【tentative translation】

System for Ensuring Stable Provision ofSpecified Essential Infrastructure Services
under the Economic Security Promotion Act

September 4, 2024

[Notes]• Only the Japanese laws has legal effect, and this document is only reference materials for understanding. We cannot hold responsibility forany problems arise from the use of this document, so please refer to the official Japanese laws and regulations published in need．
• You can use this document for any purpose without our permission as long as you make no changes to it. If you use only certain slides orparts of slides, please add the URL of the webpage where this full document can be found.
• Please refer only to the latest version of this document, as it is subject to revision.

Outline of the System for Ensuring Stable Provision of Essential Infrastructure Services⚫

This system aims to prevent critical facilities of essential infrastructures from being misused as a means of disrupting the stable provisionof infrastructure services. Under this system, the government designates essential infrastructure business (specified essential
infrastructure business) and service providers (specified essential infrastructure service providers) under certain criteria, and such service
providers that introduce government-designated critical facilities (specified critical facilities) or entrust the maintenance and management,
etc. of such facilities to a third party must give prior notification to the government and undergo its screening. The system started on May
17, 2024, under the Economic Security Promotion Act, which came into effect last November.

⚫

When concluding that the specified critical facility included in a submitted plan has a high risk of being misused as a means of disrupting
the stable provision of infrastructure services, the government may recommend (or order) that the service provider submitting the plan takethe necessary measures to prevent disruptive actions before introducing the facility or entrusting its maintenance and management, etc. toa third party.

System structure
Supplier/contractor(vendor, etc.)(0) Conclude a contract
on introduction or
entrustment, etc.

Specified essential
infrastructure service
provider(2) Conduct screening(for 30 days (which can be extended or shortened)）(1) Submit an introduction, etc. plan(5) (If necessary)
Issue a recommendation (or order)

Competent
minister(3) Hold consultations if
necessary(4) Give opinions

Prime Minister
Relevant
administrative organ(1) Regulated business sectors…The Act lists the regulated business sectors as shown below. The Cabinet Order details the regulated business and services
within each business sector.
1. Electricity
2. Gas3. Oil5. Railway
4. Water Supply
6. Motor Truck
8. Port and Harbor
7. International Maritime Cargo
9. Air Transport
10. Airport
Transportation
Transportation (※)
11.Telecommunications
12.Broadcasting
13. Postal Service
14. Financial Services
15. Credit Cards(2) Regulated service providers (specified essential infrastructure service providers)…For each business sector, the competent minister establishes designation
criteria under the Ministerial Order and designates and publicly announces regulated service providers.
※On 17 May 2024, an amendment law was published adding the sector of “Port and Harbor Transportation”. It will come into effect on the date specified by a Cabinet Order within aperiod not exceeding one year and six months from the date of publication.

1

Timeline of the System for Ensuring Stable Provision of Essential Infrastructure Services

May 18, 2022

Promulgation of the Economic Security Promotion Act

April 28, 2023

Cabinet approval and release of the guiding principles** Guiding Principles on Ensuring Stable Provision of Specified Essential Infrastructure Services by Preventing Specified Disruptive Actions

August 9

Promulgation of the Cabinet Order (related to specified essential infrastructure business) and the Ministerial Orders(related to designation criteria for service providers, specified critical facilities, etc.) (enforced on November 1)(September 15 to October 14: Public comment process for secondary drafts of ministerial orders)(October 6: Release of a technical guide*1 [provisional] and bidding guidelines*2)*1: Guide to the System for Ensuring Stable Provision of Specified Essential Infrastructure Services under
the Economic Security Promotion Act*2: Guidelines on the Consistent Operation of the Bid Contract System with the System for Ensuring Stable
Provision of Specified Essential Infrastructure Services under the Economic Security Promotion Act

November 1

November 16

Partial enforcement of the Act (related to specified essential infrastructure business, designation criteria for specified essential
infrastructure service providers, specified critical facilities, etc.)

Designation of specified essential infrastructure service providers (a total of 210 designated service providers)(Note) Four specified essential infrastructure service providers were designated and one was canceled its designation afterwards (a total of 213
designated service providers, as of September. 4, 2024).

Promulgation of the Minitrial Orders (related to critical maintenance and management, etc., information to be provided, recommendation
procedures, etc.) (enforced on November 17)

November 17

Partial enforcement of the Act (related to critical maintenance and management, etc., information to be provided, recommendation
procedures, etc.)
Public announcement of designation of specified essential infrastructure service providers (listed in the official gazette)* Six-month transition period (from November 17, 2023 to May 16, 2024)

・ Activities to raise the public awareness of the system (including holding explanatory meetingsin eight cities and releasing explanatory material on the website of the Cabinet Office)・ Creation and release of technical guides

May 17, 2024

System begins operating (start date of the obligation to notify)2

Scope of Regulation⚫ The government has specified business, service providers, specified critical facilities, and critical maintenance and management, etc. to be regulated in Cabinet andMinisterial Orders.
➢ Specified essential infrastructure business: The Act lists the regulated business sectors (electricity, telecommunications, broadcasting, financial services, etc.), and the Cabinet
Orders detail the regulated business and services within each business sector.
➢ Specified essential infrastructure service provider: The Ministerial Order provides designation criteria for each business sector and designates specified essential infrastructureservice providers.
➢ Specified critical facility: The Ministerial Order specifies facilities that are critical to the stable provision of services and can be misused to disrupt the stable provision of services.
➢ Critical maintenance and management, etc.: The Ministerial Order specifies maintenance and management, etc. that is critical to the maintenance of the functions of a specified
critical facility or the stable provision of services and could be misused to disrupt the stable provision of services.

Screening to identify the risk of being misused as a means of disrupting the stableprovision of infrastructure services from outside Japan⚫ Regulated business sectors

Electricity

Gas

Water

Railways

International
maritime
cargo

Port and Harbor
Transportation（※）

Airports

Postal service

TelecommunicationsFinancialservicesOil
Trucktransport

Component
facility a1

SupplyAir Transport

Broadcasting

Credit cards※Added by amendment of the law in 2024
(not enforced yet).

Specifiedcriticalfacility A

Facility B(Outside the scopeof regulation)(Outside the scope of
regulation)

Subcontractor of
criticalmaintenance andmanagement, etc.

Supplier offacility a3(Outside the scope of
regulation)(Not engaged in
critical maintenanceand management, etc.)

Contractor(Outside the scope of
regulation)of regulation)

・・Supplier ofcomponent
facility a2・・・Contractor of
criticalmaintenance andmanagement, etc.

Specified essential
infrastructureservice provider X

Component
facility a2

Facility a3

Contracting out maintenanceand management, etc.

Specified essential infrastructure business(detailed by the Cabinet Order)

Service provider Y(Outside the scope

Supplier of
specified criticalfacility A

Supplier ofcomponent
facility a1

Facility C(Outside the scopeof regulation)

3

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act)/
Designation of specified
essential infrastructurebusiness (Cabinet Order)
Electricity Retail

General electricity
transmission anddistribution

Designation criteria for
specified essential
infrastructure service
providers (Ministerial Order)―

General electricity
transmission anddistribution utility as
defined in Art. 2, para. (1),item (ix) of the Electricity
Business Act (All generalelectricity transmission anddistribution utilities aredesignated.)() Electricity

1Electricity
transmission

Electricity transmission
utility as defined in Art. 2,
para. (1), item (xi) of theElectricity Business Act (Allelectricity transmission utilities
are designated.)Service providers designated as
specified essential infrastructureservice providers(as of Sep. 4, 2024)

Specified critical facilities(Ministerial Order)

Criticalmaintenance andmanagement, etc.
(Ministerial Order)

―

―

―

The Okinawa Electric Power
Supply-and-demandCompany, Inc.
control systems
Kansai Transmission and Distribution, * Facilities responsible forInc.
central control critical to
Kyushu Electric Power Transmission power supply
and Distribution Co., Inc.
Shikoku Electric Power Transmission& Distribution Company, Inc.
(Yonden T&D)
Chugoku Electric Power
Transmission & Distribution
Company, Inc.
Grid control systems
Chubu Electric Power Grid Co., Inc.
* Facilities responsible for
TEPCO Power Grid, Inc.
central control critical to
Tohoku Electric Power Network Co.,power supply
Inc.
Hokuriku Electric Power
Transmission & Distribution
Company
Hokkaido Electric Power Network,
Inc.
J-POWER Transmission Network
Co., Ltd.
Fukushima Transmission Co., Ltd.
Hokkaido Northern Wind Power
Transmission Co., Ltd.

Electricity
distribution

electricity distribution utilities aredesignated.)Specified electricity
transmission anddistribution―

No designated service providers(There are no electricity distribution
utilities.)

・ Monitoring and control servers
・ Operation servers
・ Applications for grid control
operations, OS, and software

・ Maintenanceandmanagement
・ Operations
・ Monitoring and control servers
・ Operation servers
・ Applications for grid control
operations, OS, and software

Grid control systems* Facilities responsible forcentral control critical topower supply

・ Monitoring and control servers
・ Supply and demand calculation
servers
・ Applications for supply-and-demand
control operations, OS, and software* Facilities responsible forcentral control critical topower supply

Grid control systems

・ Monitoring and control servers
・ Operation servers
・ Applications, OS, and software forsystem control operations* Facilities responsible forcentral control critical topower supply――

・ Monitoring and control servers
・ Supply and demand calculation
servers
・ Applications for supply-and-demand
control operations, OS, and software

Supply-and-demand
control systems
Electricity distribution
utility as defined in Art. 2,
para. (1), item (xi)-3 of theElectricity Business Act (AllComponent facilities(Ministerial Order)

―

―

4

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)() Electricity

1Electricity
generation

Specified wholesale
supplyDesignation criteria for
specified essential
infrastructure service
providers (Ministerial Order)

Generation system owned:
A generation capacity of
500,000 kW or more
* The criteria ensure that mostof Japan’s total generation
capacity is covered.

Service providers designated as specified
essential infrastructure service providers(as of Sep. 4, 2024)

Akita Yurihonjo Offshore Wind LLC
Kashima Power Co. Ltd.
Kobe Steel, Ltd.
Kobelco Power Kobe 2 Co., Ltd.
Kobelco Power Moka Inc.
JERA Co., Inc.
Chiba-Sodegaura Power Co., Ltd.
The Kansai Electric Power Company, Inc.
Kyushu Electric Power Company, Inc.
Yonden Shikoku Electric Power Co., Inc.
Oban Joint Power Co., Ltd.
Soma Kyodo Power Company, Ltd.
The Chugoku Electric Power Company, Inc.
Chubu Electric Power Company, Inc.
Electric Power Development Co., Ltd.
Tokyo Electric Power Company Holdings, Inc.
TEPCO Renewable Power, Inc.
Tohoku Electric Power Co., Inc.
Nakoso IGCC Power GK
The Japan Atomic Power Company
Nippon Steel Corp.
Hibiki Power Generation LLC.
Himeji Natural Gas Power Generation Co., Ltd
Hirono IGCC Power GK
Fukushima Gas Power Co., Ltd.
Hokuriku Electric Power Company
Hokkaido Electric Power Co., Inc.
Mitsubishi Heavy Industries, Ltd.

Aggregated power: 500,000
Enel X Japan K.K.
kW or more
* The criteria ensure that mostof Japan’s total generation
capacity is covered.

Chubu Electric Power Miraiz Company, Inc.
TEPCO Energy Partner, Inc.

Specified criticalfacilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)

Output control units* Facilities responsible
for central control criticalto power supply
・ Maintenanceandmanagement
・ Operations

Energy management
systems* Facilities responsible
for central control criticalto power supply

Component facilities(Ministerial Order)

・ Monitoring and control
servers
・ Control units (boiler
monitoring and control units,
turbine monitoring andcontrol units, etc.)
・ Applications, OS, andsoftware・ Monitoring and control
servers
・ Applications, OS, andsoftware5

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)
Gas retail business

Designation criteria for
specified essential
infrastructure service
providers (Ministerial Order)―

Number of gas meters
General gas pipeline installed: 300,000 or more
* The criteria ensure that most ofservicethe gas customers in Japan arecovered.

(
) Gas

2

Specified gas
pipeline service

Service providers designated as
specified essential infrastructureservice providers(as of Sep. 4, 2024)

Transporting 1 billion m3 or
more of gas per year for
suppliers
andmaintaining and operating
pipelines connected to thepipelines of general gas
pipeline service providers

Osaka Gas Network Co., Ltd.
Energy Sola Platforms Co., Ltd.
Keiyo Gas Co., Ltd.
Saibugas Co., Ltd.
Shizuoka Gas Co., Ltd.
Gas Bureau, City of Sendai
Tokyo Gas Network Co., Ltd.
Toho Gas Network Co., Ltd.
Hiroshima Co., Ltd
Hokuriku Co., Ltd.
Hokkaido Gas Co., Ltd.

Ogishima City Gas Supply Co., Ltd.
Inpex Corporation
JERA Co., Inc.
Japan Petroleum Exploration Co.,Ltd.

* Those who supply a large
amount of gas to the service
areas of general gas pipeline
service providers are designated.

Gas manufacturingbusiness

Maintaining and operating agas manufacturing facility
with a production capacityof 200,000 m3 or more perhour* The criteria ensure that most ofJapan’s total gas manufacturing
capacity is covered.

Osaka Gas Co., Ltd.
Inpex Corporation
JERA Co., Inc.
The Kansai Electric Power Company,
Inc.
Shimizu LNG
Daigas G&P Solution Co., Ltd.
Tokyo Gas Co., Ltd.
Toho Gas Co., Ltd.
Hibiki LNG Co., Ltd.
Hokkaido Gas Co., Ltd.

Specified critical facilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)――

Control systems forhigh- and mediumpressure gas supply
facilities* Facilities responsible forcentral control critical to gas
supplyControl systems forgas manufacturing
units* Facilities responsible forcentral control critical to gas
supply―・ Monitoring and control servers
・ Applications, OS, and software* Facilities responsible forcentral control critical to gas
supplyControl systems forhigh- and mediumpressure gas supply
facilities

Component facilities(Ministerial Order)

・ Maintenanceandmanagement
・ Operations

・ Monitoring and control servers
・ Applications, OS, and software

・ Monitoring and control servers
・ Control units (storage tank control
units, carburetor control units,etc.)
・ Applications, OS, and software

6

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)

Oil refining

Designation criteria for
specified essential
infrastructure service
providers (Ministerial Order)

Oil refiner as defined in Art.
2, para. (5) of the Oil
Stockpiling Act that owns an
oil distillation facility* All oil refiners are designated.

(
) Oil

3

Petroleum gas
import business・ Percentage of Japan’s total
petroleum gas import: 1% or
more
and・ Main use of imported oil:
Fuel
* The criteria ensure that most ofJapan’s total petroleum gas
import is covered.

Service providers designated as
specified essential infrastructureservice providers(as of Sep. 4, 2024)
Idemitsu Kosan Co., Ltd.
ENEOS Corporation
Osaka International Refining
Company, Limited
Kashima Aromatics Co., Ltd.
Kashima Oil Co., Ltd.
Cosmo Energy Holdings Co., Ltd.
Showa Yokkaichi Sekiyu Co., Ltd.
Taiyo Oil Company, Limited
TOA Oil Co., Ltd.
Fuji Oil Company, Ltd.
Astomos Energy Corporation
Iwatani Corporation
Eneos Globe Corporation
Osaka Gas Co., Ltd
Japan Gas Energy Corporation
GYXIS Corporation
National Federation of Agricultural
Cooperative Associations
Tokyo Gas Co., Ltd.

Specified critical facilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)

Control systems

Component facilities(Ministerial Order)

・ CPU (central processing unit)
・ Control applications andsoftware* Facilities responsible forcentral control critical to oil
supply・ Maintenanceandmanagement
・ Operations

Control systems* Facilities responsible forcentral control critical to oil
supply・ CPU (central processing unit)
・ Control applications andsoftware7

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)

Water supply
service other thansmall-scale watersupply service() Water4

Wholesale watersupply service

Small-scale watersupply service

Designation criteria for
specified essential
infrastructure service
providers (Ministerial
Order)

Service providers designated as specified essential
infrastructure service providers(as of Sep. 4, 2024)

City of Sapporo (Sapporo City Water Supply Service)
City of Sendai (Sendai City Water Supply Service)
Saitama City (Saitama City Water Supply Service)
Chiba Prefecture (Chiba Prefecture Water Supply
Service)Tokyo Metropolitan Government (Tokyo Metropolitan
Population served: More
Water Supply Service)than 1 million
Kanagawa Prefecture (Kanagawa Prefecture Water* This number is the
Supply Service)
population that cannot be
City of Yokohama (Yokohama City Water Supply Service)covered by emergency water City of Kawasaki (Kawasaki City Water Supply Service)supply from other
City of Nagoya (Nagoya City Water Supply Service)municipalities and prefectures. City of Kyoto (Kyoto City Water Supply Service)
City of Osaka (Osaka City Water Supply Service)
City of Kobe (Kobe City Water Supply Service)
The City of Hiroshima (Hiroshima City Water Supply
Service)
City of Kitakyushu (Kitakyushu City Water Supply Service)
Fukuoka City (Fukuoka City Water Supply Service)

Specified criticalfacilities(Ministerial Order)

Monitoring andcontrol systems
for water
purification
facilities* Facilities
responsible forMiyagi Prefecture (Sennan and Senen Wide-Areacentral control
Maximum daily water supply Wholesale Water Supply Service)critical to watercapacity: More than 500,000 Saitama Prefecture (Saitama Prefecture Wholesale Water
purification
m3
Supply Service)* This number is the same as Aichi Prefecture (Aichi Prefecture Wholesale Water
the maximum daily water
Supply Service)supply capacity for water
Okinawa Prefecture (Okinawa Wholesale Water Supply
supply services.
Service)* As these service providers
Kitachiba Water Supply Authority (Kitachiba Wide-Area
do not supply water directly to Wholesale Water Supply Service)users, the maximum daily
Kanagawa Water Supply Authority (Kanagawa Prefecture
water supply capacity has
Wide-Area Wholesale Water Supply Service)
been adopted as the criterion, Osaka Water Supply Authority (Osaka Water Supply
instead of the served
Authority Wholesale Water Supply Service)
population.
Hanshin Water Supply Authority (Hanshin Water Supply
Authority Wholesale Water Supply Service)――

Critical maintenanceand management, etc.
(Ministerial Order)

Component facilities(Ministerial Order)

・ Maintenanceandmanagement
・ Operations

・ Monitoring and control
servers for water
purification
・ OS for monitoring andcontrol of water
purification (excluding
auxiliary OS not directly
involved in monitoring
and control)・ Middleware formonitoring and control ofwater purification(excluding auxiliary
middleware not directly
involved in monitoring
and control)・ Applications formonitoring and control ofwater purification(excluding auxiliary
applications not directly
involved in monitoring
and control)

―

―

8

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Designated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)(

Operating distance: 1,000 km or
more) Railway

5

Type I railway
business* The criteria reflect thesubstitutability of service providers
based on their ability to provide
mass, high-speed, and punctual
transport services for medium- tolong-distance passenger travel.

Service providers designatedas specified essential
Specified critical facilities
infrastructure service providers(Ministerial Order)(as of Sep. 4, 2024)

East Japan Railway Company
West Japan Railway Company
Hokkaido Railway Company
Kyushu Railway Company
Tokai Railway Company

Critical maintenanceand management, etc.
(Ministerial Order)

Component facilities(Ministerial Order)

・ Server units for route control
systems・ Network units for route control
systems
・ OS
・ Programs for route control
systems

Train operation control
systems* Facilities responsible forcentral route control criticalto train operation(

・ Domestic share of actual
transport distance, the weightof transported cargo, and thenumber of owned trucks: 5% ormore) Truck transport

6() International maritime
cargo

7

Designation criteria for specified
essential infrastructure service
providers (Ministerial Order)

General trucking
business

Cargo liner
service businessand irregularroute business,
which mainlytransports between
Japanese ports
and ports inregions outside of
Japan

and
・ Having offices nationwide* The criteria ensure that about 30% Yamato Transport Co., Ltd.
of the total actual land transport
Nippon Express
distance, the total weight of cargo
Sagawa Express Co., Ltd.
transported by land, and the total
number of owned trucks in Japanare covered. The criteria also reflect
the scale of the trucking industry,
which has 60,000 operators
nationwide, and the substitutability ofservice providers through transport
by other service providers.

Domestic share of the sea
transport volume and the numberof operating vessels: 10% orNippon Yusen Kabushiki Kaisha
more
Mitsui O.S.K. Lines, Ltd.
* The criteria ensure that about half
Kawasaki Kisen Kaisha, Ltdof the total sea transport volume andthe total number of operating
vessels in Japan are covered.

Transport and delivery
control systems* Facilities responsible forcentral control of delivered
cargo

Loading and unloading
management systems* Facilities responsible forcentral yard planning forloading and unloading・ Maintenanceandmanagement
・ Operations

・ Server units for truck operation
management
・ Programs for truck operation
management

・ Server units for stowage planning・ Software for stowage planning9

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)

Designation criteria for
specified essential
infrastructure service
providers (Ministerial Order)

Service providers designated as
specified essential infrastructureservice providers(as of Sep. 4, 2024)(

Share of international anddomestic flights among
8 Domestic scheduled specified domestic air
air transport service carriers: 25% or more
All Nippon Airways Co., Ltd.
International air* The criteria ensure that at least Japan Airlines Co., Ltd.
transport service
half of international and domestic) Aviation(

Airportestablishment and9managementbusiness
Public facility
operating projects
for airports

flights by specified domestic air
carriers are covered.

) Airports

・ Number of passengers using
the airport per year: 10
million or moreand・ Managing and operating
an airport that serves as
an international ordomestic air transport hub(excluding governmentmanaged airports)* The criteria ensure that large
airports with a significant
socioeconomic impact arecovered. (Operators ofgovernment-managed airports
are not designated).

Narita International Airport
Corporation
New Kansai International Airport Co.,Ltd.
Kansai Airports
Fukuoka International Airport Co.,Ltd.
Hokkaido Airports Co., Ltd.
Central Japan International Airport
Co., Ltd.

Specified critical facilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)

Flight planningsystems・ Server units for planning
・ OS
・ Programs for planning* Facilities responsible forflight planning essential toaircraft operation

Constant current
adjustment systems
for aerodrome lights* Facilities responsible forcontrol of lights that assist
in the safe take-off andlanding of aircraft

Component facilities(Ministerial Order)

・ Maintenanceandmanagement
・ Operations
・ Control boards
・ Operation and monitoring panel
・ Current control software

10

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated businesssectors (Act) /Designation of specified
essential infrastructurebusiness (Cabinet Order)

Designation criteria for specified
essential infrastructure service
providers (Ministerial Order)(

・ Having a Category I designatedtelecommunications facility(including providers of interprefectural telecommunications
services）
or・ Having a domestic share of 10％
or more of the number ofinternational submarine cables
or・ Having obtained thegovernment’s approval for its
Telecommunications
deployment plan for basebusiness requiring
stations for 5G communications
10 registrationorTelecommunications
・ Providing a messaging service
business requiringused by 60 million or more users
notification
and used for public services) Telecommunications* Service providers that meet the above
criteria provide a majority of domestic
fixed-line communications lines.
* Service providers that meet the above
criteria provide a majority of domestic
submarine cables.
* These service providers provide 5G
communications services that will play a
critical role in the future mobile network.
* These service providers provide amajority of the public with messaging
services fundamental to their daily lives.
Telecommunications
business listed in theitems of Art. 164, para.
(1) of theTelecommunications
Business Act―

Service providers
designated as specified
essential infrastructureservice providers(as of Sep. 4, 2024)

Nippon Telegraph andTelephone East Corporation
Nippon Telegraph andTelephone West Corporation
NTT Communications
Corporation
NTT Limited
NTT Docomo, Inc.
KDDI Corporation
Okinawa Cellular Telephone
Company
SoftBank Corp.
Rakuten Mobile, Inc.
LY Corporation

Specified critical facilities(Ministerial Order)

・ Switching facilities
・ Facilities that cancontrol
telecommunications
facilities
・ Facilities that canmanage subscribers
for communication
connection orauthentication・ Facilities that cancontrol and monitor
submarine cablesystems
・ Messaging facilities

Critical maintenanceand management, etc.
(Ministerial Order)

Component facilities(Ministerial Order)

・ Maintenanceandmanagement
・ Operations

・ Operational software
・ Node devices
・ Infrastructure system
・ Operational applications
・ OS
・ Servers
・ Systems with operation,
monitoring, or maintenancefunctions・ Systems for communicating
information related to message
services――* Facilities responsible forswitching and control oftelecommunications―

11

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated business sectors(Act) /
Designation of specified
essential infrastructurebusiness (Cabinet Order)

Designation criteria for
specified essential
infrastructure service
providers (Ministerial Order)

Service providers designated as
specified essential infrastructureservice providers(as of Sep. 4, 2024)

Specified criticalfacilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)

Component facilities(Ministerial Order)

Basic satellite
broadcasting

―

―

―

―

Basic terrestrial
broadcasting for mobile
reception

―

―

―

―

(

Television broadcaster thatmeets the following criteria
・ Percentage of its original
programs: 25％ or moreand・ Coverage rate ofhouseholds: 25% or moreof domestic households(*1)) Broadcasting

11

Basic terrestrial
broadcasting* Broadcasters who air a small
proportion of original programsand do not cover many
households will have only alimited impact even if theycannot provide stable services.

Japan Broadcasting Corporation
Nippon Television Network
Corporation
TV Asahi Corporation
TBS Holdings, Inc.
Fuji Television Network, Inc.
TV Tokyo Corporation

Program transmission
facilities* Facilities responsible forprogram transmission
critical to broadcasting・ Maintenanceandmanagement
・ Operations

・ Encoders
・ Multiplexing units*1 The designated service
providers can cover 13 million
households (calculated basedon the latest TV ownership rate
and the number of households
in the latest national census).

() Postal
services

12

Postal service

Provider of universal andfair postal services(All postal service providers aredesignated.)

General delivery
information systems
Japan Post Co., Ltd* Facilities responsible forcentral management ofresident lists

・ Operational applications
・ OS
・ Servers・ Mail sorting systems

12

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated business sectors(Act) /
Designation of specified
essential infrastructurebusiness (Cabinet Order)

Designation criteria for specified essential
infrastructure service providers (Ministerial Order)

Bank that meets the following criteria
・ Deposit balance: 10 trillion yen or moreor・ Number of accounts:
10 million or moreor・ Number of ATMs: 10,000 or more
BankingService providers designated as
specified essential infrastructureservice providers(as of Sep. 4, 2024)(* The criteria ensure that the designated service providers
hold more than 50% of their deposit balance in Japan.
* Banks with many accounts or ATMs that may have an
extensive impact if they cannot provide their services arealso subject to regulation.
* The Zengin-net (Japanese banks’ payment clearing
network), which is used for interbank transactions, is also
subject to regulation under a different business category(clearing service for interbank funds transfer).

) Financial services

13

Mizuho Bank, Ltd.
Sumitomo Mitsui Banking Corporation
MUFG Bank, Ltd.
Resona Bank, Limited
Sumitomo Mitsui Trust Bank, Limited
Mitsubishi UFJ Trust and Banking
Corporation
Seven Bank, Ltd.
Rakuten Bank, Ltd.
Lawson Bank, Inc.
Japan Post Bank Co., Ltd.
Joyo Bank, Ltd.
The Chiba Bank, Ltd.
The Bank of Yokohama, Ltd.
The Shizuoka Bank, Ltd.
The Bank of Fukuoka, Ltd.
North Pacific Bank, LTD.
Saitama Resona Bank, Limited

Specifiedcriticalfacilities(Ministerial
Order)

Criticalmaintenance andmanagement, etc.
(Ministerial Order)

Component
facilities(Ministerial Order)

Deposit andfund transfer
transaction
systems* Facilities
responsible
for core
operational
processing ofbanking・ Maintenanceandmanagement
・ Operations

・ Operational
applications, OS,middleware, andother important
software・ Server units――

Financial service
provided by central
organizations ofcooperative financial
institutions

Provider of financial services of central organizations ofcooperative financial institutions (accepting deposits,
lending funds, and fund transfer transactions) under theCredit Union Act, the Small and Medium-Sized Enterprise
Cooperatives Act, the Workers’ Credit Union Act, and theNorinchukin Act (All central organizations of cooperative
financial institutions are designated.)

Financial service provided
by workers’ credit unions
(*2)

―

―

Providers of funds transfer services that meet thefollowing criteria
・ Number of users: 10 million or moreandMerpay, Inc.
・ Annual transaction amount: 400 billion yen or more PayPay Corporation

Fund transfer
transaction
systems・ Operational* Facilities
・ Maintenanceapplications, OS,
responsible
andmiddleware, andfor core
management
other important
operational
・ Operations
softwareprocessing for・ Server units
fund transfer
transactions――

Funds transfer service

Shinkin Central BankThe Rokinren BankThe Shinkumi Federation Bank
The Norinchukin Bank

* The criteria ensure that the designated service providers
hold more than 50% of the domestic share for the number ofusers, and the amount handled is also taken into
consideration.
Other services (provided bycredit cooperatives or othercooperative financial
institutions)

―

―

―

*2 Financial services provided by workers’ credit unions have been designated because their services cannot be distinguished from those provided by The Rokinren Bank. However,there are no designation criteria because those provided by workers’ credit unions are unlikely to jeopardize national or public security.

13

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated business sectors(Act) /
Designation of specified
essential infrastructurebusiness (Cabinet Order)

Designation criteria for specified essential
infrastructure service providers (Ministerial Order)

Service providers
designated as specified
essential infrastructureservice providers(as of Sep. 4, 2024)

Specified criticalfacilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)

Component
facilities(Ministerial
Order)

Insurance company that meets the following
criteria[Licensed life insurance company]
・ Insurance and other payments (excluding
cancellation refunds, other refunds, andreinsurance premiums): 1 trillion yen or moreor・ Number of active policies: 20 million or more(

) Financial services

13 Insurance business* The criteria ensure that the designated service
providers hold more than 50% of their share for
insurance and other payments (excluding cancellation
refunds, other refunds, and reinsurance premiums) inJapan.
* Life insurance companies with many active policies
that may have an extensive impact if they cannot
provide their services are also subject to regulation.

[Licensed non-life insurance company]
・Direct net insurance payments: 1 trillion yen or
moreor
・ Number of active policies: 20 million or more
* The criteria ensure that the designated service
providers cover more than 50% of total domestic directnet insurance payments.
* Non-life insurance companies with many active
policies that may have an extensive impact if theycannot provide their services are also subject toregulation.

Business of operating
a financial instruments
exchange market

Operator of a financial instruments exchange
market (excluding financial instruments
exchange markets whose total value of tradedsecurities is less than 75 trillion yen)
* Financial instruments exchange markets with low
total value of traded securities are excluded becauseof their limited impact.

Aflac Life Insurance Japan
Ltd.
Japan Post Insurance Co.,
Ltd.
Sumitomo Life Insurance
Company
The Daiichi Life Insurance
Company, Ltd.
Nippon Life Insurance
Company
Meiji Yasuda Life Insurance
Company
Aioi Nissay Dowa InsuranceCo., Ltd.
Sompo Japan Insurance Inc.
Tokio Marine & Nichido Fire
Insurance Co., Ltd.
Mitsui Sumitomo Insurance
Company, Limited

Insurance payment
systems* Facilities responsible forcore operational
processing for insurance
proceeds payment

・ Maintenanceandmanagement
・ Operations

・ Operational
applications, OS,middleware, andother important
software・ Server units

Trading systems
Tokyo Stock Exchange, Inc.
Osaka Exchange, Inc.
Tokyo Financial Exchange* Facilities responsible forcore operational
processing for theexchange of financial
instruments

14

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated business sectors(Act) /
Designation of specified
essential infrastructurebusiness (Cabinet Order)

Financial instruments
debt assumption
service

Designation criteria for specified essential
infrastructure service providers (Ministerial Order)

・ Licensed under Art. 156-2 of the Financial
Instruments and Exchange Act
or・ Approved under Art. 156-19, para. (1) of the
Act(All licensed or approved service providers aredesignated.)() Financial services

13Type-I financial
instruments business

Trust business

Clearing service forinterbank funds
transfer

Type-I financial instruments business operator
that meets the following criteria
・ Balance of assets under management: 30
trillion yen or moreor・ Number of accounts: 5 million or more
* The criteria ensure that the designated service
providers hold more than 50% of their share of assets
under management in Japan.
* Service providers with many accounts are also
subject to regulation.

Trust business operator whose trust property
value (excluding retrust value) is 300 trillion yen
or more* The criteria ensure that the designated service
providers hold more than 50% of their share of trust
property value (excluding retrust value) in Japan.

Licensed under Art. 64, para. (1) of the
Payment Services Act* Licensed clearing organizations are designatedbecause they centrally clear funds transfer
transactions between financial institutions.

Service providers
designated as specified
essential infrastructureservice providers(as of Sep. 4, 2024)

Japan Securities Clearing
Corporation
ASDEC DVP Clearing
Corporation
Tokyo Financial Exchange

SBI Securities Co., Ltd.
Mizuho Securities Co., Ltd.
Daiwa Securities Co. Ltd.
Nomura Securities Co., Ltd.
Rakuten Securities, Inc.
SMBC Nikko Securities Inc.
Mitsubishi UFJ Morgan
Stanley Securities Co., Ltd.

Custody Bank of Japan, Ltd
The Master Trust Bank ofJapan, Ltd.

Specified criticalfacilities(Ministerial Order)

Critical maintenanceand management, etc.
(Ministerial Order)

Component
facilities(Ministerial Order)

・ Maintenanceandmanagement
・ Operations

・ Operational
applications, OS,middleware, andother important
software・ Server units

Clearing systems* Facilities responsible forcore operational
processing for clearing

Order execution
systems* Facilities responsible forcore operational
processing for type-I
financial instruments
business

Property management
systems* Facilities responsible forcore operational
processing for trust
business

Funds transfer
transaction clearing
systems
Japanese Banks' Payment
Clearing Network* Facilities responsible forcore operational
processing for funds
transfer transaction
clearing

15

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated business sectors (Act) /Designation of specified essential
infrastructure business (Cabinet
Order)

Designation criteria for specified essential infrastructureservice providers (Ministerial Order)

Business issuing prepaid
payment instruments forthird-party businessBusiness operator issuing prepaid payment instruments
for third-party business that meets the following criteria
・ Annual amount of issued prepaid payment instruments
for third-party business: 1 trillion yen or moreand・ Number of affiliated stores where the issued prepaid
payment instruments for third-party business can beused: 10,000 or more

(excluding those listed in Art.
4 of the Payment Services
Act)(

Service under Art. 34 of
13 the Deposit Insurance Act) Financial services

Service under Art. 34 of
the Agricultural andFishery Cooperatives
Savings Insurance Act

Book-entry transfer
business* The criteria ensure that the designated service providers
account for over 50% of Japan’s total amount of issued
prepared payment instruments for third-party business andtake into consideration the number of affiliated stores.

Operating under Art. 34 of the Deposit Insurance
Act(All these service providers are designated.)

Operating under Art. 34 of the Agricultural andFishery Cooperatives Savings Insurance Act(All these service providers are designated.)

Designated under Art. 3, para. (1) of the Act on
Book-Entry Transfer of Corporate Bonds andShares* These designated book-entry transfer organizations aredesignated because they centrally manage the accrual,transfer, and extinguishment of shareholders’ and other rights
on book-entry account registers.

Designated under Art. 51, para. (1) of theElectronically Recorded Monetary Claims Act(excluding service providers whose balance of electronicallyElectronic monetary
recorded monetary claims is less than 1 trillion yen)claims recording business * Those with a small balance of electronically recordedmonetary claims will have only a limited impact even if theycannot record the accrual, assignment, or extinguishment ofelectronically recorded monetary claims.

Service providers
designated as
specified essential
infrastructureservice providers(as of Sep. 4, 2024)

AEON Retail Co., Ltd.
East Japan Railway
Company
Seven Card Service
Co., Ltd.
PayPay Corporation

Deposit Insurance
Corporation of Japan
Agricultural andFishery Co-operative
Savings Insurance
Corporation

Specified criticalfacilities(Ministerial Order)

Criticalmaintenance andmanagement, etc.
(Ministerial Order)

Component
facilities(Ministerial
Order)

・ Maintenanceandmanagement
・ Operations

・ Operational
applications, OS,middleware, andother important
software・ Server units

System issuing
prepaid payment
instruments* Facilities responsible
for core operational
processing for issuanceof prepaid payment
instruments

Bank resolution
systems* Facilities responsible
for core operational
processing for bankresolution

Book-entry transfer
systems
JASDEC DVP
Clearing Corporation

Japan Electronic
Monetary Claim
Organization
Mizuho Electronic
Monetary Claim
Recording Co., Ltd
densai.net Co., Ltd.

* Facilities responsible
for core operational
processing for bookentry transfer businessElectronic monetaryclaim recording
systems* Facilities responsible
for core operational
processing for electronicmonetary claims
recording business16

Scope of Regulation (specified essential infrastructure service providers, specified critical facilities,
critical maintenance and management, etc., and component facilities)
Regulated business sectors(Act) /
Designation of specified
essential infrastructurebusiness (Cabinet Order)

Designation criteria for specified essential
infrastructure service providers (Ministerial Order)

Service providers
designated as specified
essential infrastructureservice providers(as of Sep. 4, 2024)

Specified criticalfacilities(Ministerial Order)(

Credit card payment
approval systems((1) Core processing(2) Transaction
AEON Bank, Ltd.
authentication
・ Number of credit card holders: 10 million or
NTT Docomo, Inc.
more
(3) Acceptance of
14 Business of
Credit Saison Co., Ltd.
settlement messages
andJCB Co., Ltd.
conducting(4) Detection of・ Value of annual credit card transactions: 4 trillion PayPay Card Corporationintermediation services yen or more
fraudulent
Sumitomo Mitsui Cardfor comprehensive* The criteria ensure that the designated service
transactions
Company, Limited
credit purchases
providers account for most of both Japan’s total value ofMitsubishi UFJ NICOS Co.,
(5) Credit inquiry
annual credit card transactions and total number of credit Ltd.
(6) Credit inquiry
card holders.
Rakuten Card Co., Ltd.
service, etc.)

Critical maintenanceand management, etc.
(Ministerial Order)) Credit cards

・ Maintenanceandmanagement
・ Operations

Component
facilities(Ministerial
Order)

・ Operational
applications, OS,middleware, andother important
software・ Server units* Facilities responsible forcore operational
processing for credit cardtransactions

17

Information Required in the Introduction, Etc. Plan
For introducing a specified critical facility

Descriptions

General information about the specified critical facility✓

Details and date of the introduction[Details]✓
The purpose of the introduction and information on the parties involved in the introduction (the names of the parties
and the names of their representatives, their addresses, their countries with jurisdiction over incorporation [if theparty is an individual, their name, address, and nationality], and their relationship with the introduction)[Date]✓
When a series of the necessary processes for introduction will be completed and the facility will be available for theprovision of infrastructure services

Information on the supplier of the specified critical facility
required by the order of the competent ministry✓

The name of the supplier, the name of its representative, its address, and its country with jurisdiction overincorporation (if the supplier is an individual, their name, address, and nationality) [Necessary accompanying
document: a certificate of registered information*]✓

Information on the direct holders of 5% or more of the supplier’s voting rights (their names, countries withjurisdiction over incorporation or nationalities, and proportions of voting rights held)(*) Provide the same information on thecomponent facility suppliers, contractor, andsubcontractors.

The type, name, functions, and places of installation and use of the facility✓ Names, dates of birth, and nationalities of the supplier’s officers and other equivalent members (as listed in (1) to (5)below) [Necessary accompanying documents: a certificate of registered information*, copies of their passports, andothers](1) Stock company: Directors (directors and executive officers if the supplier is a company with nominating
committee, etc.)(2) Membership company: Executive members(3) General incorporated association, general incorporated foundation, or small and medium-size enterprisecooperative: Directors(4) Partnership under the Civil Code: Members(5) Other corporation or organization: Persons equivalent to those specified in (1) to (4)✓ If the supplier’s annual sales from transactions with a foreign government, etc. (the national government, agovernmental organization, a local government, the central bank, or a political party or other political organization of aforeign country or territory) accounted for 25% or more of its total annual sales in the last three years: the relevantbusiness years, the name of the foreign government, etc., and the percentage of the sales derived from the foreign
government, etc.
✓ Location of the plant or place of business that will manufacture the facility (the name of the country or territory)* Certificates of registered information are not required if the supplier has been registered in Japan.

Information on the introduction of the specified criticalfacility or the entrustment of critical maintenance andmanagement, etc. required by the order of the competent
ministry✓

Implementation status of required risk management measures

Note: The underlined information can be provided directly to the competent minister, bypassing the specified essential infrastructure service provider.
* Documentation supporting the implementation of some required risk management measures can also be provided directly to the competent minister (see the instructions on how
to fill out the form).
18

How to Fill Out the Introduction, Etc. Plan (for introduction) (1/3)

1. General information of the specified critical facility[Instructions](1) Indicate which of the specified critical facilities
listed in the Ministerial Orders the facility falls
under.

(1) Type(2) Name(2) Provide information about the facility that canidentify it, such as the product name andmodel number.

(3) Functions
Place of installation(3) Describe the functions unique to the facility.

Place of use(4) Provide the place of installation and the placeof use or operation of the facility. Provide theprefecture’s name at least. If the facility is
located outside Japan, provide the name of
the administrative district equivalent to a
Japanese prefecture (e.g. state, province,
county)(4)

2. Details and date of the introduction of the specified critical facility
Purpose of the introduction

Detailsof theintroduct
ion

Information on
the parties
involved in the
introduction(5)

Organization’s name andits representative’s name

Address
Country with jurisdiction
over incorporation
Relationship with theintroduction(6) Date of the introduction(5) Provide information on those involved in the
introduction of the facility from the supplier
who fall under 1) or 2) below:
1) Person who manages the supply networkof the facility or plays another importantrole in the introduction of the facility as anintermediary between the specified
essential infrastructure service provider
and the supplier2) Person who checks the implementation
status of measures to prevent disruptions
to the facility, including cybersecurity
measures, and may bring changes to thefacility’s functions(6) Provide when (date) a series of the necessary
processes (design, development, assembly,
installation, etc.) for the introduction of the
facility will be completed and the facility will beavailable for the provision of infrastructureservices. If a specific date has not been
decided, provide a planned month and year
and add “(tentative).”

19

How to Fill Out the Introduction, Etc. Plan (for introduction) (2/3)
3. Information on the supplier of the specified critical facility(1) Supplier of the specified critical facility

Supplier’ name and its
representative’s name[Instructions](7) Provide the name of the country or
territory that has the law governing the
supplier’s incorporation.

Address(7)

Country with jurisdiction overincorporation(2) Direct holders of 5% or more of the voting rights of the supplier of the specified critical facility
Name

(8)

Country with jurisdiction
over incorporation or
nationality

Proportion of voting rights held(%) (the date of confirmation)(8) The proportion of voting rights held is the
proportion of the voting rights held in the
total voting rights of the supplier as of a
day within two months before the date of
notification. Round off the number to two
decimal places.
(9) Provide the names, dates of birth, andnationalities of the supplier’s officers (asdefined in the order of the competent
ministry; for example, directors andexecutive officers if the supplier is acompany with nominating committee, etc.).

(1)
(2)
(3)
(4)

(3) Officers of the supplier of the specified critical facility
Name
(9)

Date of birth

Nationality

(1)
(2)
(3)
(4)

20

How to Fill Out the Introduction, Etc. Plan (for introduction) (3/3)(4) The supplier’s percentage of sales from transactions with a foreign government, etc.
(10) 3 years from _________ to _________(11) Applicable  Not applicable 
Business year

[Instructions]

Name of the foreign government, etc.

Percentage (%)(5) Location of the plant or place of business that will manufacture the specified critical facility(12)

Location of the plantor place of business(Confirmation)
Before introducing the specified critical facility, the specified essential infrastructureservice provider has confirmed that the supplier of the facility will not only sell thefacility to us, but also manufacture the facility on its own at the plant or place ofbusiness specified above, and will meet the functional requirements of the facility.

4. Information on the component facilities (omitted)

* Same information as the informationon the specified critical facility

5. Measures to prevent specified disruptive actions taken by the specified essential infrastructureservice provider in introducing the specified critical facility
Measure(1)-1 The specified essential infrastructure service provider
has confirmed that the service provider and otherparties concerned have inspection arrangements inplace for the specified critical facility, including an
acceptance inspection to check for any malicious codeand other security problems, and will conduct
vulnerability tests of the facility before its introduction.** Excluding inspections and vulnerability tests
conducted by the supplier of the facility or the
supplier of each component facility

CheckboxNotes* If different risk
management
measures havebeen taken,
describe them.

(10) State the last three business years ending
on or before the day two months before thedate of notification.
Suppose the supplier’s business year
begins on April 1 and ends on March 31 of
the following year. If the plan is submitted
on August 1, 2025, the last three businessyears are the three years from April 1, 2022,
to March 31, 2025. If the plan is submitted
on May 1, 2025, the last three businessyears are the three years from April 1, 2021,
to March 31, 2024.
(11) If the supplier’s annual sales fromtransactions with the national government,
governmental organizations, local
governments, the central bank, andpolitical parties and other politicalorganizations of a foreign country or
territory accounted for 25% or more of its
total annual sales for a business year
within the three-year period, check“Applicable.” If not, check “Not applicable.”
If you check “Not appliable,” you do notneed to fill in the sections “Business year,”“Name of the foreign government, etc.,”
and “Percentage.”(12) Provide the name of the country or territory
where the plant or place of business thatwill manufacture the facility is located.

21

Government’s Policy on Risk Management Measures
Guiding Principles➢ To effectively reduce the risk that the specified critical facility to be introduced or subject to critical maintenance and management, etc. by acontractor is misused as a means for specified disruptive actions, the specified essential infrastructure service provider should assess the risk andtake risk management measures proportionate to the extent and level of the risk. The implementation status of such risk management measuresneeds to be checked based on the information provided in the submitted introduction, etc. plan since the measures are an important element of screening
for the risk.
➢ Shown below are some examples of required risk management measures. Since risk management measures should be proportionate to the extent
and level of the risk, there is no requirement to take all the measures listed below. When a competent minister checks the implementation
status of required risk management measures in screening for the risk, the minister should fully consider the reality of the service/business andappropriately assess the voluntary risk management efforts of the specified essential infrastructure service provider.
<Government’s policy on risk management measures>✓ As shown in “For reference” below, each specified essential infrastructure service provider must check the checkboxes for the measures(shown on pages 29 to 33) that they have taken and report the measures taken to the competent minister in the introduction, etc. plansubmitted. The form of the plan provides a section to describe their voluntary risk management efforts to appropriately assess such
efforts. As risk management measures should be proportionate to the extent and level of the risk, there is no requirement to take all
the listed measures.
✓ In checking the implementation status of required risk management measures, a competent minster should appropriately assess thevoluntary efforts of the specified essential infrastructure service provider to see how it actually manages the risk. For this reason,even if the service provider has not taken a listed measure, as long as it is considered to have taken equivalent measures tomanage risk, it can check the checkbox for the measure by describing the measures in the Notes section.
✓ The implementation status of required risk management measures, which is an important element of screening, needs to be checked.
For this reason, an introduction, etc. plan must be accompanied by documentation supporting the implementation. Such documentation
is not limited to contracts and manuals, but can be any documentation that can be considered to ensure the implementation of the risk
management measures, given the reality of the service/business and other factors.

(For reference) Form for reporting risk management measures (checkboxes)
MeasureCheckbox

Notes(1)-1 The specified essential infrastructure service provider has confirmed that the service provider and otherparties concerned have inspection arrangements in place for the specified critical facility, including an
acceptance inspection to check for any malicious code and other security problems, and will conduct
vulnerability tests of the facility before its introduction.** Excluding inspections and vulnerability tests conducted by the supplier of the facility or the supplier of eachcomponent facility
Note: Documentation supporting the implementation of some required risk management measures can be provided directly to the competent minister, bypassing thespecified essential infrastructure service provider.

22

List of Required Risk Management Measures (for introducing a specified critical facility [1])✓To effectively reduce the risk that the specified critical facility to be introduced is misused as a means for specified disruptive actions, the specified essential infrastructure service
provider should assess the risk and take risk management measures proportionate to the extent and level of the risk (they are not required to take all the listed measures).

✓To submit an introduction, etc. plan, the checkboxes for the risk management measures that have already been taken must be checked. Even if the service provider has nottaken a listed measure, as long as it is considered to have taken equivalent measures to manage risk, it can check the checkbox for the measures by describing the action in thenotes section.
* Since each ministry may require different risk management measures under its ministerial order, check the ministerial orders before submitting a plan.

Category of risk
management measures(1) Ensure, under the contract
with the supplier of thespecified critical facility andthe supplier of eachcomponent facility, that the
supplier manages the facility
to prevent unauthorizedchanges to the facility in its
manufacturing and otherprocesses and that the
specified essential
infrastructure service provider
can check its management
statusRisk management measures(1)-1 The specified essential infrastructure service provider has confirmed that the service provider and other parties concerned have inspection
arrangements for the specified critical facility in place, including an acceptance inspection to check for any malicious code and other security problems,
and will conduct vulnerability tests of the specified critical facility before its introduction.** Excluding inspections and vulnerability tests conducted by the supplier of the facility or the supplier of each component facility(1)-2 The specified essential infrastructure service provider*1 has confirmed that the service provider or the supplier of the specified critical facility has
inspection arrangements for the component facilities in place, including an acceptance inspection to check for any malicious code and other security
problems, and will conduct vulnerability tests of the component facilities before their introduction.*2*1 Including the supplier of the specified critical facility*2 Excluding inspections and vulnerability tests conducted by the supplier of each component facility(2)-1 The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility will meet the information security
requirements (e.g., applying the latest security patches to the facility and updating the anti-malware software) specified by the service provider at the timeof contracting before its introduction.
(2)-2 The specified essential infrastructure service provider* has confirmed that the supplier of each component facility will meet the information security
requirements (e.g., applying the latest security patches to the facility and updating the anti-malware software) specified by the service provider or the
supplier of the specified critical facility at the time of contracting before its introduction.
* Including the supplier of the specified critical facility(3)-1 The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility has a reliable quality assurance
system in place for the manufacturing process (including the development process).
(3)-2 The specified essential infrastructure service provider* has confirmed the supplier of each component facility has a reliable quality assurance system
in place for the manufacturing process (including the development process).
* Including the supplier of the specified critical facility(4)-1 The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility will periodically or as necessary
check for any unauthorized changes to the manufacturing process (including the development process).
(4)-2 The specified essential infrastructure service provider* has confirmed that the supplier of each component facility will periodically or as necessary
check for any unauthorized changes to the manufacturing process (including the development process).
* Including the supplier of the specified critical facility(5)-1 The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility will apply appropriate physical(e.g., access control using security cameras) and logical (e.g., control of access to data and systems) access control to the manufacturing environment(including the development environment) to prevent unauthorized access.
(5)-2 The specified essential infrastructure service provider* has confirmed that the supplier of each component facility will apply appropriate physical (e.g.,access control using security cameras) and logical (e.g., control of access to data and systems) access control to the manufacturing environment(including the development environment) to prevent unauthorized access.
* Including the supplier of the specified critical facility

23

List of Required Risk Management Measures (for introducing a specified critical facility [2])Category of risk
management measures

Risk management measures(1) Ensure, under the contract
with the supplier of thespecified critical facility andthe supplier of eachcomponent facility, that the
supplier manages the facility
to prevent unauthorizedchanges to the facility in its
manufacturing and otherprocesses and that the
specified essential
infrastructure service provider
can check its management
status(6) The specified essential infrastructure service provider will add unauthorized access control functions to the specified critical facility if the facility isconnected to the Internet and appropriately establish and observe a manual and guidance on its use.

(2) Select suppliers based onwhether only they can
perform maintenance andinspection work for the
specified critical facility orcomponent facility if the
facility is expected to needmaintenance and inspection(9)-1 The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility guarantees sufficient after-sales
service (e.g., responses to failures and vulnerabilities).

(7) The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility and those involved in its
introduction have in place a system for preventing unauthorized changes to the facility in the installation process.
(8)-1 The specified essential infrastructure service provider has confirmed that the supplier of the specified critical facility is required to cooperate indetailed investigations and on-site inspections if the facility is found or suspected to have any unauthorized changes after its introduction.
(8)-2 The specified essential infrastructure service provider* has confirmed that the supplier of each component facility is required to cooperate in detailed
investigations and on-site inspections if the facility is found or suspected to have any unauthorized changes after its introduction.
* Including the supplier of the specified critical facility(9)-2 The specified essential infrastructure service provider* has confirmed that the supplier of each component facility guarantees sufficient after-sales
service (e.g., responses to failures and vulnerabilities).
* Including the supplier of the specified critical facility(10)-1 The specified essential infrastructure service provider has considered alternatives or taken other necessary actions for the possible unavailability of
the guaranteed after-sales service (e.g., responses to failures and vulnerabilities) for the specified critical facility.
(10)-2 The specified essential infrastructure service provider has considered alternatives or taken other necessary actions for the possible unavailability of
the guaranteed after-sales service (e.g., responses to failures and vulnerabilities) for each component facility.
* Including the supplier of the specified critical facility(3) Ensure that the specified
critical facility and eachcomponent facility have asystem for detecting signs ofattempted disruptions and are
sufficiently redundant or
structured to ensure theprovision of infrastructureservices during disruptions(11) The specified essential infrastructure service provider has in place arrangements (e.g., backing up data, isolating backups, clarifying recovery
procedures, and replacing the specified critical facility with a substitute facility) that ensure the provision of infrastructure services during disruptions, suchas ransomware attacks, to the specified critical facility.
(12) The specified essential infrastructure service provider has in place a policy and system for responding to information security incidents, such as
information leaks (e.g., establishing manuals and conducting periodic incident drills).
(13) The specified essential infrastructure service provider has confirmed that the service provider or the supplier of the specified critical facility will
introduce an access control system for the facility and add unauthorized access monitoring functions to the facility before its introduction.

24

List of Required Risk Management Measures (for introducing a specified critical facility [3])Category of risk management
measures

Risk management measures(4) Confirm the compliance of the supplier ofthe specified critical facility and the supplier of
each component facility with domestic laws
and international standards, including theirpast compliance(14)-1 The specified essential infrastructure service provider has confirmed the compliance of the supplier of the specified critical facility
with domestic laws and international standards (including each country’s regulations based on the international standards), including its
compliance for the three years before the date of notification.
(14)-2 The specified essential infrastructure service provider* has confirmed the compliance of the supplier of each component facility
with domestic laws and international standards (including each country’s regulations based on the international standards), including its
compliance for the three years before the date of notification.
* Including the supplier of the specified critical facility(15)-1 The specified essential infrastructure service provider ensures, under the contract with the supplier of the specified critical facility,that the supplier reports to the service provider any possible breaches of the contract that may result from the legislation of a foreigncountry or an external entity’s instructions (including both explicit and tacit ones).

(5) Confirm that the appropriateness of the
supply of the specified critical facility and eachcomponent facility will not be affected byforeign legislation(15)-2 The specified essential infrastructure service provider* ensures, under the contract with the supplier of each component facility,that the supplier reports to the service provider or the supplier of the specified critical facility any possible breaches of the contract that
may result from the legislation of a foreign country or an external entity’s instructions (including both explicit and tacit ones).
* Including the supplier of the specified critical facility(16) The specified essential infrastructure service provider has confirmed that if video equipment, such as security cameras and drones,
is installed or used at the place of installation or use of the specified critical facility, the appropriateness of handling the video footage
obtained from the equipment will not be affected by the legislation governing the location of the head office of the equipment supplier(including the head office of a direct or indirect holder of a majority of the supplier’s voting rights).

(6) Ensure, under the contract with the
supplier of the specified critical facility and the
supplier of each component facility, that the
supplier provides its information that helps
determine whether and to what extent it isunder foreign influence and that it timely
notifies any changes to such information after
the conclusion of the contract(17) The specified essential infrastructure service provider ensures, under the contract with the supplier of the specified critical facility andthe supplier of each component facility, that the supplier provides its information, such as its name, location, officers, capital ties, businessplans and records, the location of the plant where the facility or parts will be manufactured, and the departments and qualifications (e.g.,qualifications and training records related to information security) of its workers involved.
The service provider also ensures, under the contract, that the supplier timely notifies any changes to such information after theconclusion of the contract.

* For the required risk management measures checked, submit documentation supporting their implementation together with the plan. This
documentation can be any documentation that can be considered as ensuring the implementation of the risk management measures, given
the reality of the business and other factors.
* For the underlined measures ((1)-2, (2)-2, (3)-2, (4)-2, (5)-2, (8)-2, (9)-2, (10)-2, (14)-2, and (15)-2), the supplier of the specified criticalfacility and the supplier of each component facility can provide such documentation directly to the competent minister, bypassing thespecified essential infrastructure service provider.
* Examples of risk management measures and such documentation are provided in the technical guide (the Guide to the System for Ensuring
Stable Provision of Specified Essential Infrastructure Services under the Economic Security Promotion Act).

25

List of Required Risk Management Measures (for entrusting critical maintenance and management, etc. [1])✓To effectively reduce the risk that the specified critical facility whose critical maintenance and management, etc. is to be contracted out will be misused as a means for specified
disruptive actions, the specified essential infrastructure service provider should assess the risk and take measures proportionate to the extent and level of the risk (they are not required
to take all the listed measures).

✓To submit an introduction, etc. plan, the checkboxes for the risk management measures that have already been taken must be checked. Even if the service provider has nottaken a listed measure, as long as it is considered to taken equivalent efforts to manage risk, it can check the checkbox for the measure by describing the efforts in the notes section.
* Since each ministry may require different risk management measures under its ministerial order, check the ministerial orders before submitting a plan.

Category of risk management
measures

Risk management measures(1) Ensure, under the contract with thecontractor (including eachsubcontractor) of the critical
maintenance and management, etc.,that the contractor manages the
specified critical facility to prevent thecontractor (including its employees)
from making changes to the facility thatare not intended by the specified
essential infrastructure service provider
and that the service provider can checkits management status(1) The specified essential infrastructure service provider* has confirmed that the contractor and each subcontractor have clarified procedures tokeep and check operational logs, work histories, and other records of the specified critical facility and will periodically or as necessary use suchrecords to check for any unauthorized changes to the facility.
* For the implementation status of each subcontractor, including the case where the contractor has confirmed it(2) The specified essential infrastructure service provider periodically conducts asset management of the specified critical facility and its
component facilities, including taking their inventory and checking whether the latest security patches have applied to them, and will also
periodically conduct the same asset management of replacement facilities.
(3) The specified essential infrastructure service provider* has confirmed that the contractor and each subcontractor will apply appropriate
physical (e.g., access control using security cameras) and logical (e.g., control of access to data and systems) access control to their design
specifications and information of the facility to prevent unauthorized access.
* For the implementation status of each subcontractor, including the case where the contractor has confirmed it(4) The specified essential infrastructure service provider* has confirmed that the contractor and each subcontractor will apply appropriate
physical (e.g., access control using security cameras) and logical (e.g., control of access to data and systems) access control to the working
environment for the critical maintenance and management, etc. to prevent unauthorized access.
* For the implementation status of each subcontractor, including the case where the contractor has confirmed it(5) The specified essential infrastructure service provider* has confirmed that the contractor and each subcontractor are committed tomaintaining and improving the cybersecurity literacy of the workers and supervisor engaged in the critical maintenance and management, etc. byproviding them with cybersecurity training periodically (at least once a year).
* For the implementation status of each subcontractor, including the case where the contractor has confirmed it(6) The specified essential infrastructure service provider has confirmed that the contractor is required to obtain prior approval from the service
provider for subcontracting the contract work and that each subcontractor is also required to obtain prior approval from the service provider for
subcontracting the subcontract work.
(7) The specified essential infrastructure service provider requires, under the contract with the contractor, that the contractor ensure that thesubcontractor implements the same level of cybersecurity measures as the contractor to subcontract the contract work.

(2) Ensure, under the contract with thecontractor of the critical maintenanceand management, etc., that whensubcontracting the contract work, thecontractor provides the specified
essential infrastructure service provider
with the necessary information to checkthe subcontractor’s cybersecurity
measures and that the contractor
obtains prior approval from the service
provider to subcontract the contract
work(3) Confirm that the contractor isunlikely to suspend or discontinue thecritical maintenance and management,
etc. in breach of the contract(8) The specified essential infrastructure service provider* has confirmed the business stability of the contractor and each subcontractor basedon their business plans (e.g., medium-term business plans), financial health, and service records.
* For the business stability of each subcontractor, including the case where the contractor has confirmed it

26

List of Required Risk Management Measures (for entrusting critical maintenance and management, etc. [2])Category of risk management
measures

Risk management measures(4) Confirm the compliance of the contractor(including each subcontractor) with domestic
laws and international standards, including its
past compliance(9)-1 The specified essential infrastructure service provider has confirmed the compliance of the contractor with domestic laws andinternational standards (including each country’s regulations based on the international standards), including its compliance for the three
years before the date of notification.
(9)-2 The specified essential infrastructure service provider* has confirmed the compliance of each subcontractor with domestic laws andinternational standards (including each country’s regulations based on the international standards), including its compliance for the three
years before the date of notification.
* Including the contractor(10)-1 The specified essential infrastructure service provider ensures, under the contract with the contractor, that the contractor reports tothe service provider any possible breaches of the contract that may result from the legislation of a foreign country or an external entity’s
instructions (including both explicit and tacit ones).

(5) Confirm that the appropriateness of thecritical maintenance and management, etc. to
be contracted out (including to be
subcontracted) will not be affected by foreign
legislation(10)-2 The specified essential infrastructure service provider* ensures, under the contract with each subcontractor, that the subcontractor
reports to the service provider or the contractor any possible breaches of the contract that may result from the legislation of a foreigncountry or an external entity’s instructions (including both explicit and tacit ones).
* Including the contractor(11) The specified essential infrastructure service provider has confirmed that if video equipment, such as security cameras and drones,
is installed or used at the place where the critical maintenance and management, etc. work is carried out, the appropriateness of handlingthe video footage obtained from the equipment will not be affected by the legislation governing the location of the head office of theequipment supplier (including the head office of a direct or indirect holder of a majority of the supplier’s voting rights).

(6) Ensure, under the contract with thecontractor (including each subcontractor), thatthe contractor provides its information thathelps determine whether and to what extent it
is under foreign influence and that it timely
notifies any changes to such information after
the conclusion of the contract(12) The specified essential infrastructure service provider ensures, under the contract with the contractor and each subcontractor, thatthey provide their information, such as their name, location, officers, capital ties, business plans and records, the place where the critical
maintenance and management, etc. will be performed, and the departments and qualifications (e.g., qualifications and training records
related to information security) of their workers involved.
The service provider also ensures, under the contract, that they timely notify any changes to such information after the conclusion of thecontract.

* For the required risk management measures checked, submit documentation supporting their implementation with the plan. This
documentation can be any documentation that can be considered as ensuring the implementation of the risk management measures, given
the reality of the service/business and other factors.
* For the underlined measures ((1), (3), (4), (5), (8), (9)-2, and (10)-2), the contractor and each subcontractor of the critical maintenance andmanagement, etc. can provide such documentation directly to the competent minister, bypassing the specified essential infrastructureservice provider.

* Examples of risk management measures and such documentation are provided in the technical guide (the Guide to the System for Ensuring
Stable Provision of Specified Essential Infrastructure Services under the Economic Security Promotion Act).
27

Scope of Information to be Provided under the System for Ensuring Stable Provision ofSpecified Essential Infrastructure Services under the Economic Security Promotion Act✓

The Act requires notification and screening for the “introduction of specified critical facilities” (before introduction), as well as notification and screening
for the “entrustment of the critical maintenance and management, etc. of specified critical facilities to third parties.” For the former notification,
information on the suppliers of a specified critical facility and its component facilities must be provided. For the latter, information on all
the contractors and subcontractors of critical maintenance and management, etc. must be provided (for critical maintenance and management, etc.,
some information is not required if certain conditions are met).
Red frame: Scope of information to be provided to the competent minister(Information on the
suppliers of facilities otherthan component facilities
is not required.)Serviceprovider N

Serviceprovider Z(e.g.)
Procure a component facility
Y of facility X

・・・・・・

Serviceprovider Y

Supplier ofcomponent
facility

Serviceprovider D(e.g.)
Procure acomponent facility X
of facility A(e.g.)
Procure acomponent facility Cof facility B

Supplier ofcomponent
facility

Supplier ofcomponent
facility

Supplier of specified
critical facility

・・・・・・* Facilities C and X have been designated as the component facilities of specified critical facility A.
(final contractor)

・・・・・・

Subcontractor(e.g.)
Subcontract (2)the security of
the facility

Subcontractor

Subcontractor(e.g.)
Subcontract (2)the security of
the facility(e.g.)
Subcontract (1)the maintenanceand managementof the facility

Subcontractor(e.g.)
Subcontract (1)the maintenanceand managementof the facility

Subcontractor(e.g.)
Contract out (1) themaintenance andmanagement of a
facility and (2) the
securityof the facility

Contractor

Essential infrastructure service provider

Entrust a third party with critical
maintenance and management, etc.

(specified essential infrastructure service provider)

Introduce a specified
critical facility(e.g.)
Procure a specified
critical facility A(e.g.)
Procure acomponent facility Bof facility A(Information on the contractors andsubcontractors who are not engaged in
critical maintenance and management,
etc. is not required.)* “(1) The maintenance and management of the facility” is critical maintenance and management, etc., while “(2) the security of the facility” is not.

Notification(Some required information may be provided by
the suppliers, contractor, and subcontractors
directly to the competent minister.)Competent minister

The competent minister may directly require the suppliers,
contractor, and subcontractors to provide necessary information.

28

Exemption from Providing Information on the Subcontractors of Critical Maintenance and Management, Etc.
✓

To entrust critical maintenance and management, etc. to a third party, each specified essential infrastructure service provider must, as a general rule, include
information on all the subcontractors in the introduction, etc. plan.

✓

However, if the service provider satisfies all the exemption requirements specified in the Ministerial Order, the service provider is not required to provide
some information on the subcontract that meets the requirements and documents related to the officers of the subcontractor by stating the satisfaction
in and attaching documentation supporting the satisfaction to the introduction, etc. plan.

Requirement for exemption
A specified essential infrastructure service provider who satisfies all the requirements is not required to provide information on the subcontract that satisfies therequirements other than the subcontractor’s name, address, and country with jurisdiction over incorporation by attaching documentation supporting thesatisfaction to the introduction, etc. plan. The service provider is also not required to submit any documentation other than a certification of registered information.
Requirement (1): The service provider has taken action to identify the scope and date or duration of the subcontract work.
Requirement (2): The service provider or the contractor subcontracting the contract work has taken action to confirm that the subcontractor has taken thefollowing measures:

Subcontractor’s measure (1)Take measures to prevent authorized access to the place of the subcontract work, such as controlling access to the place
Subcontractor’s measure (2)Periodically or as necessary audit the specified critical facility whose critical maintenance and management, etc. is to be subcontracted for any
unauthorized operation or activities by establishing and requiring compliance with procedures to maintain and check the records of work
performed by its workers<How the exemption applies>

Serviceprovider N(final contractor)×

Not satisfying therequirements

Serviceprovider D

Stating the satisfaction with therequirements and submitting
supporting documentation(e.g.)
Subcontract themaintenance andmanagement of
the facility

Serviceprovider C(e.g.)
Subcontract themaintenance andmanagement of
the facility

Serviceprovider B

Stating the satisfaction with therequirements and submitting
supporting documentation

Serviceprovider A

Essential
infrastructureservice provider(e.g.)
Contract out themaintenance andmanagement of a
facility

・・・・・・

Stating the satisfaction with therequirements and submitting
supporting documentation⇒ The essential infrastructure service provider must provide all the required information on the contract with service provider A and the subcontract between service providers B and C.
For the subcontract between service providers A and B, the subcontract between service providers C and D, and all other subsequent subcontracts, the essential infrastructureservice provider is not required to provide information on the subcontracts other than the names, etc. of subcontractors B and D to N.
29

(For reference) Points to Consider in the Screening Process
Guiding Principles on Ensuring Stable Provision of Specified Essential Infrastructure Services by Preventing Specified Disruptive
Actions (approved by the Cabinet on April 28, 2023)
Chapter 4 Basic Matters of Recommendations and Orders to Specified Essential Infrastructure Service Providers(4) Points to consider in the screening process
Article 52, paragraph (4) of the Act requires each competent minister to screen the specified critical facility included in a submitted introduction,etc. plan to see whether it has a high risk of being misused as a means for specified disruptive actions. Detailed screening criteria can benefit
entities attempting specified disruptive actions. Conversely, unclear screening criteria can discourage specified essential infrastructure service
providers from proceeding with their planned introduction of a specified critical facility or entrustment of critical maintenance and management,
etc. for fear of unpredictable disadvantages from the regulation. For this reason, the screening criteria need to be as clear as possible to ensurepredictability for specified essential infrastructure service providers.
The screening process must take the following points into account:(1) Whether the suppliers of the specified critical facility or its component facilities, or the contractor and subcontractors of the critical
maintenance and management, etc. of the specified critical facility, are under a strong foreign influence;(2) Whether the service provider has assessed the risk that the specified critical facility could be misused to disrupt the stable provision of thespecified essential infrastructure service and taken necessary risk management measures based on the assessment;(3) Whether the suppliers have been found to have supplied vulnerable products related to the specified critical facility or its component
facilities, whether the contractor and subcontractors have been found to have performed inappropriate critical maintenance andmanagement, etc., and whether the suppliers or the contractor and subcontractors have been found not to comply with domestic laws orinternational standards; and/or(4) In addition to the points (1) to (3), information on the introduction or entrustment or the suppliers or contractor and subcontractors that
relates to the risk that the specified critical facility may be misused as a means for specified disruptive actions. (*6)(*6) e.g., information on past involvement in disruptive actions against Japan or our allied or like-minded countries

Considering these points, the competent minister may issue a recommendation or order to the service provider when concluding that the
specified critical facility is at a high risk of being misused as a means for specified disruptive actions.
Cyber activities in our cyberspace reported in recent years, especially those with the suspected involvement of a foreign state (*7), which reflect
our harsh security environment, have disrupted the stable provision of infrastructure services fundamental to the daily lives of Japanese people
and our economic activities and caused significant social dislocations. In light of this, focusing on disruptive actions from outside Japan, thescreening process must involve carefully screening the introduction, etc. of facilities from business operators strongly influenced by foreign
entities. The process also must take into account the reality that we are facing the most challenging and complex security environment sinceWorld War II, as described in the National Security Strategy (approved by the National Security Council and the Cabinet on December 16, 2022)
and other government strategies. (*7) The Cyber Security Strategy shares the same understanding.
Careful screening is particularly necessary for the introduction, etc. of specified critical facilities from the countries subject to our economic
sanctions and business operators strongly influenced by such countries.

Notifications Required by the System for Ensuring Stable Provision of Specified Essential
Infrastructure Services under the Economic Security Promotion Act✓

To introduce a specified critical facility or the entrustment of critical maintenance and management, etc., to third parties, the Act requires (1) submission of
an introduction, etc. plan, (2) submission of an urgent introduction, etc. notification, (3) notification of (in advance) draft changes to theintroduction, etc. plan, and (4) reporting of (urgent) changes to the introduction, etc. plan.

Before introduction or entrustment
In case of urgency(1) Submit an introduction, etc. plan

Start the introduction
or entrustment

30-day* screening period (prohibiting introduction, etc.)* This period can be shortened or extended (up to four months).

Specified disruptive actions
are highly likely(within 10 days)

Authorized to start the
introduction or entrustment

Recommendation forchanges or suspension

If changes other than material
and minor ones are necessary
If material changes
are necessary

Notify whether
to accept it(2) Submit an urgent
introduction, etc. notification

If minor changes are necessary

Make the changes(Not required to notify
or report)(3) Notify (in advance) draft changes (4) Report the changes to theto the introduction, etc. plan
introduction, etc. plan

During entrustment*

After introduction

If changes other than material
and minor ones are necessary
If a change to thespecified critical facility
is deemed theintroduction of a new
specified critical facility

If changes to acomponent facility
are necessary

Make the changes

If material changes
are necessary

If urgent changes
are necessary

Make the changes(3) Notify (in advance) draft changes
to the introduction, etc. plan

(4) Report the changes to theintroduction, etc. plan (notMake thechangesrequired to notify or report minor changes)
30-day* screening period (prohibiting entrustment)(1) Submit a new
introduction, etc. plan

(4) Report the changes tothe introduction, etc. plan

* This period can be shortened or extended (up to four months).

Authorized to make the changes(4) Report the urgent
changes to theintroduction, etc. plan

* No notification is required after the completion of the entrustment.31

Changes to the Introduction, Etc. Plan for the Introduction of a Specified Critical Facility
Relevant articles of the Act

Information to be provided

Category of change

General information of the specified criticalfacility (Art. 52, para. (2), item (i))

The type, name, functions, place of installation, and place of use of the
facility

Details of the introduction (Art. 52. para. (2),item (ii)(a))

The purpose of the introduction of the facility and the names, etc. of theparties involved in the introduction

Material change

Date of the introduction (Art. 52. para. (2),item (ii)(a))

The date of the introduction (when the facility will be available for theprovision of infrastructure services)

Change to be reported after the fact

Material change••

The supplier’s name: Material change
The representative’s name: Change to be reported
after the fact

The supplier’s address••

Change of the country: Material change
Other changes: Minor change

The supplier’s country with jurisdiction over incorporation (if the
supplier is an individual, their nationality)

Material change

The supplier’s name and its representative’s name (if the supplier is anindividual, only their name)•
The names, countries with jurisdiction over incorporation or
nationalities and proportions of voting rights held of the direct holders
of 5% or more of the supplier’s voting rights* If there is a new director holder of 5% or more of the voting rights, that
person must be reported after the fact as a change to the names of thevoting rights holders.

Information other than the proportion of voting rights
held: Change to be reported after the fact
• Proportion of voting rights held
➢ New direct holder (1) to (3) below: Change to bereported after the fact
Other new direct holder: Minor change(1) Direct holder of 25% or more but less than onethird of the voting rights(2) Direct holder of one-third or more but less than
50% of the voting rights(3) Direct holder of 50% or more of the voting rights

The names, dates of birth, and nationalities of the supplier’s officers

Change to be reported after the fact

If the supplier’s annual sales from transactions with a foreign government,
etc. accounted for 25% or more of its total annual sales in the last three
years: the relevant business years, the name of the foreign country,
and the percentage of the sales from the foreign government, etc.

Change to be reported after the fact

Location of the plant or place of business that will manufacture thefacility••

Information on each component facility (Art.
52, para. (2), item (ii)(c))(The same information as the information on the supplier of thespecified critical facility)

Same as at left

Other information (Art. 52, para. (2), item (iv))

The implementation status of the required risk management measures

Material change

Information on the supplier of the specified
critical facility (Art. 52, para. (2), item (ii)(b))* To add a new supplier ofthe specified criticalfacility, submit a plan
including all the required
information.

Change of the country: Material change
Other changes: Minor change* The underlined information can be provided directly to the competent minister, bypassing the specified essential infrastructure service provider. For the required risk management
measures, however, the implementation status of only some of the measures can be provided directly.

32

Changes to the Introduction, Etc. Plan for the Entrustment of Critical Maintenance and Management, Etc.
Relevant articles of the Act

Information to be provided

Category of change

General information of the specified criticalfacility (Art. 52, para. (2), item (i))

The type, name, functions, place of installation, and place of use of
facility

Material change

Details of the contract work (Art. 52, para. (2),item (iii)(a))

The purpose, scope, and place of the contract work

Material change

Date or duration of the contract work (Art. 52,
para. (2), item (iii)(a))

Date or duration of the contract work••

Extension of the period: Material change
Other changes: Change to be reported after the fact••

The contractor’s name: Material change
The representative’s name: Change to be reported
after the fact

The contractor’s address••

Change of the country: Material change
Other changes: Minor change

The contractor’s country with jurisdiction over incorporation (if thecontractor is an individual, their nationality)

Material change

The contractor’s name and its representative’s name (if the contractor is anindividual, only their name)•
The names, countries with jurisdiction over incorporation or
nationalities, and proportions of voting rights held of the direct holders of
5% or more of the contractor’s voting rights* If there is a new director holder of 5% or more of the voting rights, that
person must be reported after the fact as a change to the names of thevoting rights holders.

Information other than the proportion of voting rights
held: Change to be reported after the fact
• Proportion of voting rights held
➢ New direct holder (1) to (3) below: Change to bereported after the fact
Other new direct holder: Minor change(1) Direct holder of 25% or more but less than onethird of the voting rights(2) Direct holder of one-third or more but less than
50% of the voting rights(3) Direct holder of 50% or more of the voting rights

The names, dates of birth, and nationalities of the contractor’s officers

Change to be reported after the fact

If the contractor’s annual sales from transactions with a foreign government,
etc. accounted for 25% or more of its total annual sales in the last three
years: the relevant business years, the name of the foreign country, andthe percentage of the sales from the foreign government, etc.

Change to be reported after the fact

Information on the subcontract work (Art. 52,
para. (2), item (iii)(c))(The same information as the information on the contractor of thecritical maintenance and management, etc.)

Same as at left

Other information (Art. 52, para. (2), item (iv))

The implementation status of the required risk management measures

Material change

Information on the contractor of the contract
work (Art. 52, para. (2), item (iii)(b))* To add a new contractor of thecritical maintenance andmanagement, etc., submit a plan
including all the required
information.

* The underlined information can be provided directly to the competent minister, bypassing the specified essential infrastructure service provider. For the required risk management
measures, however, the implementation status of only some of the measures can be provided directly.

33

Introduction, Etc. of a Specified Critical Facility and Introduction, Etc. Notification for Cases of Urgency✓

If introducing a specified critical facility or entrusting the critical maintenance and management, etc. of a specified critical facility to a third party is urgent, eachspecified essential infrastructure service provider may do so without submitting an introduction, etc. plan in advance. In this case, the service provider must
submit an introduction, etc. notification without delay after the introduction, etc.

✓

Cases of urgency are defined in each Ministerial Order.

Definition of cases of urgency[Article of each Ministerial Order] The cases specified in the order of the competent ministry under the proviso of Article 52, paragraph (1) of the Act are cases
where a specified essential infrastructure service provider has or is likely to have difficulty in providing the specified essential infrastructure service (unlessthe service provider has caused the risk of such difficulty in an attempt to evade the application of the main clause of the paragraph), has to urgently introduce
a specified critical facility or entrust the critical maintenance and management, etc. of a specified critical facility to a third party in order to remove or prevent suchdifficulty, and has no appropriate alternatives.
[This article says that if a specified essential infrastructure service provider meets all the following conditions (1) to (4), it may introduce, etc. a specified
critical facility without submitting an introduction, etc. plan in advance.](1) The service provider has or is likely to have difficulty in providing the specified essential infrastructure service⇒ The introduction, etc. of a specified critical facility through the normal procedure may undermine the purpose of the Act (the stable provision of infrastructureservices) (Urgent).

(2) Unless the service provider has caused the risk of such difficulty in an attempt to evade the application of the main clause of the paragraph⇒ The service provider has not intentionally caused the risk of such difficulty in an attempt to evade giving prior notification (Unintentional).
(3) The service provider has to urgently introduce a specified critical facility or entrust the critical maintenance and management, etc. of a specified criticalfacility to a third party in order to remove or prevent such difficulty⇒ The service provider’s introduction, etc. is necessary to remove or prevent such difficulty (Necessary).
(4) The service provider has no appropriate alternatives⇒ The service provider has no appropriate alternatives to the introduction, etc. (No alternatives).
[Information required in an urgent introduction, etc. notification: the information (1) to (4) below must be provided in addition to the information required in
an introduction, etc. plan](1) Urgent

Required information: (1) the details of the difficulty in providing the service; (2) the date of occurrence and duration of the difficulty; (3) the
impact of the difficulty on the provision of the service; (4) by when the urgent introduction, etc. had to take place; and (5)why an introduction, etc. plan could not be submitted in advance(2) Unintentional

Required information: (1) the causes of the difficulty; (2) when the difficulty was identified; and (3) why the difficulty was unavoidable(3) Necessary

Required information: (1) the relationship between the difficulty and the specified critical facility and the details of the problems with thespecified critical facility, and (2) the relationship between the difficulty and the urgent introduction, etc.

(4) No alternatives

Required information: (1) what alternatives were considered, and (2) why the alternatives could not be taken

34