology division

IT division

Manufacturing andproduction division

Quality assurance
division

Procurement division

BUs and Group companies
Figure 2‐⓱

In-house OA
environment
EnterprisenetworkDevelopment/validation
environment security network

Environment
in the cloud

FW

Internetpublication

Cloud use

Development/testing
environments

FW

Large-scale
development
environment
Development
project A

Internet

Research
environment

Testingenvironment

Research
environment

FW
Demonstration
environment

Closedenvironment

Individual
development
environments

Client OA
environments
Connections
to othercompanies

Development
project B

Development
project C

Clients' internal
environments

FW

FW
Individual
development
environments

19

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives■ Security enhancement inproduction/manufacturing environments
It is important that manufacturing and production
environments do not affect other environments, such as
in-house OA and development environments, andvice-versa. Hitachi has established guidelines governing
the creation and operations management of mutually
secure connection environments, and acts according tothose guidelines within the Hitachi Group. (Figure 2‐⓲)
At actual manufacturing and production sites, posters
are displayed workers of their obligations during theird ay-to - d ay wo r k. T h i s l e a d s to g re ate r s e c u r i t yawareness in the manufacturing and production sites.
(Figure 2‐⓳)

Figure 2‐⓲

Figure 2‐⓳

Posters/rule collections for production
and manufacturing workplaces

Content of guidelines for production/manufacturing environments and an illustration of their use

HQ and BU cybersecurity
management divisions
Feedback

Cybersecurity
management
divisions ofindividual sites

Departmentsthat operate
systems at
individual sites

Chief officer

20

Security guidelines for
manufacturing andproduction environments(Management edition)
Scope

Feedback

Site
Site
Site
policies and policies and policies andwrittenwrittenwritten
instructions instructions instructions

Manufacturing andproduction lines
Operatingadministrator
department A

Operatingdepartment B

WrittenWritten
instructions instructions

Field managers
Field workers

Written
instructions

Manufacturing/production line A

Operatingdepartment C

Feedback
Written
instructions

Manufacturing/production line B

Security guidelines for
manufacturing andproduction
environments(System edition)
Scope

Manufacturing/production line C

Guideline structure

Description

Target audience

Management edition

From a managerial perspective (as initiatives for organizational andhuman resource management), this document describes the process
of formulating and revising rules related to security operation andmanagement for an entire site and specific divisions.

Person responsible forcybersecurity management

System edition

D e s c r i b e s t h e s y s t e m c o n fi g u r a t i o n a n d a p p r o a c h t ocountermeasures in terms of ascertaining the current status andassessing countermeasures based on IEC 62443-3-3 with model
used by the Hitachi Group. The contents of this document arereference to a typical customized by each division and department.

Manufacturing/production line manager
Field manager
Field worker

Initiatives to enhance supply chain security

Checks status of countermeasures

Reports results

Security strengthening system in the supply chain

Security initiatives related to products and services

Figure 2‐

Internal Control

cybersecurity risks and the importance ofcountermeasures for those risks. In relation to the IT
systems, OT systems, IoT devices, and other assorted
products and services provided by the Hitachi Group,

Hitachi's digital solutions business provides new
customer value through increasingly sophisticateddigitalization and networking technology and more open
systems. However, this is accompanied by a growth in
Fields of products and services provided by the Hitachi GroupInternet(cloud)IT system
Information system that supports business operations
Businessapplication
serverWi-Fi

IT
infrastructure
server

DatabaseserverCybersecurity Initiatives

Figure 2‐⓴

Information security criteria

Procurement
partners

Hitachi Group
companies

When security operations to take care of Hitachi's
information assets are consigned to a procurement
partner, Hitachi checks and screens the procurement
partner's information security in advance, based on
Information security criteria set by Hitachi.
These nformation security criteria have supplementary
information security guidelines which have added
security measures against recent cyber attacks on
supply chains.
Hitachi also specifically stipulates requirements
concerning information securit y, so procurement
partners can perform checks. (Figure 2‐⓴)

Office PC

OT system
Industrial control systems and operation support
systems for plants and factories
Production
management
serverWi-Fi

Control server

Generic
PC

HMI※1

ENGS※2

IoT devices
Embedded systems that use IT
and information network
technology
Note: Can be embedded in IT/OT systems

Controller

Controller
Remote I/O※1 Human Machine Interface※2 Engineering Station21

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
Hitachi continues to promote initiatives intended toprotect customer assets and social infrastructure fromcyberattacks. (Figure 2‐ )Since FY 2022, new product security officers havebeen placed in each BU and Group company, and weare building a security management organization under
their control, to enhance product and service security.
We have also developed PSIRTs to handle technologicalresponses at headquarters (Corporate) and at each BU
and Group company. They work together to takeappropriate action in response to vulnerabilities andincidents involving products and services.
■ Security management policy for products andservices
To unify the approach to security management for the
many and varied products and services of the HitachiGroup, Hitachi has prepared guidelines for quality
assurance in the form of a Security Management Policy
for Products and Services and related documentation.
(Figure 2‐ )By applying the contents of this policy to its own

Figure 2‐

security management regulations, each division canadvance the implementation of secure processes acrossall stages of the lifecycle of its products and services
including development, manufacturing, maintenance,and operation. (Figure 2‐ )■ Dissemination of guide material and support
activity
Hitachi disseminates various guidebooks and otherresources that divisions can use to prepare their own
security management regulations. One example is the
Secure Process Implementation Guide. These resources
accumulate and share the know-how of the HitachiGroup by presenting case studies of the initiatives ofdivisions that have taken the lead in terms of security
measures. The case studies cover implementation
procedures and the like for each design andmanufacturing, operation and maintenance, and security
incident response process.
Hitachi shares this guide material on the intranet, andotherwise supports each division in the creation of its
secure development processes.

Security management policy for products and services

Security management regulations etc.
Security Management Policy for Products
and Services

A policy intended to unify the approach to security management for the products and services(hereinafter products) of the Hitachi Group.

Requirements for product development
and maintenance processes

Requirements that apply to processes associated with product development and maintenance. These
requirements form the basis for specific tasks appropriate to the nature of the product and can be
enforced through checklists or other means as needed.

Product security inspection checklist

An inspection checklist used to confirm that the product development and maintenance processes ofthe division conform to the policies and criteria.

Figure 2‐

Overview of development and maintenance processes to ensure security

1.Design/manufacturing process
1-1. Risk analysis and requirements
definition/basic design

2. Operation/maintenance3. Security incident
response process

2-1. Change management

3-1. When detected internally2-2. Collecting vulnerability information

3-2. When detected externally

1-2. Configuration management

2-3. Predictive maintenance3-3. Regular drills

1-3. Design/manufacturing2-4. Routine vulnerability inspections

1-4. Procurement (including OSS)
1-5. Testing and evaluation
1-6. Inspection

22

Overview

2-5. Reporting of vulnerabilities andcountermeasure information to
the customer

( 1) F o r m u l a t i n g a n d i m p l e m e n t i n g s e c u r i t ycountermeasures
Hitachi promotes the formulation and implementationof security countermeasures. For example, becauseinternet connections are typically high risk, Hitachirequires approval for internet connections. A framework
is in place that prohibits internet connections or sharing
without the appropriate permission. This approach has
also been adopted by related Group companies, andmeasures formulated through collaboration have been
deployed to and used by related business divisions.

(4) Implementing vulnerability inspections
Hitachi conducts regular vulnerability assessmentswith the aim of minimizing damage from attacks that
exploit vulnerabilities. These inspections occur routinely
or when starting a new development or changing anenvironment. Methods of inspection include a qualitative
approach that uses a checklist and an approach thatuses a vulnerability inspection tool. These methods canbe used independently or together to conduct aninspection appropriate to the characteristics andoperation status of the system.

(2) Product and service development and operationthat conforms to security management processes
Hitachi defines security management processes foreach phase of product and service development andoperation. Formalizing rules based on these processes
has allowed securit y countermeasures to be
implemented reliably within organizations. Using thec o n c e pt of a s e cu r i t y ra n k in g w h i c h d efi n e s th e
m a g n i t u d e o f r i s k , t h e s e r u l e s d e fi n e s e c u r i t ymanagement processes required to ensure security
during development and operation for each security
ranking. The use of a security ranking encourages
people to take the appropriate measures commensuratewith the seriousness of the risk, but also promotes a wayof thinking that considers the balance between risk andcost. These processes link with Hitachi's standardized
development process for information systems. The
contents of the formalized securit y management
processes are revised routinely or as needed. This
process takes place based on feedback from incidents
that occur, risks that manifest, and the results of prioruse, and aims to ensure ongoing improvement ofmanagement processes.

(5) Handling vulnerability-related information andestablishing an incident response framework
To reduce the likelihood of an exploited vulnerability
causing a security incident, Hitachi has created a guidethat summarizes handling process forvulnerability-related information in divisions that provide
i nfo r m ati o n-re l ate d p ro d u c ts a n d s e r v i c e s, a n d
encourages activity based on this guide. Hitachi also
provides a response framework and response manualaccompanied by drills to ensure a rapid and appropriate
response when a large-scale incident occurs.

Cybersecurity Initiatives

testing, and operation process. Security risk assessors
are appointed by the head of each businessdepartment. They conduct security reviews from theirexpert perspectives, and give advice and guidance. The
security systems architect and security operations
administrator use their expert knowledge to design, test,
and operate security for each project. This allows us todevelop and operate products and ser vices withassured security and deliver them to customers.

Internal Control■ Pioneering initiatives related to ensuring security
for products and services
To ensure the security of information-related products
and services provided to its customers, Hitachi, Ltd., hasestablished frameworks to assess and formulate
security measures. Hitachi implements and improves
securit y measures according to the securit y
management process. The pioneering initiatives over thelong term are as follows:(3) Promoting measures concerning the placementof security personnel
In order to ensure security quality to counter security
risks in products and services, we have defined three
types of personnel with appropriate qualifications,experience, and knowledge (① security risk assessors,② s e c u r i t y s y s te m s a rc h i te c t s, a n d ③ s e c u r i t yoperations administrators), and we are advancing
measures to allocate them to each review, design and23

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
Cybersecurity Countermeasures
To stay on top of its handling of cyberattacks and incidents, Hitachi enhances security monitoring andincident response at the Hitachi Security Operation Center (SOC). We also take proactive measures bycollecting and analyzing threat information, and disseminating vigilance information.

Enhancing security monitoring and incident response
Recently, there have been more at tacks where
genuine authentication information is acquired
fraudulently and used maliciously. These attacks are
difficult to detect since genuine authentic authentication
i nfo r m ati o n i s u s e d. S o, we h ave e n h a n c e d o u r
monitoring of the authentication system to allow early
detection of fraudulent account use by third parties.

Security risks are increasing not only for individualcompanies and organizations, but across the supply
chain, with complex and ingenious cyberattacks such as
targeted attacks, ransomware, and double extortion. To
establish an ef fective line of defense against suchcyberattacks, it is crucial to discover them early and limit
the damage. To enhance its security monitoring andincident response capabilities, Hitachi, Ltd. established a
Hitachi Security Operation Center (Hitachi SOC) in
October of 2017. The Hitachi SOC operates 24 hours aday, 365 days a year, detecting threats such as malware
infection or unauthorized access at an early stage. Thiscondenses the timeline from initial response to resolution
and minimizes the extent of damage.

■ Incident response
T he Hitac hi G roup has e sta blis he d a ha ndlingprocedure and contact system that come into play when
an incident occurs. This allows the cause and scope of
impact of an incident to be quickly identified and theappropriate countermeasures to be taken. Since 2020,
we have been able to capture the details of any incident
more quickly by combining log monitoring of core bases
and EDR surveys. This means that we can judge theresponse priority and whether a response is required,allowing us to handle incidents more efficiently.
Moreover, we can handle the new threats associatedwith work-from-home environments by monitoring theauthentication system. The know-how we gather during
incident response is then fed back to various internal
security measures, making it less likely that the samekind of incident could occur again. (Figure 2‐ )■ Security monitoring
The Hitachi Group has established systems andnetwork monitoring points that cover the entire globe for
integration, analysis, and monitoring of logs. We have
expanded our monitoring scope since 2017, and oursystems now cover all core global bases. With theintroduction of EDR (Endpoint Detection and Response),
we can now also monitor the operation of devices, carryout surveys, and address issues. This means that we
can analyze logs from EDR and core bases incombination, and implement high accuracy, efficientmonitoring.

Figure 2‐

Global security monitoring and incident response

Americas

Asia

Oceania24

Sites

Regular security risk and incident status reports
Security monitoring

Incident response

Hitachi SOC

Collection of
threat information
Threat information
EDR

Authentication
SystemMonitoring

Dispatch

EuropeSecurity monitoring

Japan

Applicable division

IT administrator

System administrator(Individual systems)

■ C o ll e c t in g , a n a l y zin g , a n d ve r i f y in g t h r e a t
information
When collecting information, in addition to thefollowing vulnerability and threat information publishedon the web, we also make use of a range of CTI (Cyber
Threat Intelligence) services to collect information on
threats in Japan and internationally.
Information sites operated by public third parties suchas IPA, JPCERT/CC, and CISA
Security-related news sites
Blogs and white papers published by various security
vendors
We use metrics published by the information provider(such as severity and CVSS base score) to classify
threats into five vigilance levels, based on factors suchas their likelihood of success and the prevalence of thevector in in-house systems.
For some threats, we use a simulated environment top e r fo r m ve r i fi c ati o n s. T h i s a l l ows u s to c o m p i l e
information to assist with our investigations of impact,
countermeasures, and damage, which we use in ourcountermeasure activities.

Figure 2‐■ Disseminating security advisory information
Collected information is disseminated to selected
people responsible for cybersecurity of BUs and Group
companies. This might take place by email (immediate or
we ek ly dige st) or posting to an internal website.
Additionally, to enhance countermeasures, when athreat has the potential to widely impact the whole
Hitachi Group's operations, we issue a cyber alert tourge thorough implementation of countermeasures, andwe consider issuing a cyber BCP. We also survey public
systems outside of the company, and if there is a risk ofd a m a g e, w e c o n t a c t t h e r e l e v a n t d e p a r t m e n t s
individually and recommend countermeasures. We
share the collected and analyzed information with
Hitachi SOC and IT system departments, and use it toenhance incident responses and monitoring.
Based on the knowledge gained through these
activities, we examine the current status of the HitachiGroup and countermeasures that require improvement.
We then share this with the HQ security management
division and link it with deliberations at the managementlevel about security strategy for the Hitachi Group, toaccelerate the security response execution cycle.
■ Taking action in emergency situations
If a threat might severely impact business operationsat numerous sites within Hitachi, or would render
continuation of business impossible on a company-wide
scale, Hitachi establish a task force that directs the
response at the company level, with measures such a
issuing a cyber BCP. (Figure 2‐ )Internal Control

Hitachi, Ltd. collects and analyzes threat information,and disseminates vigilance information, to ensure thesecurity of its in-house information systems and the
products and services it provides to its customers. We
share the knowledge gained from these activities with
the CISO and advance deliberations at the managementlevel about security strategy for the Hitachi Group.

Cybersecurity Initiatives

Collecting and Analyzing Threat Information, and Disseminating Vigilance Information

Application of threat information in ordinary times and extension to emergency measures(Company-wide) Emergency Response
Headquarters establishedManagement
Information sharing and security strategy advice

Outside organizations, etc.
(IPA/JPCERT and others)

Cyber BCP

Major threat andincident detection

CISO and otherexecutive members

BUs and Group companies

Information Vulnerability
information
Collecting and threat
Security-related
information

Feedback

Information sharing and measure suggestion

LiaisonInformation analysis and warning level determination
Intelligence generation

vendors

Incident detection andemergency contact

Information security officer
IT

Investigation
Response and application Verificationcooperation

QA

Development

Security
advisory

Monitoring
Various CTI services
Public information

Hitachi SOC・Countermeasure
instructions
・Incident response

In-house information systems

25

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives
CSIRT Activity in the Hitachi Group
Hitachi established the Hitachi Incident Response Team (HIRT) as a CSIRT (Cyber Security Incident
Readiness/Response Team) to support our cybersecurity countermeasures. By preventing theoccurrence of security incidents and promptly responding to them if they do occur, the HIRT
contributes to the realization of a safe and secure network environment for our customers and society.

What is an incident response team?
A security incident (hereinafter incident) is an artificial
cybersecurity-related occurrence, examples of which
include unauthorized access, denial of service, anddestruction of data.
An incident response team is a group of people who
lead incident operations to resolve issues throughinter-organizational and international cooperation. Thes k i l l s e t of a n i n c i d e n t re s p o n s e te a m i n c l u d e sunderstanding and communicating threats from atechnical perspective, coordinating technical activity,and liaising with external parties on technical matters. A
team with these skills can prevent (through readiness)and resolve (through responsiveness) various issues thatmight arise.

Model of HIRT activity
The role of the HIRT is to provide ongoing support for
Hitachi's cybersecurity countermeasures throughvulnerability handling, which eliminates vulnerabilities
that threats might exploit, and incident response which
involves evading and resolving cyberattacks. The teamapproaches these tasks from the perspective of
intra-organizational activity and collaborative activity.
Intra-organizational activity covers information security
initiatives targeting Hitachi's corporate information
systems, and collaborative activity covers initiatives
intended to ensure the cybersecurity of products andservices targeting our customers' information systems
and control systems. HIRT's mission also includes
helping to realize a safe and secure internet society bycatching the early signs of nascent threats and taking
preventive measures at the earliest possible stage.
The HIRT has adopted a model that consists of four

26

IRTs (Incident Response Teams) to advance vulnerability
handling and incident response. The four IRTs are:(1) Product vendor IRT, responsible for developing
products related to information systems and control
systems(2) SI (System Integration) vendor IRT, responsible forbuilding systems and providing services using theseproducts(3) In-house user IRT, responsible for managing theoperation of Hitachi's information systems as an internet
user Plus the fourth:(4) The HIRT/CC (HIRT center) which coordinates among
these IRTs, combining to create a model that makes therole of each IRT clear and promotes ef ficient andeffective security countermeasures through inter-IRT
cooperation. (Figure 2‐ )Four IRTs that support vulnerability countermeasures and incident response activities

Ensuring the security ofcustomer systems

Information security
initiatives

Addressing vulnerabilities
in Hitachi products

Ensuring the security of
in-house infrastructure

SI vendor IRT

Product vendor IRT

Internal user IRT

Divisions that provide SI
services to third parties

Product development
division

Divisions managing
in-house infrastructure

HIRT center (HIRT/CC)
Liaison and coordination among IRTs

Hitachi

Building a global networkwith external IRT communities

Information Security Early
Warning Partnership

Category

External IRT communities
such as FIRST*

Cybersecurity Initiatives

Initiatives to bolster cybersecurity of
products and services

Internal Control

Figure 2‐

Role

HIRT/CC*

Applicable division: HIRT center
Promotes vulnerability countermeasures and incident response activity throughcoordination with external IRT groups such as FIRST, JPCERT/CC* and CERT/CC*,and cooperation with SI vendor IRTs, product vendor IRTs, and in-house user IRTs.

SI vendor IRT

Applicable division: SI/service division
Supports vulnerability handling and incident response for customer systems by
ensuring their security in the same way as in-house systems in relation to known
vulnerabilities.

Product vendor IRT

Applicable division: Product development division
Supports vulnerability countermeasures for Hitachi products by investigating froman early stage whether any products are affected by known vulnerabilities, andtaking action to resolve any issues found by patches or other means.

In-house user IRT

Applicable division: Divisions that provide internal infrastructure
Supports promotion of vulnerability countermeasures and incident response so that
Hitachi-related websites do not become the point of origin of a security breach.

* HIRT/CC: HIRT Coordination Center
FIRST: Forum of Incident Response and Security Teams
JPCERT/CC: Japan Computer Emergency Response Team/Coordination Center
CERT/CC: CERT Coordination Center
SI: System Integration27

Governance

Co-Creating Securuty

Jibungoto

Cybersecurity Initiatives

Activity promoted by the HIRT center
The activity of the HIRT center in relation to in-house
IRTs includes promoting cybersecurity measures on asystemic and technical level through cooperation withinformation security supervisory divisions, which leads
the institutional side of IRT activities, and quality
assurance divisions, and suppor ting vulnerability
countermeasures and incident response in businessdivisions and Group companies. The HIRT center alsos e r ve s a s l i a i s o n w i th ex te r n a l I RTs to p ro m oteinter-organizational cybersecurity measures.
■ In-house IRT activity
In-house IRT activity includes issuing alerts andadvisories derived from know-how obtained through thegathering and analysis of security-related information,and feeding this know-how back into product andservice development processes in the form of guidelines
and support tools.
(1) Collecting, analyzing, and disseminating
security-related information
The HIRT center disseminates information andknow-how related to vulnerability countermeasures andincident response fostered through involvement in the
Information Security Early Warning Partnership*1 andother initiatives.
*1 A public-private par tnership based on of ficial rules that facilitates theunimpeded dissemination of information related to vulnerabilities in software
products and websites and the proliferation of countermeasures.

Figure 2‐(2) Developing frameworks for research activity
T h e H I R T c e n te r u s e s b e h a v i o r o b s e r v a t i o ntechnology to identify nascent threats and implement
countermeasures as early as possible. Behavior
observation is an observational technique that uses asimulated version of an organization's internal network
to investigate cyberattacks such as spear phishing. This
technique is used to record and analyze the behavior ofan attacker who has managed to infiltrate the system.
(Figure 2‐ )(3) Improving security technology for products
and services
To improve the IRT capability at an organizational
level, the HIRT center establishes concrete security
countermeasures for products related to information
systems and control systems and ensures that skills
learned are passed on to the relevant experts. As part ofan approach to dissemination of practical in-housesecurity know-how, the HIRT center is also involved in
the development of simulated cyberattack drills thatteach workers how to handle spear phishing andransomware.
In June 2022, HIRT was registered with the CVE
Numbering Authority (CNA), to be able to assign CVE ID
numbers to vulnerabilities in Hitachi products, and to
cre ate and publish CVE re cords. As a CNA , HIRT

Dynamic activity observation system to record attackers’ behavior

Branch office(Related office)Internet
Internet

Public web server
Email relay server
External DNS server(1) Deceive an attacker by presenting
a simulated environment
VPN

HUB

VPN
RouterPC

Sales/
Business travelers(Mobile connections
etc.)

HUB
PC

(2) Record the
behavior of theattacker after theygain access

HUB
RouterPC
HUB
Internal network server
PC

28

Simulated network
for behavior
observation

Actual networkassigns a CVE ID when a vulnerability is reported in a
Hitachi product and publishes suitable vulnerability
information, as it works to enable customers to use our
products with peace of mind.

member organizations as part of CSIRT activity. The
HIRT center also suppor ts the creation of an
information-sharing platform based on the JVN*3 service
jointly operated by the JPCERT coordination center andthe Information-technology Promotion Agency (IPA).

(4) Implementing IRT activity for individual sectors
The HIRT center assesses and organizes IRT activity
for specific sectors that accounts for the context andtrends of that sector. A preeminent example of such an
initiative is HIRT-FIS*2 established in October of 2012 forthe financial sector.

*3 JVN: Japan Vulnerability Notes (a portal site that provides information about
vulnerability countermeasures)(1) Enhancing domestic cooperation for IRT activity
The HIRT center endeavors to create networks forcooperation, including passing on information about
vulnerabilities and incidents that came to be known
through information gathering to the PoC of other*4 STIX: Structured Threat Information eXpression*5 AIS: Automated Indicator Sharing(3) Organizing research activity
The HIRT center fosters opportunities for humanre s o u rc e d eve l o p m e n t a n d th e d eve l o p m e n t ofresearchers and workers with specialized knowledge
through participation in academic research including
anti-Malware engineering WorkShops (MWS).

■ Hitachi Incident Response Team

Cybersecurity Initiatives■ Inter-organizational IRT activity
As inter-organizational IRT activity, multiple IRTs
promote inter-organizational cooperation to present a
united front against developing threats and build
partnerships that can help improve each other's IRT
activity.

Internal Control*2 HIRT-FIS: Financial Industry Information Systems(2) Enhancing international cooperation for IRT
activity
The HIRT center promotes the organization of aframework for collaboration among international IRT
organizations and overseas product vendor IRTs thatmake use of FIRST initiatives, and a plat form for
information sharing that uses STIX*4 and United States
Department of Homeland Security's AIS*5 program.

https://www.hitachi.co.jp/hirt/
https://www.hitachi.com/hirt/29

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection
Initiatives for Personal Information Protection
With the advancement of digital technology causing rapid growth in data usage, the protection of
personal information, and its transfer across borders, are growing concerns.Against this background,
as a provider of safe and secure social infrastructure systems, Hitachi places considerable importanceon personal information protection initiatives to reliably manage personal information kept on
customers' behalf and personal information used during business.Hitachi has defined its vision for
personal information protection, summarized as providing safety and trustworthiness and recognizing
the importance of individual rights. This vision underpins Hitachi's role as a member of a global society.

Vision for personal information protection governance
Hitachi's vision regarding personal information
p rote c ti o n i s “ Prov i d i n g a s afe a n d tr u s t wo r thy
environment and Valuing individual rights.” Hitachi has

positioned personal information protection as a key
issue in its business and is making steady progress
towards achieving its vision. (Figure 2‐ )Personal information protection framework
To fulfill its mandate as an organization committed tothe appropriate handling of personal information,
Hitachi's upper management has formulated a personal
information protection policy. Rules and guidelines for
managing personal information are then formulated
in-house that conform to this basic policy. Hitachi has aframework in place to check and evaluate whether its
Figure 2‐internal rules confirm to applicable laws and to JIS Q
15001 which is the basis for PrivacyMark certification. In
addition to creating these rules, Hitachi implements
concrete safety management measures that come into
effect when handling personal information. There are
four aspe cts to the se me asure s: orga niz ationa l,personal, physical, and technical. (Figure 2‐ )Vision for personal information protection governance

VISION
Doing its part to protect personal information as a member of global society

1 Providing safety and trustworthiness
Hitachi provides a safe and trustworthy environment by observing personal information protection andconfidential information management programs (process regulations) based on laws and other regulations.

2 Recognizing the importance of individual rights
Hitachi faces the global trend of respecting the rights of the individual from a good faith position.
Personal information protection equates to the protection of a fundamental human right, and Hitachi
considers it a key issue in terms of business management.

30

(2) Collecting, using, and providing Personal
information and prohibiting use for unintended
purposes
K nowing the re spe ct owed to the personal
information it possesses, Hitachi establishes
management frameworks for personal information

Figure 2‐(3) Implementing and revising safety measures
To ensure the accuracy and safet y of personal
information, Hitachi complies with rules and regulations
related to information security. This includes controlling
access to personal information, limiting means by which
it can be removed from business premises, preventing
unauthorized access from external sources, and othermeasures to prevent leakage, loss, or damage. Upon
discovering an issue with its safety measures, Hitachi
identifies the cause and takes remedial action.
(4) Complying with laws and regulations
Hitachi complies with applicable laws, nationalguidelines, and other standards relating to the handlingof p e r sona l infor mation. Hitac hi's ow n p e r sona l
information management rules confirm to these laws,
guidelines, and standards.
(5) Respecting the rights of the subject in relation topersonal information
Hitachi will comply with requests from the subject of
personal information to disclose, modify, delete, ceaseuse of, or cease provision of that information, andrespond in good faith to complaints and inquiries
concerning the handling of personal information.

Initiatives for Data Protection(1) Formulation of personal information
management rules and ongoing improvement of
personal information protection management
systems
H i t a c h i h a s f o r m u l a te d p e r s o n a l i n f o r m a t i o nmanagement rules that ingrain the impor tance of
personal information protection in its managers andworkers, and ensure that personal information is usedappropriately and protected. Hitachi thereby reliably
operates personal information protection management
systems. Hitachi also maintains these systems andsubjects them to ongoing improvement.

protection that reflect its use in day-to-day business.
Hitachi also collects, uses, and provides personal
information appropriately according to predetermined
rules. Hitachi does not use personal information otherthan for its intended purpose, and has measures inplace to prevent such misuse.

Internal Control■ Personal information protection policy
Hitachi, Ltd. (hereinafter “Hitachi”) is a global supplierof total solutions. In this role, Hitachi handles all mannerof information including its own technical informationand information it holds on behalf of customers.
Reflecting how highly it values this information, Hitachi
has established an information management frameworkand endeavored to enforce it. With that in mind, Hitachi,Ltd. has established a personal information protection
policy and makes it widely available to stakeholders, on
its website and by other means.
（https://www.hitachi.co.jp/utility/privacy/）.

Personal information protection framework

Personal information protection framework
PolicyFormulate basic policy (upper management)

Note: Governance of data protection according to basic policy
Internal
regulations

Prepare regulations for handling of personal information
Four types of safety management measures

Organizational
measures

Personal
measures・Prepare organizational framework
・Operate according to regulations
・Prepare means for reviewing status of personal
information handling・Provision of framework for incidents such as
information leakage
・Ascertain the handling status and improve safety
management measures
・Inspection and audit

・Dissemination of correct handling procedures,
regular training and drills

Physicalmeasures

Organizational
measures

・Entry and exit management for buildings and rooms
・Measures to prevent theft and loss of devices,media, and documents
・Measures to prevent leakage during deletion or disposal

・Measures to prevent unauthorized access and use ofunauthorized software
・Manage and authenticate access rights
・Measures to protect information during transfer and communication
・Monitoring of information systems

31

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection■Personal information protection system
Through our information security promotion framework,
headed by the CEO, we thoroughly apply our policies on theprotection of personal information, and manage personal
information appropriately. All Hitachi, Ltd. BUs and offices
appoint information asset managers in all divisions, under the
information security officer, and allocates responsibilities inrelation to the handling and protection of personal information.
Similar organizations are established in Group companies, tofoste r thorough pe rsonal infor mation prote ction andmanagement throughout Hitachi Group.
■System of rules for personal information
H i t a c h i a p p r o p r i a te l y m a n a g e s t h e p e r s o n a linformation it obtains and holds according to a set ofrules governing personal information protection. (Figure
2‐ )■Safety management measures
As part of its organizational safety management measures,
H i t a c h i d e s i g n ate s p e o p l e re s p o n s i b l e fo r p e r s o n a linformation protection and establishes a personal information
protection system.
Hitachi defines rules related to the roles and responsibilities
of workers in relation to safety management and handling of

personal information, and operates according to those rules.
Hitachi has also put in place a response framework to follow
when an incident such as information leakage occurs, anddefined rules related to inspection and audit, and carries out
its operations accordingly.
As personal safet y management measures, Hitachi
conducts education and training in how to handle personal
information appropriately based on the education plan for
personal information protection. This includes stratified
education, specialized education, and universal e-learning.
(See Education regarding personal information protection).
As physical safety management measures, Hitachi has put
safety measures in place including managing entry and exit tovarious buildings and rooms, physically protecting devices
and documents, anti-theft measures, and measures toprevent information leakage when disposing of devices anddocuments.
As technical safety management measures, Hitachi
prevents unauthorized access to information systems andeliminates unauthorized software. Hitachi also manages andauthenticates access rights, implements measures duringtransfer and communication, and monitors information
systems according to the impor tance of the personal
information being handled.

Personal information protection management system
Hitachi's personal information protection management
system was established based on JIS Q 15001. Hitachi's
personal information protection policy defines its policy
regarding the protection of personal information.
The 47 articles of the general rules for information
security management define the rules for personal
information protection management.
The handling of personal information is based on the
Figure 2‐
System of personal
information protection rules

63 articles of the personal information protection rules,
the 12 articles of the criteria for consignment of personal
information handling, and related documents.
■Personal information protection
management cycle
Hitachi's framework for personal information protection
management is subject to the PDCA

Personal Information
Protection Policy＜Document structure＞

Basic policy

Information Security Management Rules

Information Security Standards

Basic regulations

Regulations for Personal Information Management
Criteria for consignment of personal information handling

Related documents (written procedures and by-laws)

Rules related to information security

32

Related documents(written procedures and by-laws)
Related laws including
those referenced

Management and appropriate handling of personal information
To ensure protection of personal information at a levelexceeding that specified by the Personal Information
Prote c tio n Ac t, Hi tac hi h a s e sta b lis h e d inte r n a lregulations equivalent to the stipulations of JIS Q 15001(Personal information protection management systems requirements). These regulations are the basis for
Hitachi's efforts to strictly manage and appropriately
handle personal information. Each workspacenominates a person to be responsible for personali n fo r m a ti o n m a n a g e m e n t (a n i n fo r m a ti o n a s s e t
manager). This person identifies all personal information
handled during business, manages it in a ledger, andtakes the appropriate measures according to the
Figure 2‐

importance and risk of the personal information.
For each business operation that handles personal
information, Hitachi recognizes and analyzes theassociated risks. Hitachi defines rules for business
operations that handle personal information. These rules
are centrally managed by the company and regularly
reviewed.
People who handle personal information are informedof the rules for its handling, and sign a documentattesting as such before starting their work. During
operations, each workplace conducts a monthly
self-check to assess the status of safety management
measures and operations.

Initiatives for Data Protection

conducts audits based on the audit plan to check thestatus of other divisions. The person responsible for theaudit formulates a written company audit plan and written
report and has them approved by the company president.
If there are any matters raised by these audits, Hitachi
remains vigilant until the issues are remedied. (SeeAuditing personal information protection)
In the “Action” stage, Hitachi revises its management
system based on various factors. These include changes
to legal obligations regarding the handling of personal
information, changes in the social landscape, opinions
gathered from inside and outside the company, changes
in the business environment, and the results of internal
operations.
In FY 2021, we formulated a plan for compliance with
the A me nd e d Act on the Prote ction of Pe r sona lInformation and amended related rules, as the “Plan”
stage. The “Do” stage is now in progress at all sites, to befollowed by the “Check” stage of testing and auditing
within FY 2022 to confirm progress, and the “Action” stage
to assess results and make revisions. (Figure 2‐ )Internal Control(Plan-Do-Check-Action) cycle, undergoing continuous
improvement through decisive implementation of a plan.
The “Plan” stage entails formulating the personal
information protection policy and personal information
protection measures and establishing a personal
information protection training plan and personal
information protection audit plan. These are then approvedby the company president.
In the “Do” stage, the personal information protection
measures are disseminated and used in-house.
Personal information protection training is conducted tomake the personal information protection measures andmanagement approach well-known throughout Hitachi.
(See Management and appropriate handling of personal
information)
Hitachi also holds meetings to promote personal
information protection matters, using these meetings to
p rov i d e i n fo r m ati o n a n d to re p o r t th e s t atu s of
implemented measures.
In the “Check” stage, Hitachi asks each department to
conduct regular self-checks of its operations, andThe framework of personal information protection management though the PDCA (Plan-Do-Check-Action) cycle● Reliably implement personal information protection management system (PMS)● Conduct regular reviews and ongoing improvements by cycling the PDCA

Rules

●Internal rules●Management
framework

Protection andmanagement●Identification and inventoryof personal information●Personal information

protection and management

Education andmonitoring●Education●Auditing andinspection

Ongoing
improvement●Revising the PMS

33

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection
Hitac hi's inte r n a l re g u l atio ns c o m p l y w ith th e
standards required by the My Number system. Basedon these regulations, Hitachi makes every effort tomanage and handle this information with the necessary
discipline. Hitachi has established a framework form a n a g i n g M y N u m b e r i n f o r m a t i o n. I t u s e s t h i sframework to evaluate the risk of business operations
that handle My Number information, and ensure theappropriate measures are taken.
■ A u d i t i n g a n d te s t i n g p e r s o n a l i n f o r m a t i o nprotection
Hitachi, Ltd., and all Group companies within Japan
conduct an annual audit of their personal information
protection and information security status. A personal
information protection and information security audit
reviews compliance with personal information protection
and management, and audits compliance with legal
requirements.
Group companies outside Japan perform common
global self checks in a Hitachi-wide auditing andinspection process. All Hitachi, Ltd. depar tmentsp e r f o r m “ P e r s o n a l I n f o r m a t i o n P r o te c t i o n a n dInformation Security Operation Checks” annually, as
self-checks in the workplace. In addition, departments
involved in operations that handle important personal
information (740 operations*) per form “Personal
Information Protection Operation Checks” every month.
With the se measure s, we regularly check safet y
management measures and their operational status.

■E d u c a t i o n r e g a r d i n g p e r s o n a l i n f o r m a t i o nprotection, and fostering understanding among
employees
To ensure that personal information is reliably
p rote c te d, H i t a c h i c o n d u c ts a n n u a l tr a i n i n g bye-learning of all executives, workers, and temporary
employees. Hitachi, Ltd., gives each of its employees apersonal information protection card that outlines
Hitachi's personal information protection policy andbasic matters regarding information security.
■Stricter management of subcontractors
Hitachi has taken the early initiative to enhance its
policies regarding subcontractors' handling of personal
information. It has established internal regulations that
apply when subcontracting the handling of personal
information and implemented screening and supervisionof subcontractors. When subcontracting business
operations, Hitachi screens its subcontractors so thato n l y th o s e w h o s e l eve l of p e r s o n a l i n fo r m ati o nprotection equals or exceeds that of Hitachi are
selected. T he contracts Hitachi signs with its
subcontractors incorporate strict provisions regarding
personal information management. These provisions
might include the need to establish a management
framework and a ban in principle on fur thersubcontracting. As part of its approach to managing
and supervising subcontractors, Hitachi also conducts
regular assessment of its subcontractors and reminds
them of their obligations.

*As of March 2022

Global personal information protection initiatives
Advancements in data use driven by the significant
progress being made in digitalization will inevitably resultin increased privacy risk and impose greater demands
on personal information protection. Under thesec i rc u msta n c e s, c o u ntr i e s a ll ove r th e wo r l d a reformulating and revising legal frameworks related topersonal information protection.
With data use sometimes crossing international
borders, the personal information protected by acountry's legal framework will not always belong to its
domestic subjects, and restrictions might apply to
cross-border transfer. For this reason, compliance for
personal information protection must be based on athorough understanding of current trends in various
countries' legal systems.
As a pioneer in global compliance with personal
information protection legislation, Hitachi has beenpromoting compliance with the European General Data
Protection Regulation (GDPR).

34

We are also promoting compliance with data protection
laws and regulations in other countries and regions incooperation with local regional managementcompanies.
In 2021, we enacted the “Hitachi Group Privacy
Principles” as a common code of conduct for personal
information protection throughout the Hitachi Group, toe nsure thorough action on pe rsonal infor mation
protection in each Group company. To ascertain risk
status in relation to personal information protection
within the Hitachi Group and take action, Hitachi
conducts ongoing monitoring of the compliance statusof Group companies and implements appropriate
measures.
To promote compliance with personal information
protection requirements by all Hitachi Group companies,
we will continue to bolster and develop the ability ofthese companies to comply with applicable regulations.

PrivacyMark*-Related Initiatives of the Hitachi Group

Website for PrivacyMark System of Japan Institutefor Promotion of Digital Economy and Community(https://privacymark.org/)■Holders of PrivacyMark certification within the Hitachi GroupAs of the end of July 2022, the following Hitachi Group companies hold PrivacyMark certification:

Hitachi, Ltd.

Hitachi Systems Field Services, Ltd.

Hitachi, Ltd., Corporate Hospital Group

Hitachi Social Information Services, Ltd.

Hitachi Kenpo

Hitachi Information & Telecommunication Engineering, Ltd.

Okinawa Hitachi Network Systems, Ltd.

Hitachi Research Institute

Kyushu Hitachi Systems, Ltd.

Hitachi Solutions, Ltd.

Shikoku Hitachi Systems, Ltd.

Hitachi Solutions Create, Ltd.

SecureBrain Corporation

Hitachi Solutions West Japan, Ltd.

Hitachi ICT Business Services, Ltd.

Hitachi Solutions East Japan, Ltd.

Hitachi Urban Support, Ltd.

Hitachi Channel Solutions, Corp.

Hitachi Academy Co., Ltd.

Hitachi Document Solutions Co., Ltd.

Hitachi Information Engineering, Ltd.

Hitachi Hi-System21 Co., Ltd.

Hitachi SC, Ltd.

Hitachi High-Tech Solutions Corporation

Hitachi Global Life Solutions, Inc.

Hitachi Power Solutions Co., Ltd.

Hitachi KE Systems, Ltd.

Hitachi Building Systems Co., Ltd.

Hitachi Consulting Co., Ltd.

Hitachi Foods & Logistics Systems Inc.

Hitachi Industry & Control Solutions, Ltd.

Hitachi Insurance Services, Ltd.

Hitachi Systems, Ltd.

Hitachi Management Partner, Corp.

Hitachi Systems Engineering Services, Ltd.

Hitachi Real Estate Partners, Ltd.

Hitachi Systems Power Services, Ltd.

Hokkaido Hitachi Systems, Ltd.

Initiatives for Data Protection* PrivacyMark is a third-party certification program that certifies businesses
recognized to be implementing security measures and protection measuresappropriate for personal information.
(Issuing organization: Japan Institute for Promotion of Digital Economy and Community)

Hitachi's Privacy MarkInternal Control

The Hitachi Group engages in personal information protection as asingle entity.
The first instance of PrivacyMark certification by a Group
company was in 1998. As of the end of July 2022, 38 business
operators now hold this certification. These businesses protect
and handle personal information at a higher level than that
required by law.
Hitachi, Ltd. received its eighth certification in March 2021 and iscontinuously working towards the next renewal in March 2023.
In addition, the “Hitachi Group P Mark Liaison Committee” isorganized mainly by companies that have acquired the Privacy
Mark, and regularly holds information exchange meetings, study
sessions, and lectures by invited outside experts, as well as
sharing and studying information on personal information
protection throughout the Group.

35

Governance

Co-Creating Securuty

Jibungoto

Initiatives for Data Protection
Privacy Protection Initiatives
Advancements in digital technologies such as AI and IoT have set high expectations for social
innovation using the varied and vast data they produce. However, public awareness is also growing
around privacy protection for consumers. Hitachi is taking the initiative regarding privacy protection tofoster value creation in a way that protects people's safety and security.

Using personal data and protecting privacy
Recently, all businesses are expected to use personal
data to create value, regardless of whether it is deemed“personal information”. This situation demands concern
for personal privacy. In the DX era, the amount of
personal data collected is increasing exponentially,
which inevitably changes the privacy risk a businessmust manage. As Figure 2-xDBCA__xDD28_ illustrates,

there is a partial overlap between personal data andinformation about an individual. For example, they
include information like location data and purchasehistories which have privacy implications.
To create value using personal data, a business must
protect personal information while also protecting
privacy. (Figure 2‐ )Hitachi's privacy protection initiatives
Hitachi seeks to create value through the safe andsecure use of personal data. To this end, Hitachi has
been working on privacy protection initiatives for data
use since 2014 led by the IT sector.
■Operation of the privacy protection advisor ycommittee
In the IT sector that is at the forefront of digitalb u s i n e s s, H i tac h i h a s n o m i n ate d p e r s o n a l d ata
managers who oversee the handling of personal data,a n d e s t a b l i s h e d a p r i v a c y p r o te c t i o n a d v i s o r y
c o m m i t te e w h i c h s u p p o r t s r i s k e v a l u a t i o n a n dcountermeasure assessment by aggregating knowledge
related to privacy protection.

Figure 2‐■Preparing rules and manuals related to privacy
protection
Hitachi has defined a privacy protection policy withreference to this framework, defined rules for handlingpersonal data based on its policies, and createdmanuals for workers. These manuals set out specificprocesses to be followed and matters to consider toprotect privacy, allowing each employee to implement
privacy protection measures.

Relationship between personal data, personal information, and information with privacy implications

Personal data

Personal
information

36

Information withprivacy implications

■Privacy protection education
Using personal data while also protecting privacy
requires that individual employees understand theimportance of privacy protection and implement privacy
measures accordingly. To this end, Hitachi conducts
regular education and information sharing related to
privacy protection and keeps a keen eye on attitudes
regarding privacy protection in wider society.

Ensuring the safety and security of consumers and customers
With the goal of meeting consumer expectations
regarding privacy protection, Hitachi worked with
Hakuhodo Inc. in 2020 to conduct its “5th Opinion Poll
Regarding Consumer Information Handled as Big
Data”*¹.
Hitachi reflects changes in consumer attitudes,
learned through such investigations, in our privacy
protection measures.
The “Corporate Privacy Governance in the DX Era
Guidebook ver1.2”*2 published by the Ministr y ofInternal Affairs and Communications and the Ministry of
Economy, Trade and Industry also notes the importanceof regularly surveying public opinion in these types ofsurveys to facilitate the evaluation and improvement of
measures. Hitachi's efforts were also noted as a casestudy in the guidebook.
In March 2022, we presented our actions on privacy
protection under the title of “Personal Data Usage andPrivacy Protection” at the Symposium on the Proper
Use of Personal Data, which was organized by theJapan Business Federation (Keidanren).
At a panel discussion after the presentation, thepanelists rated Hitachi's privacy protection initiatives asadvanced and valuable.
Hitachi also applies its privacy protection know-how
to its customers' businesses by offering better services
and technology that consider privacy. In this way,
Hitachi helps make progress towards safe and securesocial innovation.

Initiatives for Data Protection

many of its operations, with approximately 230 in fiscal
2021 alone. The business fields covered are also
diverse, including finance, public, social infrastructure,and industry/distribution.

Internal Control■Assessing privacy impact
Using these rules and manuals, workers involved inbusiness processes that handle personal data can
c o nd u c t a p r i vacy im pac t a s se s s m e nt a nd ta kemeasures to prevent privacy issues from arising. To
carry out this assessment, the worker uses a checklist
in a format created by Hitachi based on legal systems,
technological trends, case studies, and knowledge
gleaned from opinion surveys (described later). If thee m p l o y e e's j u d g m e n t w i l l n o t s u f fi c e o r r i s k i sdetermined to be high, the privacy protection advisorycommittee can reduce risk by providing support.
Hitachi has applied privacy impact assessments to*1 “5th Opinion Poll Regarding Consumer Information Handled as Big Data”(published December 2020)
https://www.hitachi.co.jp/New/cnews/month/2020/12/1222a.html*2 “Corporate Privacy Governance in the DX Era Guidebook ver1.2” (Published in
February 2022)
https://www.meti.go.jp/policy/it_policy/privacy/guidebook11.pdf

37

Governance

Co-Creating Securuty

Jibungoto

Internal and External Activity Related to Information Security
Recent cyber attacks are gaining in level and sophistication, so the scope of their impact is widening, toinclude supply chains. To counter the threat of such cyber attacks, it is vitally important to build asecurity ecosystem that goes beyond internal departmental boundaries and also collaborates withexternal organizations. To that end, we are building a framework for inter-divisional collaboration,
between divisions other than security, through various internal activities. We also participate actively inexternal activities, to enable collaborative creation with others in industry, government, and academia.

Internal Activity Related to Information Security
their individual roles and deepen connections with thosearound them.
Global security workshops held with counterparts in
Europe and the Americas deepen understanding of
measures that are promoted as internal controls.
Workshops in Japan hold panel discussions under theheading of security ecosystems with a perspective
completely different from security and IT experts. Points
raised and lessons learned at these events are thenshared.

Now that we are in an environment where devices,
systems, and other things “interconnect” in the IoT, evendivisions which previously had few occasions to think
about security must do so. Therefore we organize
se mina r s, wor ks hops, a nd othe r eve nts to build
communities beyond barriers of position or organization,in addition to thorough implementation of measures byusing IT systems and tools, and controls such as rules,
regulations, and guidelines. These oppor tunities
strengthen security by helping participants to reaffirm

External Activity Related to Information Security
We communicate with communities that transcend
frameworks, to share matters such as threat informationand issues arising when countermeasures are applied,with other nations, academia, and companies which are
working to promote cybersecurity.
Hitachi participates in global communities to that end.
We endorse the C ybersecurit y Tech Accord joint
declaration, which the IT and technology industries called
for as a way to ensure safety in cyberspace. We aim towork within this global collaborative framework to protectuser companies from cyber attacks. We have also joined
the Information Security Forum (ISF), an organization
engaged in world-leading investigation and research into
subjects such as information security standardization andbest practices for cybersecurity and digital risks.
We also use the knowledge and experience of ouremployees to participate in various external activities
related to information security, such as the international
standardization activities noted below, and CSIRT work.

■International standardization activity
Hitachi participates in the following international standardization activity:
・ISO/IEC JTC1/SC27
SC27 is a subcommittee of the ISO/IEC joint technicalc o m m i t t e e J TC1 i n s t i t u t e d b y t h e I n t e r n a t i o n a l
Organization for Standardization (ISO) and International
Electrotechnical Commission (IEC) for the purpose ofinternational standardization. SC27 asse sse s thestandardization of information security management
systems (WG1), encryption and security mechanisms(WG2), security evaluation technology (WG3), security

38

control and services (WG4), and identity management
and privacy technology (WG5).
・ISO TC292
ISO's Technical Committee (TC) 292 assesses various
security-related standardization including general security
m a n a g e m e n t, b u s i n e s s c o n ti n u i t y m a n a g e m e n t,
resilience and emergency management, prevention andmanagement of unauthorized activity, security services,and homeland security.

■CSIRT activity
In addition to the CSIRT activity of the Hitachi Group, Hitachi participates in external CSIRT activity with the HIRT
(Hitachi Incident Response Team) as its PoC (Point of Contact). Hitachi also promotes the sharing and exchange of
information about vulnerabilities and other matters through cooperation with external CSIRT organizations.
・FIRST
FIRST (Forum of Incident Response and Security
Te a ms) is a n inte r n atio n a l c o m mu ni t y of inc id e nt
response teams bound by mutual trust. FIRST includes
universities, research institutions, corporations, andgovernment agencies among its members.
As of the end of September 2022, membership consistsof 652 teams from 101 countries.
・Nippon CSIRT Association (NCA)
The NCA was established to help resolve issues faced
during CSIRT activity by facilitating information sharing
and cooperation among Japanese CSIRT organizations.

Its mission includes helping organizations establish
CSIRTs and creating collaborative frameworks among
CSIRTs when an issue occurs, providing a venue throughwhich Japan's CSIRT community can independently
improve its basic incident response capability and findpartners for collaboration in times of need. Hitachi is afounding member, and between 2015 and 2020, a
Hitachi representative held the position of chairperson of
the association. In 2021, FIRST became a generalincorporated association, and Hitachi has helped topromote domestic CSIRT activities as an executive
committee member.

External Activity Related to Information Security

・IEC TC65/WG10, WG20
IEC's TC 65 promotes the standardization of industrial
automation, measurement, and control. In TC 65, WG10
assesses the standardization of security of the networks
and control device in control systems. WG20 assesses
frameworks to bridge the requirements for safety andsecurity.
・OASIS CTIThe Organization for the Advancement of Structured
Information Standards (OASIS) Cyber Threat Intelligence(CTI) committee assesses the standardization of theStructured Threat Information eXpression (STIX) format
for exchanging cyber threat intelligence and procedures
for automatically exchanging detection index information.

Co-creation

・ISO TC262
ISO's TC 262 is focused on risk management, andassesses standardization of terminology, principles,policies, risk assessment methodology, and otheraspects for all types of risk.
・ITU-T SG17
S G 17 i s a S t u d y G r o u p ( S G ) u n d e r t h e I T U
Telecommunication Standardization Sector (ITU-T) of theInternational Telecommunication Union (ITU). SG17 looks
at standardization in such matters as cybersecurity,
security management for communications providers,
telebiometrics, security functions for communication andapplication ser vices, anti-spam measures, and ID
management.

■Other activity
In addition to the preceding activity, Hitachi participates in various outside activity to promote research, discussion,
proliferation, public awareness, and matters related to security. Hitachi also holds various seminars and conferences
across the country.
・ Information-technology Promotion Agency (IPA): Ten
Major Security Threats Authors' Committee, etc.
・ Japan Institute for Promotion of Digital Economy andCommunity (JIPDEC) ISMS Expert Committee, Control
Systems SMS Expert Committee, etc.
・Japan Cybercrime Control Center (JC3)・Japan Information Security Audit Association (JASA)
・NPO Japan Network Security Association (JNSA)・ Information Security Operation providers Group Japan(ISOG-J)・Japan Digital Trust Foundation (JDTF)
・ Japan Electric Measuring Instruments Manufacturers'
A s s o c i a t i o n (J E M I M A ) PA / FA C o m m i t t e e o nInstrumentation and Control, Security Research WG

・Control System Security Center (CSSC)
・ Ja pa n El e c tro n i c s a n d Info r m ati o n Te c h n o l o g yIndustries Association (JEITA) Information Security Expert
Committee
・ICT-ISAC
・Council of Anti-Phishing Japan・ National Institute of Technology and Evaluation (NITE)
Evaluation Body Certification Technical Committee
・ Robot Revolution & Industrial IoT Initiative and Industrial
Security Action Group・Japan Society of Security Management (JSSM)
・ CRIC Cross-Sector Cybersecurity Committee, CRIC
Security Quality Committee, etc.

39Governance

Co-Creating Securuty

Jibungoto

Working to Raise Information Security AwarenessWe see each employee's individual security awareness as security's last line of defense.
Therefore, in addition to our existing strict governance, we have star ted activities to foster
independence in our employees and raise their security awareness by encouraging them to take theinitiative and act independently.

“Jibungoto(ownership)” in information security
The ongoing COVID-19 pandemic has accelerated andnormalized working from home, but with growth in cyberattack threats showing no signs of abating, adequate
security measures are essential to unlock the potential ofworking from home. Until now, attacks have primarily
targeted vulnerabilities in organizations' IT infrastructure,
but with work styles increasingly based on working from
home, attackers are beginning to target lapses in security
awareness.
Security measures have always required a balance
between the three elements of IT, processes, and people.
We have begun expanding and enhancing education
and awareness-building for employees and promoting

more balanced security measures, in order to adapt tothe current dramatically-changing environment and to
reduce future security risks. We see improving security
awareness as the last line of defense, so in addition to ourexisting strict governance, we are working to raise
security awareness by encouraging employees to takethe initiative and act independently. Our goal is to get
employees interested in the issues and have them takeownership of security, rather than taking a passive role.
Our mottos for this approach are “Jibungoto(ownership)”and “heartfelt empathy between employees”.（ Figure
3‐❶）

Figure 3‐❶ The ideal future form of security awarenessIn addition to our existing strict governance, generateawareness by employees taking the initiative and acting independently.

The important thing is to elevate the security awareness of each and every person
Key concepts: “Jibungoto（Ownership）” and “heartfelt empathy between employees”

Management
Enforcing governancemeasures(2) Self-directed action

Organizations(such as business units)

Enhancing knowledge
Sharing knowledge

Employee(1) Encouraging self-initiative
New security awareness-raising activities
Raising security awareness40

raise people's awareness of security around them bymaking them interested in it.
We use the newly-developed mascot character “Harry”
with animations, chats, and other means to get closer to
employees by making information dissemination more fun
and accessible.

Self-directed action: Green Aegis
I n M ay 20 21 we s t a r te d G r e e n A e g i s i n te r n a lcommunity activities as “behavior reform” to support
employees in their own independent actions on security
measures. (Figure 3‐❸)
The aim of this activity is to get employees interested insecurity issues, so that they independently acquire
knowledge and research the issues, and share thisknowledge with their colleagues.
Intra nets a nd de dic ate d Microsof t Te a ms* a repositioned as “communities for enjoyable involvementwith security, which spread with open sharing andharmony”. We use them to provide places for introducing
actions which we have taken, distributing videos that
employees have planned for themselves, and allowing
employees to freely exchange opinions and take theinitiative to get involved with security in ways which suitthem.

Figure 3‐❷ Harry's Security Activities

Figure 3‐❸ Green Aegis Activities

Mindset Reform

Behavior reform

1) Actions to gain empathy (recognition/* Microsoft Teams is a trademark or registered trademark of Microsoft Corporation in
the USA and other countries.

Actions to make each employee see security

understanding)as a personal matter and take the initiative in⇒ Get people interested in security.

their behavior.

2) Initiatives for instilling “Jibungoto(ownership)”⇒ Make people aware of
security issues around them.

Jibungoto

Since December 2020, we have been promoting“Harry's Security” for internal communications as a“mindset reform” to help employees see that security is an
issue that directly impacts them, and to encourage themto get involved independently. (Figure 3‐❷)
Security work tends to have a negative impression of
being difficult and tiresome, but this activity is intended toWorking to Raise Information Security AwarenessEncourraging self-initiative: Harry's Security⇒ Get people to learn,
investigate, and shareknowledge.

41

COLUMN

Product Security Technologies toProtect Clients' Businesses

Recent cyber attacks have targeted products and OT systems that are increasingly connected, and theresulting damage is increasingly severe. Legal regulation and standardization of product security is advancing
rapidly in every industry, and response is becoming indispensable for Clients' businesses.
Hitachi is working to develop various security technologies to protect Clients' businesses.

Promoting the development of product security technologies toprotect Clients' businesses
Cyber attacks used to target IT systems. More recently, products from vehicles to home appliances and OT
systems such as factories and social infrastructure have been connected to the internet and other networks,
exposing them to unprecedented cyber attack threats. Many of these “Internet of Things” (IoT) systems are directly
linked to people's lives and safety, making it extremely important for customer companies, which bear
responsibility for sales and operations, to protect the security of their own products. The enactment andmandatory enforcement of legal regulation and guidelines about product security is advancing rapidly in every
industry and around the world, and compliance is becoming indispensable for Clients' businesses. Security must
be considered in all parts of the product life cycle, through design, development, and operation. In recent years,
products which have been in operation for long periods are getting connected, and the software they run is
becoming increasingly complicated, so security needs in the operation phase are rising. Hitachi is developing
product security technologies for the operation phase, such as intelligent threat analysis for PSIRT and security
operation technology for vehicles.

Intelligent threat analysis technology for PSIRTs
Customer companies are calling for the establishmentof a PSIRT (Product Security Incident Response Team)
organization to protect product security in the operation
phase. A PSIRT monitors product-related vulnerability
information, judges the impact of such information on
products, and makes decisions about responses. A
PSIRT gathers large amounts of information about

product security every day, from the internet, externalorganizations, and other sources. This information must
be sorted appropriately and its impact determined. Expert
personnel well versed in security and our products are
essential for that work. The extension of the IoT into
products is accelerating and the volume of security
information grows day by day, but it was difficult to train

Figure ❶ Summary of intelligent threat analysis for PSIRTs

ISAC

AsIs

NVD

Primary analysis
Sorting

Information gathering

Secondary analysis
Detailing

Development/judgment

Public announcements
Information transmission

Public vulnerabilities

Web

Operator

ISAC

Threat intelligence
Service provided

Threats, cases, etc.

NVD

ToBe Public vulnerabilities
Web

Threats, cases, etc.

42

AnalystCustomer PSIRTInformation gathering

Operator

Operator

AI utilization
Primary analysis
Sorting

Operator
・Technical Explanations
・Product Impact
・Risk assessment (CVSS)

Incident information
management

AnalystVulnerability
information

Development department
Quality department

Supplier

Investigation/examination

Investigation/examination

Repair and Countermeasure

Repair and Countermeasure

Development department
Quality department

Supplier

Investigation/examination

Investigation/examination

Repair and Countermeasure

Repair and Countermeasure

Customer PSIRT

Secondary analysis
Detailing

Development/judgment

Public announcements
Information transmission

Shared database
Incident information
management

Vulnerability
information

and maintain the expert personnel needed for the work.
That made scalability a challenge.
Hitachi is addressing that challenge by developing
AI-based intelligent threat analysis for PSIRT. This
technology uses AI to automatically judge whether
collected security information is related to the relevant
field and the client company. Using AI with judgment

models trained on IT-related and industry-specific security
information can eliminate 80% of the information that
PSIRT experts would have had to see. The intelligent
threat analysis delivery service that Hitachi provides uses
this technology, helping to provide client companies andindustries with timely analysis reports tailored to theirneeds. (Figure ❶)Security operation technology for vehicles
The risks of cyber attacks on connected cars and otherve h i c l e s a r e g row i n g. R e g u l a t i o n s o n ve h i c u l a r
cybersecurity are enacted by UNECE WP29. They call forthe maintenance of security at the operation stage, in
addition to measures applied during manufacturing. In
response, automakers are working to set up vehicle
security operation centers to monitor vehicles and detectand handle attacks. We apply our experience with SOCs
(Security Operation Centers) for IT and our knowledge ofdeveloping vehicular devices to develop technologies andprovide solutions for vehicle-related SOCs.
Hitachi's vehicular SOCs monitor logs for vehicles,
centers, mobile connections, etc. in real time, detectattacks quickly, and limit the damage. We provide
systems that extend from onboard systems to the cloudand support fast and accurate incident responses. On thevehicle side, in particular, we ascertain the features thatare unique to onboard systems, design and placemonitoring logs, and provide software to efficiently collectlogs from vehicles into monitoring systems. We usecomprehensive analysis of logs collected at onboard
gateways to estimate attack scenarios, and detect thesigns of an attack from the moment an attacker entersfrom outside the vehicle.

The creation of appropriate attack-detection rules isessential for the effective analysis of logs in monitoring
systems. The creation of attack detection rules inconventional IT-oriented SOCs required the accumulationof attack cases, but the small body of cases of attacks on
cars was a problem, and it would have been difficult toapply the system as it was. In the absence of cases, it'snecessar y to comprehensively imagine all kinds ofattacks, but to keep up with the release timing of vehicle
models, detection rules had to be designed efficiently. We
responded the situation by developing analytical cyberattack detection technology for vehicular SOCs as a way
to create detection rules even when there were few attack
cases. By that method, we used our security design
technology to analytically identify threats to vehicles, andthen assigned the attacker's behavior to categories which
we could infer from attack examples accumulated in the
IT field. We could then convert attacker behaviors toapply to the vehicular field on the basis of differences
between the IT and vehicular fields. That approachenabled us to efficiently create detection rules withoutomissions. We use that technology in our solutions forvehicular SOCs. (Figure ❷)Figure ❷ Summary of security operations for vehicles
Connected infrastructure for vehicles
Connected
service logs

Connected
service

SOC for vehicles

Log collection system

Log monitoring system (SIEM)

・Log collection

Analytical attack detection technology

Log database・Log monitoring
Detection rules
・Abnormality
for vehicles
detection

Automakers

Network
service logs
Control logs

Connected car
IVI
OnboardgatewayECU

TCU

SOC Agent・Onboard system log collection

ECU

ECU

SOC process management system
・Ticket management
・Incident database・Threat database

Executives
ReportIRT
Development/
quality assurance
departments

Incident analysis
・Triage・Primary/secondary analysis
・Response proposal formulation

43

Third-Party Evaluation and Certification
Hitachi promotes third-party evaluation and certification in relation to information security management.

Status of ISMS certification
The following Hitachi organizations have gained ISMS certification from the ISMS Accreditation Center (ISMS-AC)
based on the international standard for information security management systems (ISO/IEC 27001) (As of the end of
August 2022). The names of the organizations are as they appear in the list of ISMS-accredited organizations
maintained by the ISMS-AC.

● Hitachi, Ltd. (Financial Information Systems 2nd Division,
Governmental & Public Financial Systems Division)● Hitachi Systems, Ltd(Public & Social Platform Services
Division)● Hitachi, Ltd. (Social Infrastructure Systems Business Unit,
Control System Platform Division)● Hitachi Systems, Ltd. (Contact Center & BPO Services
Division)● Hitachi, Ltd. (Service & Platform Business Unit Service
Platform Division, Lumada CoE, Software CoE, Application
Services Division Lumada Solutions Operation)● Hitachi Systems, Ltd. (Solution Business Administration
Group Advanced Support Platform Design Department)● Hitachi, Ltd. (Social Infrastructure Information Systems
Division, Strategy Planning Division, Energy Systems
Division 1, Energy Systems Division 2, Energy Solutions
Division and Transportation Information Systems Division)● Hitachi, Ltd. (Social Infrastructure Systems Business Unit,
Government & Public Corporation Information Systems
Division)● Hitachi, Ltd. (Water & Environment Business Unit, Water
Solutions Division, Digital Solutions Business Development
D e p a r t m e n t, Wa te r & E nv i ro n m e n t B u s i n e s s U n i t,
Environment Solutions Division, Information System
Engineering Department, Connective Industries Division,
Information Technology & Business Process Innovation
Division, Secure IT Innovation Center, Secure Information
Group)● Hitachi, Ltd., Social Infrastructure Systems Business Unit,
Defense Systems Division (Yokohama Office), Corporate
Sales & Marketing Group, Systems & Services Business
Sales Management Division, Defense Systems SalesManagement, and Hitachi Advanced Systems Corporation(HQ)● Hitachi Channel Solutions, Corp.

● Hitachi Social Information Services, Ltd. and Okinawa
Hitachi Network Systems, Ltd.
● Japan Space Imaging Corporation● Hitachi Information & Telecommunication Engineering, Ltd.
(Customer Support Center)● Hitachi Information Engineering, Ltd.

● Hitachi ICT Business Services, Ltd. (Product Support
Department Media Service Group)● Kyushu Hitachi Systems, Ltd.

● Shikoku Hitachi Systems, Ltd.

● Hitachi Systems, Ltd. (Financial Platform Division Service
Office 2, ATM Services Department)● Hitachi Systems, Ltd. (Public & Social Business Group)

44● Hitachi Systems, Ltd. (Managed Services Division, Cloud
Services Division, Business Services Division, Security
Services Division)● Hitachi Systems Power Services, Ltd. (Managed Services
Division, Platform Services Office)● Hitachi Systems Field Services, Ltd. (Branch HQ, Tokyo
Branch, Tokyo Office)● Hokkaido Hitachi Systems, Ltd. (Management PlanningGroup, Administration Division, Public & Social Systems
Management Division, Corporation Services Business
Division, Business Planning Department, Systems Division,
Systems Section 1, Group 1, Group 2, Systems Section 2,
Platforms Division Section 1, Facilities Division Promotion
Department, Facilities Service Group, Platforms Division
Section 2 Sales Management Division, Sales Planning
Division, Public & Social Sales Division, Sales Section 1,
Sales Group 1, Sales Section 2, Corporate Sales Division,
S a l e s S e c t i o n 1, S a l e s G r o u p 1, S a l e s S e c t i o n 2
Production Technology Management Division, Quality
Assurance Division)● Hitachi Solutions Create, Ltd.

● Hitachi Solutions West Japan, Ltd. (Cloud Plat form
Operating Support Department, Financial Solution Division
1 Department 3)● Hitachi Solutions East Japan, Ltd.
● Hitachi Solutions, Ltd.

● Hitachi Power Solutions Co., Ltd.
● Hitachi SC, Ltd. (HQ)

● Hitachi Foods & Logistics Systems Inc.
● Hitachi Pharma Information Solutions● Hitachi KE Systems, Ltd. (Tokyo Development Center)● Hitachi High-Tech Solutions Corporation (Solution Center)● Hitachi Management Partner Corp.(Business Planning
Division, Human Resources Solution Division)

Status of IT security evaluation and certification

Figure 4‐❶Main products certified under the Japan Information Technology Security Evaluation and Certification Scheme

TOE type*1

Product

Certification No. Evaluation assurance level*2

HiRDB/Parallel Server Version 8 08-04

Database management system

C0225

EAL4+ALC_FLR.1

HiRDB/Single Server Version 8 08-04

Database management system

C0216

EAL4+ALC_FLR.1

HiRDB Server Version 9 (Linux Edition) 09-01

Database management system

C0351

EAL2+ALC_FLR.2

Smart Folder PKI MULTOS application 03-06

Smart card application software

C0014

EAL4

Hitachi Device Manager Software,

Access Control Device andC0536

EAL2+ALC_FLR.1

Hitachi Tiered Storage Manager Software 8.0.1-02

Systems

Storage device control software

C0514

EAL2+ALC_FLR.1

Storage device control software

C0513

EAL2+ALC_FLR.1

Microprogram 0917/A for Hitachi Unified Storage 110

Storage device control software

C0421

EAL2

Microprogram 0917/A for Hitachi Unified Storage 130

Storage device control software

C0420

EAL2

Finger Vein Authentication Device UBReader2

Biometric device

C0332

EAL2

Certificate Validation Server 03-00

PKI

C0135

EAL2

CBT Engine 01-00

Major application of CBT

C0288

EAL1+ASE_OBJ.2、Third-Party Evaluation and Certification

The following table lists the key products certified under the Japan Information Technology Security Evaluation andCertification Scheme run by the Information-technology Promotion Agency (IPA) based on ISO/IEC 15408. (As of
August 2022 [Includes products in the certified products archive list]) (Figure 4‐❶)

Hitachi Virtual Storage Platform G1000,
Hitachi Virtual Storage Platform VX7 Control Program
80-01-25-00/00（R8-01A-06_Z）
Hitachi Unified Storage VM Control Program73-03-09-00/00（H7-03-10_Z）

Hardware: D, Software: 03-00

examination system
Security Threat Exclusion System SHIELD/ExLink-IA 1.0

Security Management Software

ASE_REQ.2、ASE_SPD.1
C0090

EAL1

*1 TOE (Target Of Evaluation)
A TOE is defined as a product such as software or hardware that is the subject of evaluation. This can include written guidance for managers and users (user manuals, guidance,
installation procedures etc.).
*2 EAL (Evaluation Assurance Level)
ISO/IEC 15408 stipulates the degree of assurance of evaluation items (assurance requirements) in a range from EAL1 to EAL7. A higher level means more stringent evaluation.
・EAL1 involves the validation and testing of security functions and the objective evaluation of guidance used to maintain security.
・EAL2 adds vulnerability analysis with respect to typical attack vectors and evaluation from the perspective of product integrity from manufacturing to commencement of operation. This
adds a security perspective to the standard development lifecycle.
・EAL3 adds to the assurance of EAL2 by evaluating the development environment to assure the comprehensiveness of testing and prevent tampering of the product during
development.
・EAL4 is considered a high level of assurance for general consumer products, and evaluates the entire development lifecycle including the integrity of development assets in thedevelopment environment, the source code of the product, and the trustworthiness of personnel.
・ALC_FLR.1 objectively evaluates the basic procedures for providing the necessary patches when a security defect is found in the product. You can use this assurance level to add
assurance requirements not included in the EAL of the standard. The level is expressed as EAL2+ALC_FLR.1, for example.
ALC_FLR.2 requires that procedures are in place to accept reports about vulnerability information and to notify users.

45

Third-Party Evaluation and Certification

Status of testing and certification of cryptographic modules
The following table lists the main products certified by the Japan Cryptographic Module Validation Program (JCMVP)
based on ISO/IEC 19790 operated by the IPA or the Cryptographic Module Validation Program (CMVP) based on FIPS
140-2 operated by NIST in the United States and CSE in Canada. (As of August 2022 [Includes products in the CMVP
“historical list”]) (Figure 4‐❷)
Figure 4‐❷Main products certified by the Cryptographic Module Validation Program (CMVP)

Product

Certification No.

Hitachi Vantara Cryptographic Library

4239

Level 1

Hitachi Virtual Storage Platform (VSP) Encryption Board for NVMe

4194

Level 1

Hitachi Virtual Storage Platform (VSP) Encryption Module

4183

Level 2

Hitachi Virtual Storage Platform (VSP) Encryption Board for NVMe

4076

Level 1

Hitachi Virtual Storage Platform (VSP) Encryption Module for NVMe

3803

Level 2

Hitachi Flash Module Drive HDE

3314

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Board

3279

Level 1

Hitachi Virtual Storage Platform（VSP）Encryption Module

3278

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Adapter

2727

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Board

2694

Level 1

Hitachi Virtual Storage Platform（VSP）Encryption Module

2462

Level 2

Hitachi Virtual Storage Platform（VSP）Encryption Engine

2386

Level 1

Hitachi Unified Storage Encryption Module

2232

Level 1HIBUN Cryptographic Module for User-Mode 1.0 Rev.2

JCMVP #J0015、CMVP#1696

Level 1HIBUN Cryptographic Module for Kernel-Mode 1.0 Rev.2

JCMVP #J0016、CMVP#1697

Level 1HIBUN Cryptographic Module for Pre-boot 1.0 Rev.2

JCMVP #J0017、CMVP#1698

Level 1

Keymate/Crypto JCMVP Library (Solaris*1and Windows*2editions）

JCMVP #J0007

Level 1

Keymate/Crypto JCMVP Library

JCMVP #J0005

Level 1

*1 Solaris is a trademark or registered trademark of Oracle Corporation, its subsidiaries, and affiliated companies in the USA and other countries.
*2 Windows is a trademark or registered trademark of Microsoft Corporation in the USA and other countries.

46

Level

Overview of the Hitachi Group
Company Profile（As of March 31, 2022）
Corporate name

Hitachi, Ltd.

Incorporated

February 1, 1920 (founded in1910)

Head office

1-6-6 Marunouchi,Chiyoda-ku, Tokyo,Japan

Representative*1

Keiji Kojima, President and COO

Capital461.731 billion yen

368,247

Number of employees(Japan: 156,768, outside Japan: 211,479)
Number of consolidated
subsidiaries

853(Japan: 157, outside Japan: 696)

Numberof equity-method
associates andjoint ventures

287*1 As of June 23, 2021

Consolidated Financial Highlights for Fiscal 2021,
Based on the International Financial Reporting Standards (IFRS)Revenue

10,264.6 billion yen（118% year on year）

Adjusted operating income

7.2％（up 1.5 percentage points, year on year）

EBIT

850.9 billion yen（up 6 billion yen, year on year）*2

Net income attributable to Hitachi, Ltd. stockholders
583.4 billion yen（up 818 billion yen, year on year）
7.7％（up 1.3 percentage points, year on year）

ROIC

*3

*2 EBIT: Income from continuing operations before income tax, less interest income, plus interest charges.
*3 ROIC: Return on invested capital. Calculated as follows: ROIC = (NOPAT + Equity method gain/loss) ÷ Invested capital × 100. NOPAT (Netoperating profit after tax)
= Adjusted operating income × (1 – Tax burden). Invested capital = Interest-bearing debts + Capital.
Note: Hitachi's consolidated financial statement is prepared based on the International Financial Reporting Standards (IFRS).

■ Revenue, Adjusted Operating Income Ratio, and Net Income(billion yen)(billion yen)

12,00010,0009,480.6

9,368.6

8,767.2

8.0%

7.6%

8,000

1,200

10,264.6
8,729.1

1,000

7.2%

7.5%

5.7%
501.6

6,000

800

583.4
600

362.9
4,000

222.5
87.5

2,000
0

2017

2018

2019

2020

(Consolidated for FY 2021, based on IFRS)Others

942.7 billion yen（9％）

1,597.7 billion yen（15％）

0Adjusted operating
income ratio (%)(Consolidated for FY 2021, based on IFRS)Other Regions

Hitachi Metals

Automotive
System business

(FY)

Japan

708.1 billion yen（7%）
Employees Approx. 20,000

456.3 billion yen（4％）

1,024.9 billion yen（9％）

200■ Revenue and Share by Region■ Revenue and Share by Segment

Hitachi Construction
Machinery2021■ Revenue (left scale)■ Net income attributable
to Hitachi, Ltd.
stockholders (right scale)

400

Digital Systems & Services

2,153.6 billion yen（20％）
Revenue

10,264.6 billion yen

Europe1,299.4 billion yen（13%）
Employees Approx. 43,000
North America

Green energy & mobility

2,051.0 billion yen（18％）

Connective Industries

2,752.8 billion yen（25％）

4,187.0 billion yen（41%）
Employees Approx. 157,000

1,555.1 billion yen（15%）
Employees Approx. 28,000

ASEAN, India, andOther Asian Regions

1,183.2 billion yen（11%）
Employees Approx. 70,000

Revenue by RegionJapan4,187.0 billion yen
Outside Japan

6,775 billion yen

China1,331.6 billion yen（13%）
Employees Approx. 51,000

Note: Revenue by segment includes intersegment transactions.

47

Information Security Risk Management Division
1-6-6 Marunouchi, Chiyoda-ku, Tokyo 100-8280
Tel: 03-3258-1111

All product names and services mentioned herein are registered trademarks or trademarks in Japan and/or other countries.