Cybersecurity Strategy

Cybersecurity for All
Cybersecurity which leaves no-one behind

The Government of Japan
September 2021

Contents

Executive summary

・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・

Cybersecurity Strategy

3

13

・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・
・

1 Introduction

14

1.1.

Japan in the 2020s: Era of the“new normal”and the digital society ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・14

1.2.

Meaning of the strategy ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・16

2 Concept of the strategy

17

2.1.

Cyberspace to be ensured ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・17

2.2.

Basic principles ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・17

3 Issues surrounding cyberspace

19

3.1.

Risks from the perspective of environmental changes ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・20

3.2.

Risks from the perspective of international aﬀairs ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・21

3.3.

Recent trends of threats in cyberspace ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・22

4 Policy approaches toward achieving the objectives ̶ Cybersecurity for All

23

4.1.

Enhancing socio-economic vitality and sustainable development ̶Advancing DX with Cybersecurity・・・・・・・・・・・・・・・・27

4.1.1

Raising executive awareness ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・27

4.1.2

Promotion of“DX with Cybersecurity”among local regions and SMEs ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・28

4.1.3

Building a foundation for ensuring trustworthiness of supply chains that support new value creation・・・・・・29

4.1.4

Advancing digital/security literacy with no one left behind ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・31

4.2.

Realizing a digital society where the people can live with a sense of safety and security・・・・・・・・・・・・・・・・・・・・・32

4.2.1

Providing a cybersecurity environment which protects the people and society ・・・・・・・・・・・・・・・・・・・・・・32

4.2.2

Ensuring cybersecurity integral with digital transformation (led by the Digital Agency)・・・・・38

4.2.3

Promotion of eﬀorts by stakeholders which underpin the socio-economic infrastructure (1) (Government agencies, etc.)・・・・・・38

4.2.4

Promotion of eﬀorts by stakeholders which underpin the socio-economic infrastructure (2) (Critical infrastructure)・・・・・39

4.2.5

Promotion of eﬀorts by stakeholders which underpin the socio-economic infrastructure (3)(Universities, education and research institutions, etc.)・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・41
Seamless information sharing and collaboration by multiple stakeholders and application ofknowledge gained through eﬀorts toward the Tokyo Games, etc. ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・42

4.2.6
4.2.7

Enhancement of readiness to respond to massive cyberattacks, etc. ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・42

4.3.

Contributing to the Peace and Stability of the International Community and Japan’s National Security・・・・・・・・・・・・・・・44

4.3.1

Ensuring“a free, fair and secure cyberspace”・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・45

4.3.2

Strengthening Japan’s capabilities for defense, deterrence, and situational awareness・・・・・・・・・・・・・・46

4.3.3

International cooperation and collaboration ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・49

4.4.

Cross-Cutting Approaches to Cybersecurity ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・51

4.4.1

Advancement of R&D ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・51

4.4.2

Recruitment, development, and active use of human resources ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・54

4.4.3

Collaboration based on full participation and awareness raising ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・58

5 Implementation Framework

59

Cybersecurity Strategy

1Cybersecurity for All
Cybersecurity which leaves
no-one behind

Ⅰ

Executive summary

Cybersecurity Strategy

3

Executive summary

Issues and Direction of Japan’s Cybersecurity Strategy 2021
Japan in the 2020s: Era of the“new normal”and the digital society
Digital economy
Digital transformation(DX)

COVID-19
Remote working, online
education, etc.

Growing severity of
the national security
environment

Expectations forthe contribution ofdigital technology
to SDGs

Tokyo Olympic/
Paralympic Games

Issues in cyberspace: Inclusion of all the people in cyberspace
Cyberspace is becoming a public space where all entities participate
Interconnections and interrelationships across cyber andphysical boundaries are becoming deeper
These changes increase vulnerabilities that attackers can exploit

Cyberspace reﬂects
geopolitical tensions
Interstate competition
National security issues

Concerns about rifts
between nations andthe suppression ofhuman rights

Utilizing public
and private
initiatives

Cybersecurity has become an issue for all entities
Japan’s Commitment to the ﬁve basic principles** Assuring the free ﬂow of information, the rule of law, openness, autonomy, and collaboration among multi-stakeholders“Cybersecurity for All”
Cybersecurity which leaves no-one behind

Advancing DX
andcybersecurity
simultaneously

Enhancing initiatives
from the perspectiveof national security

Ensuring the overall safety
and security of cyberspace
as it becomes increasingly
public, interconnected
and interrelated

Ensuring“a free, fair and secure cyberspace”
4

Cybersecurity Strategy

Issues and direction

Executive summary

Enhancing Socio-Economic Vitality and Sustainable Development

Advancing digital transformation and cybersecurity simultaneously● The Digital Agency was established in September 2021. This is a great opportunity to advance DX.

To this end, it is important to build trust in cyberspace, which leads to participation and commitment
by all the people and businesses.
● As operations, products, and services become increasingly digitalized, ensuring cybersecurity will bedirectly linked to corporate value.
“Security by design”will become ever more important, and digital investments and security measures
will likely become increasingly integrated.

Advance cybersecurity in parallel with digitalization

Specific measures
1 Raising executive awareness→Visualize and incentivize initiatives based on the guidelines of cybersecurity management, andfurther promote such initiatives, by implementing guidelines for digital management.
2 Advancing DX with Cybersecurity among local regions and SMEs

→Address the shortage of knowledge and human resources required for digitalization, through thedevelopment of local regions and the establishment of a registration scheme for services targeting SMEs.
3 Building a foundation for ensuring trustworthiness of supply chains→Advance initiatives based on the frameworks which respond to Society5.0.
▷Supply chains： Industry-led consortium▷Data Flow
: Definition of data management, securing the reliability of data with“trust service”▷Security products/services ： Promotion of third-party verification services▷Advanced technology： Building a common foundation for collecting, accumulating, analyzing, and providing information
4 Advancing and broadening digital/security literacy with no one left behind→Advance initiatives which provide assistance in the use of digital technology, along with efforts
to drive information education.

Cybersecurity Strategy

5

Executive summary

Realizing a Digital Society where the People can Live with a Sense of Safety and Security

Issues and direction

 nsuring the overall safety and security of cyberspace as it becomesE
increasingly public, interconnected and interrelated● C yberspace becoming increasingly public, interconnected and interrelated, and cyberattacks becoming more organized and sophisticated.

The national government, in cooperation with various stakeholders, will take acomprehensive and multilayered approach to cybersecurity, which is based on
self-help, mutual help and public help, and which reduces risks and increases
resilience for the entire country. This will be done mainly by (1) creating an environment where risk is managed autonomously through self-help and mutual help,
and by (2) deploying comprehensive cyber defense using all available means.
Specific measures (1)Providing a cybersecurity environment which protects the people and society
1 Ensure safety and security in cyberspace→Establish guidelines and encourage industry-led efforts for supply chain management, and ensure
safety when implementing new technologies (IoT, 5G, etc.)→Study measures for ensuring safe and reliable telecommunications networks to protect users
2 Cooperate with new providers of cybersecurity (accommodate cloud services)→Create security rules for government agencies, critical infrastructure operators, etc. to consider when using cloud→Promote cloud usage that ensures a measure of security through private-sector efforts, such as the ISMAP initiative→Advance the development of high-quality cloud that is reliable, open and user friendly
3 Address cybercrimes→Actively point out criminals exploiting cyberspace or malicious business operators who provide
criminal infrastructure blocking traceability for ensuring a sense of security and safety→Strengthen police capabilities for responding to cyber incidents
4 Deploy comprehensive cyber defense→Enhance the functions of national CERTs/CSIRTs, which handle general coordination of integrated advancement from response to cyberattacks to policy measures, including prevention of recurrence (marshal resources and strengthen collaboration of responsible government agencies, enhance public-private partnership by working with the Cybersecurity Council and other relevant agencies and international collaboration)→Establish an environment for comprehensive cyber defense (vulnerability handling, technical verification mechanism, and establishing functions for investigating the cause of relevant industrial control system incidents, etc.)

5 Ensure trustworthiness of cyberspace→Support stakeholders who possess personal information and intellectual property→Ensure trustworthiness of IT systems and services from the perspective of economic security (government procurement, critical infrastructure, international submarine cables, etc.)

6

Cybersecurity Strategy

Executive summary

Specific measures (2)Ensuring cybersecurity integral with digital transformation(led by the Digital Agency)→Propose and implement the basic principle for cybersecurity in the Digital Agency’s development
policy for the information systems of the national government, etc..

→Plan systems which ensure the authenticity of information and its provider, and promote their utilization. Implement the ISMAP system and encourage its use by the private sector.

Specific measures (3)Promoting efforts by stakeholders which underpin the foundations of the economy and society
1 Government agencies, etc.

→Advance measures based on the Common standards for Gov-

ernmental Agencies and Related Agencies, and increase theoverall security level of government agencies through efforts in-Digitalization

cluding security audits, CSIRT training and monitoring by GSOC.

→Promote the revision and implementation of the Common standards for Governmental Agencies and Related Agencies in ac-

cordance with the expanding use of cloud services and enhance

Public space

the GSOC functions to enable cloud services’monitoring.
2 Critical infrastructure→Revise the“Cybersecurity Policy for Critical Infrastructure Protection (4th Edition),”and advance reinforcement and management leadership in response to environmental changes.

→Update guidelines and advance efforts to establish necessary
systems in response to standardization of local government information systems, handling administrative procedures online, etc.

Self-help, mutual help, public help
Self-help

Self-help

Mutual help public help Mutual help
Self-help

Self-help

Self-help

Self-help

3 Universities, education and research institutions, etc.

→Seminars and training on risk management and incident response, supporting enhanced measures at universities, etc. possessing advanced information, including measures against supply chain risks, and so on.

Specific measures (4)Seamless information sharing and collaboration by multiple stakeholders
and enhancement of readiness to respond to massive cyberattacks, etc.
→Actively use findings and know-how obtained through response capabilities and operation at theTokyo Games to support business operators, etc. nationwide.

→Strengthen seamless and whole of nation response capabilities, keeping in mind even in peacetime
the possibility that a minor incident may escalate into a major cyberattack.

Cybersecurity Strategy

7

Executive summary

Contribution to the Peace and Stability of the International Community and Japan’s National Security

Issues and direction

Enhancing initiatives from the perspective of national security● Amidst the growing severity of the security environment surrounding Japan, cyberspace has become an realm of interstate competi-tion that reflects geopolitical tensions. China, Russia and North Korea are presumed to be building cyber capabilities and conducting
cyberattacks intended to steal information, etc..
● Meanwhile, Japan’s ally and like-minded countries have been accelerating efforts to build the capabilities of their cyber commands and strengthen theability to respond to cyberattacks, and they are collaborating to address cyber incidents and conflicts over international rules in cyberspace in particular.
● In addition, as national security has been expanding its scope to include economic and technological fields, Japan must also collab-

orate with its ally and like-minded countries to address conflicts over technological foundation concerning cyberspace and data, on
which Japan must also establish international rules in line with its basic principles to ensure“a free, fair and secure cyberspace.”

To ensure safety and security of cyberspace, Japan will placea higher priority on cyber issues in diplomatic and national
security agenda, and Japan also commits to the following.
Specific measures

Ensuring“a free, fair andsecure cyberspace”

International cooperation and collaboration

Strengthening Japan’s capabilities for defense, deterrence, and situational awareness

1 Ensuring a free, fair and secure cyberspace→Promoting the rule of law in cyberspace (formulating rules that contribute to Japan’s national security)▷Promote discussions on the application of international law and the practice of norms, and advance the universalization of the Convention
on Cybercrime, etc.

→Formulating rules in cyberspaces basic principles, based on the progress of international efforts including Data Free Flow
▷Formulate international rules in line with Japan’
with Trust (DFFT), 5G security, etc.

2 Strengthening Japan’s capabilities for defense, deterrence, and situational awareness→Increasing defense capabilities▷Fundamentally strengthen the cyber defense capabilities of the Ministry of Defense and the Self-Defense Forces (SDF), andconduct exercises and other measures by the SDF and US military to defend infrastructure.

▷Strengthen public-private collaboration and information sharing to ensure security of advanced technology, the defense industry, etc.
→Enhancing deterrence capabilities▷Employ capabilities to disrupt opponents’use of cyberspace for attack, use diplomatic means and criminal prosecution, and maintain and strengthen the Japan-US alliance→Strengthening cyber situational awareness capabilities▷Advance efforts to further clarify the actual situation of cyberattacks by leveraging the nationwide networks, technical teams andhuman intelligence

3 International cooperation and collaboration→Sharing expertise and coordinating policy▷Strengthen multi-layered frameworks for international collaboration within and across ministries and agencies, with like-mindedcountries including the US, Australia, and India as well as ASEAN→Strengthening international collaboration for incident responses international presence by leading international cyber exercises, etc.
▷Enhance Japan’→Supporting for capacity building▷Enhance efforts in the Indo-Pacific region, including ASEAN, such as industry-academia-government collaboration, diplomacy andnational security based on the Basic Policy on Cybersecurity Capacity Building for Developing Countries.

8

Cybersecurity Strategy

Advance DX andcybersecurity
simultaneously

Ensure the overall safety and security ofcyberspace as it becomes increasingly
public, interconnected and interrelated

Enhance initiatives fromthe perspective of
national security

Executive summary

Cross-Cutting Approaches to Cybersecurity

Taking a cross-cutting, medium- to long-term view, promote R&D, development of human resources, and awareness-raising activities in order to advance the above.

1 Promotion of R&D
Build a government-industry-academia ecosystem, and pursue practical R&D using that as a foundation.
Take medium- to long-term technological trends into consideration.

(2) Advance practical R&D①Address supply chain risks②Cultivate/develop domestic industries③Foundations for monitoring, analyzing, and sharing attacks④Advance research of cryptography, etc.

(3) T ake medium- to long-term
technological trends into consideration①Advancement of AI technology
AI for Security(1) S trengthen international competitiveness Builda government-industry-academia ecosystem
・Leverage measures to promote research andgovernment-industry-academia collaboration
・Enhance research environment, etc.

Security for AI②Advancement of quantum technology
Post-quantum cryptography

Quantum communications/cryptography

2 Recruitment, development, and active use of human resources
Maintain the quality and quantity of initiatives by public and private sectors, with a focus on efforts to address environmental changes. Create an environment that enables career development spanning both public and private sectors.
(1) Advance DX with Cybersecurity

・Create an environment where people can gain
additional security knowledge

・Promote practices which encourage function building and staff mobility, etc.

(xSIRT, side/concurrent business, etc.)(2) Address increasingly sophisticated and complex threats・Strengthen human resources development programs
SecHack365/CYDER/enPiTICSCoE Core Human Resource Development Program, etc.
・Build a common foundation for human resources development
and make it available to industry and academia
・Promote the use of qualification systems, etc.

Create an environment that enables talented human resources to develop careerswhich span the private sectors, municipalities, and national government agencies(3) Pursue government agency initiatives
・Strengthen systems for enlisting the help of advanced outside experts
・Promote recruitment of successful candidates from the“digital division”experts
・Enhance training

3 Collaboration based on full participation and awareness raising
Improve and review action plans considering progress of digitalization, including support for the elderly.

Cybersecurity Strategy

9

Executive summary

Implementation Framework● A concerted effort by the whole of government is needed to promote and implement cybersecurity policy in order to ensure a free, fair and secure

cyberspace in line with Japan’s cybersecurity policies. Further efforts will be made to strengthen the capabilities and collaboration of relevant agencies so that they can contribute to the digital transformation led by the Digital Agency, and leverage their limited resources to fulfill their roles.
● NISC and relevant ministries and agencies must work together to actively communicate this strategy to stakeholders both in Ja-

pan and abroad, in order to encourage each stakeholder to take practical actions, and further understanding by foreign governments of Japan’s stance and enhance deterrence against attackers with the importance of international cooperation in mind.
●T o enable comprehensive response by the whole of government against cyberattacks, the Cybersecu-

rity Strategic Headquarters will improve a national CERTs/CSIRTs framework.
●A nnual reports and plans should be discussed in an integrated manner, and activities for the next yearaligned with the results and evaluation of the previous year’s activities, in order to develop a cohesiveflow of activity which is in line with the strategy.

CabinetPrime Minister

National Security Council (NSC)

Digital Agency*1

Deliberates on important issues regarding national security.

Promotes digital transformation as a leader
toward the creation of a digital society.
Close collaboration on formulating
basic/development policies

Close collaboration

Chair:

Chief Cabinet Secretary

Deputy Chair:

Minister of state in charge of affairs concerning the Cybersecurity Strategic Headquarters

Members:

Chairman of the National Public Safety Commission Minister in Charge of Digital Affairs*1
Minister for Internal Affairs and Communications
Minister for Foreign Affairs
Minister of Economy, Trade and Industry
Minister of Defense
Minister in charge of Economic Security
Minister in charge of the Tokyo Olympic and Paralympic Games
Experts (8 persons; no more than 10 persons)Financial Services Agency
Ministry of Internal Affairs and Communications
Ministry of Health, Labor and Welfare
Ministry of Economy, Trade and Industry
Ministry of Land, Infrastructure, Transport and Tourism

Human Resources Expert Panel for
Dissemination and Enlightenment

Cybersecurity Measures Promotion Committee(CISO, etc. liaison committee)

S e c re t a ri a t

Cooperation

Competent Ministries of Critical Infrastructures

Technological Strategy
Expert Panel

National center of Incident readiness and Strategy for Cybersecurity (NISC)

Cooperation

Critical Infrastructure Expert Panel

Government Security
Operation Coordination Team
(GSOC)

Cybersecurity Council
Rapid sharing of information thathelps ensure cybersecurity at an early stage through mutual collaboration between multiple stakeholders
in the public and private sectors, etc.

Cyber Incident
Mobile Assistant Team(CYMAT)

Relevant Ministries

Ministries under HQ Members

Ministry of Education, Culture,
Sports, Science and Technology, etc.

Critical infrastructure
operators, etc.

Collaboration

Cybersecurity Strategic Headquarters (As of December 14, 2021)

Cooperation

Governmentorganizations

National Police Agency Digital Agency*1
Ministry of Internal Affairs Ministry of Foreign
and Communications
Affairs
Ministry of Economy, Ministry of Defense
Trade and Industry

Companies

Individuals(*1) Basic Act on Creation of a Digital Society (Act No. 35 of 2021), Act for Establishment of the Digital Agency (Act No. 36 of 2021). (effective since September 1, 2021)
10

Cybersecurity Strategy

Medium and Long Term

1 Japan in the 2020s
１-１

Establishment of the digital economy and promotion of digital transformation, expectations for contribution to SDGs, changing national security environment, impact and experience of COVID-19, and application of efforts toward the Tokyo Games.

Executive summary

Outline of the Cybersecurity Strategy 2021

2 Basic principles of the strategy
2 -１
2 -2

Ensuring a cyberspace which is“free, fair and secure”
The basic principles adhere to the 5 principles set forth in the previous strategies（assurance of the free flowof information, the rule of law, openness, autonomy, and collaboration among multiple stakeholders）

3 Issues surrounding cyberspace
Risks from the perspective of environmental changes, risks from the perspective of international affairs, and recent trends of threats in cyberspace

4 Policy approaches（1）Advancing digital transformation and cybersecurity simultaneously
Three
（2）
Ensuring the overall safety and security of cyberspace as it becomes increasingly public, interconnected and interrelated
directions（3）Enhancing initiatives from the perspective of Japan’s national security

Enhancing Socio-Economic Vitality
and Sustainable Development

Realizing a Digital Society where the People
can Live with a Sense of Safety and Security

Contribution to the Peace and Stabilityof the International Community andJapan’s National Security

1 Raising executive awareness1 P roviding a cybersecurity environment

1E
 nsuring“a free, fair and2E
 nsuring cybersecurity integral with

2 Strengthening Japan’s2A
 dvancing DX with Cybersecurity

among local regions and SMEs

3B
 uilding a foundation for

Strategy Period

ensuring trustworthiness of
supply chains that support
new value creation

４A
 dvancing digital/security

literacy with no one left
behindwhich protects the people and society

digital transformation (led by the
Digital Agency)

3・
 4・
 5

Promoting efforts by stakeholders which underpin the foundations of the economy and society

secure cyberspace”

capabilities for defense,
deterrence, and situational awareness3 International cooperationand collaboration①(Government agencies, etc.)②(Critical infrastructure)③(Universities, education andresearch institutions, etc.)
6 Seamless information sharing and collaboration by multiple stakeholders andapplication of knowledge gained throughefforts toward the Tokyo Games, etc.
7 E nhancement of readiness to

respond to massive cyberattacks, etc.

Cross-Cutting Approaches to Cybersecurity
Promotion of R&D

Recruitment, development, andactive use of human resources

Collaboration based on full participation
and awareness raising

5 Implementation Framework
A concerted effort by the whole of government to ensure“a free, fair and secure cyberspace”

Cybersecurity Strategy

11

Executive summary

Enhancement of Efforts to Achieve“Cybersecurity for All”
Cyberspace becoming a public
space where all stakeholders
are involved

Issues in cyberspace

Deepening interconnections
and interrelationships across
cyber and physical

Increasing threat tonational security

Cyberattacks
becoming more complex
and sophisticated“Cybersecurity for All”
Cybersecurity which leaves no one behind

Local regions, SMEs,
youths and seniors
faced with DX

Individuals andorganizations facing
invisible risks

Due to cyberattacks, criticalinfrastructure outages, intellectual
property theft and Increased
instances of financial damage

Attacks suspected ofbeing state-sponsored

Individuals

Organizations

Advance DX andcybersecurity simultaneously● Integral with digital transformation: raise executive

awareness, promote efforts by local regions and SMEs

(Management incentives, promotion of inexpensive
and effective support services and insurance)● A dvance literacy with no one left behind(Collaboration with workshops to support the useof digital technology by seniors, awareness raisingin line with the GIGA School Program, cybercrime
prevention volunteers)

Enhance initiatives from theperspective of national security●P lace higher priority on cyber issues in diplomaticand national security agenda in light of the threats
from China, Russia and North Korea●F undamentally strengthen cyber capabilitiesof the Ministry of Defense and SDF● L everage“capabilities to disrupt opponents’use of cyberspace

for attack,”employ diplomatic means and criminal prosecution,and maintain and strengthen the Japan-US alliance●P ursue international cooperation and collaboration

Ensure the overall safety and security of cyberspace as it
becomes increasingly public, interconnected and interrelated● Provide
a cybersecurity environment which protects people and society(Cross-industry supply chain management, cybercrime countermeasures, multilayered deployment of measures
for using cloud services, ensuring trustworthiness of cyberspace including the perspective of economic security)● Deploy comprehensive cyber defense to protect the people’s livesand the economy from serious cyberattacks(Enhancing the functions of national CERTs/CSIRTs which handle general coordination of integrated
advancement from information collection to response and coordination and policy measures,
security measures of stakeholders including government agencies and critical infrastructure)

12

Cybersecurity Strategy

Cybersecurity for All
Cybersecurity which leaves
no-one behind

Ⅱ

Cybersecurity Strategy

Cybersecurity Strategy

13

1

Introduction

Introduction

In the first year of the new decade, the world

nature. Changes in the international community

was faced with a series of discontinuous changes

are accelerating and becoming more complex,

due to the impact of the COVID-19 pandemic. As

including the emerging interstate competition incountries across the world-imposed lockdown andthe spheres of politics, economy, military affairs,

stay-at-home orders, it became clear that theand technology. This is accompanied by theordinary, everyday space which provides a

progress of information and communications

foundation for people’s lives and economic

technology, as well as a deepening

activities was not something that can be taken forinterdependence of complex economic and social

granted, but something fragile, with vulnerabilities

activities.

in its various aspects. On the other hand, theIt is now clear that a “free, fair and secure

effort to respond to this crisis has resulted in the

cyberspace” is not a given. Rather, we are at aaccelerated use of digital technologies by thecritical juncture where we may not be able togeneral public, and cyberspace is taking on greater

safeguard it. Against this backdrop, we must

importance as a sort of “public space” in our lives.

address the issues and challenges associated with

Moreover, this change can also be seen as reflecting acybersecurity with a spirit of “immutability andmajor trend continuing over a longer time span. The

fluidity,”3 an idea that constant change leads tospread of digital economy continued throughout thethe immutability of the value to be secured. To

Heisei era (1989–2019), and now in the Reiwa era, it isthat end, Japan needs a new strategy, one that will

expected to accelerate with the Digital Agency taking

serve as a cornerstone of its endeavors.

the lead. While Japan is expected to contribute to theinternational effort to achieve SDGs1 by 2030, the 2020s
will likely be a “Digital Decade” in which the Japanese
economy and society make a great leap toward therealization of Society 5.0,2 in which cyberspace isintegrated with physical space at a high level.
Meanwhile, the uncertainty surrounding
cyberspace is constantly growing and changing in

1 Stands for Sustainable Development Goals. SDGs set out international goals to be achieved by 2030 with the aim of creating a better,more sustainable world. They were unanimously adopted by UN member states at the Summit held in September 2015 as a successor to theMillennium Development Goals (MDGs), which were formulated in 2001. SDGs, documented in the “2030 Agenda for Sustainable Development,”
consist of 17 goals and 169 targets, promising that “no one will be left behind.”2 Society 5.0 is the 5th stage of human history, following the hunting society, agricultural society, industrial society, and information society.
It is a society in which new value and new services are created continuously, bringing wealth to the people of society. (Source: Growth Strategy
2017 (Cabinet Decision on June 9, 2017))
3 This phrase is said to be the word of Matsuo Basho, a Japanese haiku poet of 17th century, who allegedly put it forward as a principle for
capturing the essence of haiku. “Immutability” refers to things that transcend the passage of time and remain unchanged through the ages, and“fluidity” expresses the idea that some things change over time. These two ideas do not intrinsically conflict with each other. Rather, it is believedthat true “fluidity” will naturally lead to “immutability,” and true “immutability” will of itself give rise to “fluidity.” (Source: Encyclopedia Nipponica,
Shogakukan)

14

Cybersecurity Strategy

in order to advance digitalization. To that end, the1.1.

Digital Agency, which was established inJapan in the 2020s: Era of the“newSeptember 2021, will lead the effort to create anormal”and the digital society

digital society, and powerfully promote digital（1）Spread of digital economy and promo-society where people can choose services that suittion of digital transformation (DX)their needs and realize diverse forms of happiness

The rise of the internet has led to the creation ofIntroduction

transformation under the vision of creating “athrough the use of digital technology,” with thea new space called cyberspace, and the great

aim of achieving “people-friendly digitalization,

advancement of the digital economy through thewith no one left behind.”8

Heisei era. The digital economy is generating an
impact that is felt in people’s lives. In Japan, the(2) Expectations for contribution to SDGs

proportion of the population using the internet

The realization of Society 5.0, which Japan ishas exceeded 80%4, and an average internet user

powerfully advancing, will enable further use of

now spends more than two hours a day online.

data, which is expected to help solve global issues

5

People’s behavior has changed, including thein various areas that are identified as priorities by

growing use of IoT,6 AI, 5G,7 and cloud services,

the SDGs, including disaster prevention, climate

diffusion of remote working, and implementation

change measures, environmental protection, andof ICT in education, and cyberspace is becoming aempowerment of women.

foundation of economic and social activities for

In particular, for Japan to achieve “green growth”

everyone. This tide of change is expected toalong with “carbon neutrality in 2050,”9 it is said

provide a positive thrust to support the realizationthat a robust digital infrastructure including smartof Society 5.0, in which cyberspace is integrated

grids and automated manufacturing is essential.10

with physical space at a high level.
Meanwhile, various issues and challenges,
including prevention of damage from abuse andmisuse, cultivation of literacy, and measures(3) Changes in the national security
environment
The uncertainty surrounding the existing order

against delays in digitalization in both public andthat Japan has enjoyed is increasing rapidly. The

private sectors, must be addressed appropriatelyinternational community is changing at an

4 Data from the 2020 Communications Usage Trend Survey (published on June 18, 2021) conducted by the Ministry of Internal Affairs andCommunications. Internet users account for 83.4% of respondents overall, and over 50% of elderly respondents.
5 Data from the FY2019 Survey Report on Usage Time of Information and Communications Media and Information Behavior (published on
September 30, 2020) conducted by the Institute for Information and Communications Policy of the Ministry of Internal Affairs and Communications.
6 Abbreviation of Internet of Things.
7 5th generation mobile communication system. In September 2015, the International Telecommunication Union (ITU) issued Recommendation ITU-R M.2083, which described the key capabilities and concepts of 5G. This recommendation presented enhanced mobile broadband(eMBB), ultra-reliable and low latency communications (URLLC) and massive machine type communications (mMTC) as three scenarios for theuse of 5G, listing a maximum transmission speed of 20 Gbps, a latency of about 1 millisecond, and 1 million connected devices per square kilometer as major requirements.
8 “Basic Policy on Reform toward the Realization of a Digital Society” (approved by the Cabinet on December 25, 2020)
9 In October 2020, Japan announced its aim to “achieve net zero greenhouse gas emissions, or carbon neutrality, by 2050, and become acarbon-free society.”
10 “Green Growth Strategy Through Achieving Carbon Neutrality in 2050” (formulated on June 18, 2021)

Cybersecurity Strategy

15

Introduction

increasing rate and is becoming more and more

2025 World Exposition (hereinafter referred to ascomplicated, including the emerging competition

the “Osaka Kansai Expo”), to improve Japan’s

between nations in the spheres of politics,

cybersecurity. The knowledge and know-how

economy, military affairs, and technology, andacquired through these efforts are valuable forcircumstances around cyberspace have the risk ofother countries as well, and they are expected to

rapidly developing into a grave situation.11

help facilitate international collaboration by being
provided and shared around the world.

(4) Impact and experience of COVID-19
Faced with a series of discontinuous changes
due to the impact of the COVID-19 pandemic,
people were forced to respond to various

1.2.
Meaning of the strategy

restrictions and societal demands. The “newnormal” lifestyle that emerged as a result partially

The Cybersecurity Strategy to be formulated

embodied the realization of Society 5.0.

based on the Basic Act on Cybersecurity

Specifically, diverse work styles including remote(hereinafter referred to as the “Basic Act”) will beworking, implementation of ICT in education,

the third one, and it has been about seven years

telemedicine, and other similar initiatives

since the Basic Act was enacted in 2014.

advanced remarkably compared to before thepandemic.
The process of responding to the pandemic alsoThis strategy will set out the goals andimplementation policies of the various measuresthat must be taken in the next three years during

expedited the creation and use of new services

the early 2020s. These goals and policies will bethat leverage various data including personal

provided from a medium- to long-term

data.

perspective and based on an understanding of the

12times as outlined above. At the same time, this(5) Application of efforts toward the TokyoGamesThe Tokyo 2020 Olympic and Paralympic Gamesstrategy will communicate to all stakeholders,foreign governments, and attackers Japan’scommitment to ensuring cybersecurity based on(hereinafter referred to as the “Tokyo Games”)

the lessons learned from the response to thewere held in 2021. The efforts undertaken together

unprecedented COVID-19 pandemic, digitalby the public and private sectors to build responsetransformation, and the experience to be gained

capabilities and promote risk management inthrough the handling of the Tokyo Games.

preparation for this event have no doubt been an
invaluable experience for Japan, including the factthat they all took place under an unprecedented
environment of a COVID-19 pandemic. This
experience will be applied to future events,
including large-scale international events like the11

See 3.2 “Risks from the perspective of international affairs” for a detailed discussion on anticipated risks.

12

A concept that includes attribute information, travel/action/purchase histories, personal information collected from wearable devices, and humanflow information, product information, and other information that are processed so that they cannot be used to identify specific individuals.

16

Cybersecurity Strategy

2Concept of the strategy

Japan will adhere to its basic position on

it should be well-understood that the need tocybersecurity including the “objectives of the Basicensure “a free, fair and secure cyberspace” isAct,” ideas about “cyberspace to be ensured” asgreater than ever now when securing cyberspacepresented in the past two cybersecurity strategies,

is at risk.

2.1.
Cyberspace to be ensured

2.2.
Basic principles
With this understanding, Japan will firmly

The global expansion and development ofConcept of the strategy

and “basic principles.

maintain and abide by the five principles upheld

cyberspace has turned it into a place where a widein the past cybersecurity strategies as the basic

range of information and data, both in terms ofprinciples to be followed in formulating andquality and quantity, can be freely generated,

implementing measures on cybersecurity.

shared, analyzed and distributed across national
borders regardless of time and place. Equippedwith these characteristics, cyberspace offers aplace where people can enrich their lives and(1) Assurance of the free flow of
information
For the sustainable development of cyberspacerealize diverse values by creating intellectual

as a place for creation and innovation, it isassets such as technological innovations and newimperative to build and maintain a world in whichbusiness models. As such, it serves as atransmitted information reaches the intended

foundation for the sustainable development of therecipient without being unfairly censored or

economy and society in the future while

illegally modified en route (a world where “Dataunderpinning liberalism, democracy, and cultural

Free Flow with Trust” is ensured).13 At the samedevelopment.

time, it must be made clear that the free flow of

To serve the purpose of the Basic Act by making

information does not harm the rights and interests

cyberspace “a free, fair and secure space,” theof others without due cause, including

government has formulated a cybersecurity

consideration for privacy.

strategy twice so far. This strategy defines Japan’s
basic plan for its measures on cybersecurity.
Given an understanding of the era as discussed(2) The rule of law
As the integration of cyberspace and physicalabove, there is no reason to assume that the

space progresses, the rule of law should be

purpose of this strategy and its stance topermeated in cyberspace, in the same way as incyberspace should be changed in any way. Rather,physical space as cyberspace developed as a

13

Article 1 of the Basic Act stipulates, “ensuring the free flow of information.” Its importance is recognized internationally as well. For example, theRoadmap for Cooperation on Data Free Flow with Trust (DFFT) is endorsed in the G7 Summit Communique (June 2021).

Cybersecurity Strategy

17

foundation underpinning liberalism, democracy,

stakeholders, including the national and local

and so forth. Similarly, it should also be madegovernments, critical infrastructure operators,

clear that any acts that threaten peace andcyber-related and other businesses, educational

activities that support such acts should not be

and research institutions, and individuals. For thecondoned, assuming that existing internationalsustainable development of cyberspace, all

law including the UN Charter is applied in thestakeholders are required to consciously fulfill

cyberspace.

their respective roles and responsibilities. To doso, coordination and collaboration are required inConcept of the strategy(3) Openness
In order to achieve the sustainable development

addition to individual efforts. The national
government has the role of promoting thisof cyberspace as a space to generate new values,

coordination and collaboration, while further

it must be open to all stakeholders without

promoting collaboration with other countries that

restricting possibilities of linking diverse ideas andshare common values and cooperation with theknowledges. Japan firmly adheres to the positioninternational community, in light of changes inthat cyberspace must not be exclusively

international affairs. 15

dominated by a certain group of stakeholders. This
encompasses the idea that all stakeholders should
be given equal opportunities.

To meet the expectations of the people,
cybersecurity policies should safeguard their freeeconomic and social activities, secure their rights(4) Autonomy
Cyberspace has developed through theand convenience, and protect them by deterring
the activities of malicious actors through law

autonomous initiatives of multi-stakeholders. It is

enforcement and legal systems in a timely andinappropriate and impossible for a state to take on

appropriate manner. Japan will make it clearer

the entire role of maintaining order for cyberspacethan ever that the nation possesses political,

to sustainably develop as a space where order andeconomic, technological, legal, diplomatic, and all

creativity coexist. To maintain order in cyberspace,other viable and effective means as national

it is also important for various social systems tooptions.

autonomously fulfill their roles and functions,
thereby increasing society’s resilience as a wholeand deterring the activities of malicious actors, so
this will be facilitated. 14(5) Collaboration among multistakeholders
Cyberspace is a multi-dimensional world
established through activities of multi-

14

Article 3, paragraph (2) of the Basic Act stipulates that “The cybersecurity policy must be advanced with the principle to raise awareness to eachindividual member of the public about cybersecurity and encourage each individual member of the public to take voluntary actions.”

15

Article 3, paragraph (1) of the Basic Act stipulates that “[cybersecurity policy] must be advanced with the principle to proactively respond to
cybersecurity threats through coordination among a variety of actors.”

18

Cybersecurity Strategy

3Issues surrounding cyberspace

In formulating this strategy, it is important toregardless of age, gender, or geographic location,
participate to engage in social and economicmuch as possible, with the aim of achieving theactivities autonomously. In addition, in

vision of creating, through digital transformation,

circumstances where various services are offered“a society where people can choose services thatin cyberspace, the interconnection andsuit their needs and realize diverse forms ofinterrelationship between stakeholders across thehappiness through the use of digital technology.”

boundaries of cyberspace and physical space areThis must be based on an accurate understanding

also expected to deepen further as a result of theof not only the benefits provided by cyberspace,

popularization of cloud services, increased

but also the changes and risks (including thecomplexity of supply chains17, and other factors.

perspectives of both threat and vulnerability)
surrounding it.

On the other hand, the use of digital technology
in cyberspace presents new challenges as well. It

Cyberspace itself has expanded quantitatively as

has been pointed out that if used inappropriately

digital services have become established in society

with malicious intent, it can deepen the rift andand an increasingly diverse range of people

increase risks between nations, suppress humanparticipate in cyberspace. At the same time, its

rights, and expand inequality.18 Risks which were

contact points with physical space have expanded

unforeseen previously can also be increased byto cover broader areas, and the values it can

the transformation of cyberspace, and changes

deliver have diversified qualitatively, largely

that take place in a discontinuous manner due tothrough an increase in the amount of data that

the COVID-19 pandemic and other factors may

can be handled, the spread of new digital services

generate concerns about such risks emerging inthrough the use of IoT, AI, mobility innovation,

unexpected ways. While cyberspace continues to

AR/VR16, and other cutting-edge technologies, andtransform into a public space, it is also true thatthe establishment of the new lifestyle that hassuch circumstances have caused the people tobecome the “new normal.”continue to harbor a sense of anxiety about

As these developments advance simultaneously,
mutually affecting each other, the nature ofIssues surrounding cyberspacetake an approach that controls the uncertainty as

cyberspace.19
To ensure “a free, fair and secure cyberspace”

cyberspace is changing as well. It is expected thatwith these circumstances in mind, it is necessary

cyberspace will become increasingly positioned as

to clarify the issues that must be addressed andan important public space where all the people,

promote policies based on a proper understanding

16 AR stands for Augmented Reality and VR stands for Virtual Reality.
17

A supply chain generally refers to the flow of goods and information in business activities from upstream to downstream, from the receiving andplacing of orders between suppliers and the procurement of materials to inventory management and product delivery. In addition, supply chainsin IT may also encompass the product design stage and the operation, maintenance, and disposal of information systems and so on.

18

This is also presented as a new challenge in the “Declaration on the commemoration of the seventy-fifth anniversary of the United Nations,”(September 21, 2020) and addressing digital trust and security is considered a priority.

19 According to a questionnaire survey conducted by the National Police Agency in September 2020, 75.3% of respondents say they feelanxious about cybercrime. (Source: “2020 Cybersecurity Policy Meeting Report” (March 2021 National Police Agency Cybersecurity Policy Meeting))

Cybersecurity Strategy

19

of the risks that arise from the changes that are

efforts to make cyberattacks more organized andcurrently unfolding, or changes that could occur insophisticated.

the near future. Naturally, it is extremely

As digital services begin to take root in people’s

important to consider at the same time that these

lives, it is conceivable that attack methods willassumptions may change significantly over the

become more diversified and advanced, and gaps

medium to long term as service providers change

formed in the process of coordinating digital services

every few years in cyberspace, which means that

may become vulnerabilities for attackers to target.

stakeholders that play a major role in ensuring

It is also conceivable that attackers will takecybersecurity can also change.
The following sections will identify the risk

advantage of the fruit of technological innovation,
leading to greater threats. For example, if AI

Issues surrounding cyberspacefactors to be considered based on changes in thetechnologies are exploited by attackers,

environment surrounding the economy andcyberattacks will be launched at a speed and on asociety and developments in international affairs,

scale beyond the level of human capabilities andand show how they are emerging specifically.

technical skills. In the medium to long term, thepossibility of autonomous attacks that do not rely

3.1.
Risks from the perspective ofenvironmental changes

on human control must also be taken into
consideration.

(2) Perspective of vulnerabilities of theeconomy and society

While changes in the environment surrounding

From the perspective of the economy andJapan’s economy and society may provide a varietysociety as a whole, the advancement ofof benefits, those changes may also be

digitalization will inevitably involve companies inaccompanied by increased risks. In the following

various industries and business categories that

sections, those developments from thewere hitherto unrelated to cyberspace, and evenperspectives of threats and vulnerabilities of theindividuals including the young and elderly, toeconomy and society will be mentioned.

participate in cyberspace. While there are rising
expectations that cyberspace will become a space(1) Perspective of threats
Through the use of new technologies andtrust, gaps in literacy about cybersecurity andestablishment of the so-called “new normal,” newshortage or uneven distribution of workforce may

digital services continue to be created and become

be targeted by attackers as potential

part of people’s lives. This also means that people

vulnerabilities.

will be putting much more information about

Furthermore, shortage of human resources inthemselves—information that has bearing on theirbusiness organizations and the technology field may

lives, bodies, and property—than ever before onlead to a situation in which Japan must rely excessively

cyberspace, both quantitatively and qualitatively.

on foreign sources for products, services, and technology

This data will be used to create sources of value

related to cybersecurity. The lack of literacy also poses

and increase convenience, which benefit people.

the risk of creating new vulnerabilities in the economy

At the same time, it will provide greater incentives

and society through the misuse of devices and services.

for attackers to carry out cyberattacks, potentiallyIn addition, we are seeing increased use of cloud

resulting in more systematic and large-scale

20

where everyone can participate with a sense ofCybersecurity Strategy

services, expansion and widespread adoption of

products and services delivered through complex

these types of cyberattack poses the risk ofglobal supply chains, greater use of IoT devices

creating a graver situation that undermines theamong industries (i.e., everything becomespeople’s safety and security as well as theconnected to networks), and application of AI

foundation of a nation and democracy, evolving

technology to various systems. Due to these

into an issue of national security. Attackers aredevelopments, the impact of incidents on

becoming increasingly adept at hiding andeconomic and social activities may affect a broader

disguising their identities. In particular, cyberand more diverse range of stakeholders andactivities suspected of state involvement include

situations, making it increasingly difficult to solve.

cyberattacks presumed to be conducted by China

Moreover, the growing use of cloud services,to steal information from companies related to themilitary industry and possessing advanced

established part of business operations, istechnology, and by Russia to exert influence torevealing the limitations of the traditional concept

achieve military or political aims. North Korea isof “perimeter security.”20

also presumed to conduct cyberattacks to achieve
political aims or obtain foreign currency. In

3.2.

addition, it is observed that China, Russia, andRisks from the perspective of

capabilities of their military and otherinternational affairs

North Korea are continuing to build the cyber
institutions.21

Issues surrounding cyberspace

combined with remote working becoming an

In addition, as differences in basic values
As cyberspace has become a realm of interstate

become apparent and conflicts arise overcompetition that reflects geopolitical tensions

international rules and other matters concerning

even during normal times, and due to thecyberspace, some states are asserting that national

anonymous, asymmetric, and cross-border nature

governments should strengthen management andof cyberattacks, there are increasing threats ofcontrol of cyberspace. If this becomes theorganized and sophisticated cyberattacks,

mainstream for international rules, it may become

including those suspected of being state-

an obstacle to ensuring “a free, fair and securesponsored, with the aim of service disruption of

cyberspace” that underpins Japan’s national

critical infrastructure, theft of personal information

security and principles to be followed. As national

and intellectual property, and interference withsecurity has been expanding its scope to economic

democratic processes. As such, the situation inand technological fields, the struggle forcyberspace, while not amounting to national

technological supremacy is emerging, and someemergency per se, can no longer be deemedstates are stepping up collection, management,

purely in peacetime.

and control of data.

As wider sections of the economy and society

Moreover, as the supply chains for systems

are rapidly becoming digitalized, an increase incomprising cyberspace become increasingly

20 This concept is based on the idea of establishing a perimeter and cutting off the inside from the outside to prevent attacks from the outside
and information leakage from the inside. Perimeter security assumes that “things that cannot be trusted” do not enter through the perimeter, andonly “things that can be trusted” exist inside. This security model is mainly intended to defend networks.
21

Specific trends are detailed in 4.3 Contribution to the Peace and Stability of the International Community and Japan’s National Security.

Cybersecurity Strategy

21

complex and globalized, the risk of malicious

Moreover, the popularization of remote working

functions, etc. getting embedded in products

has led to increased cases of network intrusions

along the supply chain is arising. Similarly, risks

via individual devices or through exploitation ofrelated to the reliability and stable supply ofvulnerabilities in VPN22 devices, and cases in whichcyberspace itself (i.e., supply chain risks), including

cloud services become targets of attack. In fact,

disrupted supply of devices and services due tocyberattacks that take advantage of current

the state of political and economic affairs, areenvironmental changes have been observed,

emerging as well.

including those that target vulnerabilities createdIssues surrounding cyberspace

In this way, more and more organizations andin the pandemic (e.g., business email compromise

individuals are becoming exposed to the threat ofand phishing attacks related to vaccination news),

cyberattacks, and the means of cyberattacks areattacks via overseas branches where

becoming organized and sophisticated, whichcountermeasures tend to be relatively difficult toundermine the stability of cyberspace. This

reach, and attacks carried out through highly

situation has emerged as a common and urgent

anonymous infrastructure.

issue for the international community that is

In addition, Advanced Persistent Threat groups

extremely challenging to solve for eachare continuing to do damage, as evidenced by the

stakeholder and state alone, putting at risk Japan’s

fact that indiscriminate attacks rapidly increased inaim of ensuring “a free, fair and secure

2020. Existing threats are also becoming morecyberspace” on a global level.

complicated and sophisticated, as can be seen in"double extortion" ransomware attacks that

3.3.

demand money in return for restoring data andRecent trends of threats in cyberspacemisuse of anonymization and encryption

stopping the disclosure of stolen data,23 and thetechnologies by attackers to avoid being tracked.

Risk factors discussed above are seen as clear

As background to this, it is pointed out that an

trends from observing the recent stream of threats

ecosystem has become established to enable thein cyberspace.

provision of malware and collection of ransom toMany attacks suspected of involvement of crime

be carried out in a systematic manner, so thatorganizations or states are taking place. Overseas,

those with malicious intent can easily launch an

attacks interfering with democratic processes

attack even if they do not have sophisticated skills.

including those targeting elections, large-scale

These types of cyberattack are causing major

attacks exploiting vulnerabilities in supply chains,impacts on economic and social activities as wellattacks targeting industrial control systems, andas national security by halting production

other attacks against infrastructure that could

activities, causing service disruption, doing

impact a wide range of economic and social

financial damage, and stealing personal andactivities as well as national security are prevalent.

confidential information.

22 An abbreviation for Virtual Private Network. It refers to the technology or device used to simulate a situation where private networks areconnected by a dedicated line via the internet or a closed network used by a large number of people, using encryption and traffic control technologies.
23 For example, the G7 Summit Communique (June 2021) refers to “the escalating shared threat from criminal ransomware networks.”

22

Cybersecurity Strategy

4Policy approaches toward achieving the objectives — Cybersecurity for All

In this section, targets and guidelines of theunderstanding of issues discussed up to thepolicies to be implemented in the coming three

preceding section, these directions must be kept

years will be presented, based on thein mind in implementing measures to achieve any

understanding of issues discussed in the precedingof these objectives.

sections, with the aim of achieving the objectives
set forth in the Basic Act.
As stated above, cyberspace itself has both
expanded in quantity and evolved in quality,<Three directions>(1) A dvancing digital transformation (DX)24 andcybersecurity simultaneously
The COVID-19 pandemic has had the effect ofspace. It is safe to say that Japan has entered anadvancing the establishment of the new normal,

era of “Cybersecurity for All”, in which

and the Digital Agency was established incybersecurity must be ensured for all the people,

September 2021 to lead the effort to create abusiness sectors, local regions, etc. In the future,

digital society. Given these circumstances

all stakeholders, including those that previously

surrounding the digitalization of the economy andhad no connections with cyberspace, willsociety, it is undeniable that now is an excellent

participate in cyberspace in one way or another.

time to make up for Japan’s delay in digitalization.

Given this situation, it is necessary to pursue

On the other hand, unless awareness of

initiatives aimed at ensuring cybersecurity “withcybersecurity is raised and trust is built in the

no one left behind,” in response to digitalization.

technological foundation and data that compose

With this mindset, Japan will push forward withcyberspace, active participation and commitment

measures to ensure “a free, fair and secure

will not be gained within the current trend ofcyberspace” in an increasingly uncertain

digitalization, resulting in only achieving

environment, in keeping with the three directions

superficial digitalization that is not accompanied

stated below.

by real business transformation. Conversely,

These directions each correspond primarily toproperly addressing risks that change along withthe efforts toward “enhancing socio-economic

digitalization may also lead to increased

vitality and sustainable development,” “realizing aawareness and trust regarding cybersecurity.

digital society where the people can live with aDigitalization has a strong connection withsense of safety and security,” and “contributing toensuring cybersecurity from the perspective of not

the peace and security of the international

only the economy and society as a whole but also

community and Japan’s national security,” asthe activities of individual companies. It is

discussed in this section. In light of an

expected that the ability to respond to IT systems

Policy approaches toward achieving the objectives — Cybersecurity for All

becoming increasingly integrated with the physical24 Digital transformation is typically abbreviated as DX. The “DX Report” issued in September 2018 (Study Group for Digital Transformation of
the Ministry of Economy, Trade and Industry) cites the following definition: “An effort by companies to create value and establish competitive
advantage by transforming both online and real customer experience through new products and services and new business models, utilizing thethird platform (the cloud, mobility, big data/analytics, social technology), responding to disruptive changes in external ecosystems (customers,
markets), and driving transformation of internal ecosystems (organizations, cultures, employees).”

Cybersecurity Strategy

23and digitalization will form a source of added

in 2018, Japan encouraged public and private

value for operations, products, and services, as thesector initiatives based on the three approaches ofworld becomes increasingly digitalized. As such,“mission assurance” of service providers, “riskensuring cybersecurity will be an activity directly

management,” and “participation, coordination,linked to corporate value. Moreover, at a timeand collaboration” toward the sustainable

when speedy and flexible development anddevelopment of cyberspace.

response are becoming increasingly necessary, theIn an environment of increasing uncertainty due

concept of “Security by Design,” which represents

to growing threats in cyberspace, emergence of

the idea of ensuring cybersecurity in the planningvulnerabilities in the economy and society,and design stages of operations and systems ofchanges in Japan’s national security environment,

products, services, etc., will become more

and other factors, cyberspace must have the same

important than ever. It is also believed that digitallevel of safety and security as real space in orderinvestments and security measures will become

to be recognized as a public space. To this end,

increasingly integrated.

Japan must deepen and enhance the approaches

Policy approaches toward achieving the objectives — Cybersecurity for All

In this way, in both micro and macro(deepen mission assurance and enhance efforts

perspectives, it is important to promote

related to risk management) without overlooking

digitalization along with efforts to ensure

the asymmetrical situation with the attackers, andcybersecurity (hereinafter referred to as “DX withwork to improve the environment and address the

Cybersecurity”). All stakeholders must pursue theircauses.

initiatives with this understanding. In the current

Such societal demands require all stakeholders

efforts toward digital transformation, theinvolved in cyberspace to assume greater roles.

groundwork has just been laid for advancing

While the importance of independent efforts (“self-

digital transformation and cybersecurity at thehelp”) and close coordination among multiple

same time, with the Basic Act on the Formation of

stakeholders (“mutual help”) remains unchanged,a Digital Society (Act No.35 of 2021) clearlyJapan will continuously examine the role of eachstipulating that cybersecurity must be ensured.

stakeholder, including the role of “public help” that

The national government will powerfully support

serves as their foundation, and what to defend, andall efforts aimed at digitalization, including thethen enhance multi-layered approaches. In doing

creation of an underlying foundation.

so, the national government will strengthen theframework of national CERTs/CSIRTs25 while(2) E nsuring the overall safety and security ofensuring they can fulfill their function by making

cyberspace as it becomes increasingly

improvements and enhancements based on follow-

public, interconnected and interrelated

up. National CERTs/CSIRTs are responsible forIn the previous cybersecurity strategy formulated

general coordination to enable response to

25 Generally, CSIRT is an abbreviation for Computer Security Incident Response Team. It is an organization that monitors for security problems
in information systems, etc. within companies, government agencies, and other entities. In the event of a problem, it analyzes the cause andinvestigates the scope of impact. CERT is an abbreviation for Computer Emergency Response Team. It is an organization that responds to computer
security incidents. In Japan, when cyberattacks are addressed through international collaboration, specialized government and private sector
organizations work together to respond. In this strategy, national CERTs/CSIRTs are positioned as “a function responsible for general coordinationin the event of a serious cyberattack to enable a series of actions ranging from information collection and analysis to investigation, evaluation,issuing alerts, responding to the attack, and subsequent planning of policy measures to prevent recurrence, etc., to be pursued in an integrated
manner” (see 4.2.1(4) for details).

24

Cybersecurity Strategy

incidents that cannot be handled through self-help

supply chain into consideration, not just the one-or mutual help, as well as subsequent policy

to-one relationship between the providers andmeasures to prevent recurrence and makeusers, and act responsibly with the reliability of

improvements, to be pursued in an integrated

the supply chain in mind.

manner.

The importance of the concept of “mission(i) Deepening“mission assurance”

assurance” should remain unchanged. This should(ensuring trustworthiness of the entire

be further deepened so that all organizations, as

supply chain with a focus on securing

an entity that provides and composes cyberspace,delivery of services to end users)

will recognize ensuring the trustworthiness of thePreviously, the idea of “mission assurance” has been
26

entire supply chain, from the operations that they

positioned as an approach for service providers tomust perform and products and services that theysteadily perform operations that must be performed as

must provide to the end users, as their mission. By

a “mission,” with a focus on the direct users of services,doing so, Japan will aim to create an environment

in particular those under a contractual relationship.

where the safety and trustworthiness of the

In recent years, the popularization of cloudvarious products and services composing
cyberspace are ensured, so that users can continue

have led to the delivery of services throughto use them with a sense of trust.

cyberspace. With many stakeholders involved and(ii) Improving“risk management”efforts

the reliance on cloud service providers increasing,With the increased threat of organized and

it is becoming increasingly difficult for end users

sophisticated cyberattacks, Japan will cooperate

to see who is responsible for services andwith foreign governments and the private sector

operations. The impact of incidents is also

on various levels as it works to supplement the

becoming more widespread and complex, and it is“risk management” of individual stakeholders andbecoming increasingly difficult to foresee theeffectively strengthen efforts further.

repercussions and resolve the incidents. Taking

Specifically, Japan will actively and efficiently

cloud services as an example, the impact may(through the use of automation technology, etc.)

now extent not only to businesses that use adefend against cyberattacks while making efforts

certain cloud service, but also to the end users

to constantly review anticipated risks and ensuring

who use the services of those businesses. In these

the possibility of tracking attacks (hereinafter

circumstances, the impact will be all the greaterreferred to as “traceability”) after they occur, infor individuals who used to have little involvement

light of the trend of threats.

with cyberspace but must now inevitably

Cyberspace is used as a key channel for stealing

participate in it as a result of the progress of

personal information, information concerning

digitalization. Based on this understanding,intellectual property, which is a source ofentities that use cyberspace to perform operations

international competitiveness, and informationor provide services are required to take the entire

related to national security. Given this situation,

Policy approaches toward achieving the objectives — Cybersecurity for All

services and increased complexity of supply chains

26 Refers to the condition in which any organization represented by companies, critical infrastructure operators, and government bodies
understand the operations or services that they should carry out as their missions, and ensure necessary capabilities and resources to reliably
execute such missions. This means that senior executives or managers of each organization should identify operations or services that represent
their missions and take all responsibility for secure and sustainable provision, rather than making cybersecurity initiatives themselves the goal.

Cybersecurity Strategy

25

Japan will strive to ensure the trustworthiness ofthe technological foundation that composes
cyberspace while also dealing with suchcyberattacks.

(3) Enhancing initiatives from theperspective of Japan’s national security
The environment surrounding Japan’s national
security is becoming increasingly harsh, andcyberspace has become an area of interstatecompetition. Amid these circumstances, theasymmetrical situation with attackers incyberspace must not be overlooked.
While also having each stakeholder clarify suchstance, Japan will strengthen its defense
capabilities by securing the nation’s resilience
Policy approaches toward achieving the objectives — Cybersecurity for All

through enhanced capabilities of the Ministry of
Defense and the Self-Defense Forces (SDF), andother government institutions. At the same time,
Japan will enhance deterrence capabilities todetect, investigate, and analyze cyberattacks sothat Japan can identify the attackers and holdthem accountable. As for cyber threats, in close
coordination with its ally and like-mindedcountries, Japan will utilize political, economic,
technological, legal, diplomatic, and other viable
and effective means and capabilities, and takeresolute responses.
In addition, Japan will counter efforts intended
to prevent the healthy development of cyberspacein cooperation with its ally, like-minded countries,
and private organizations, and play an active roleto ensure “a free, fair and secure cyberspace”
globally, in a way that contributes to Japan’snational security.

26

Cybersecurity Strategy

4.1.

not working on digitalization. Based on thisEnhancing socio-economic vitality andawareness and advance initiatives pursued bysustainable development—Advancing DX with Cybersecurity

understanding, it is necessary to raise executive
companies to strengthen cybersecurity in line withdigitalization.
To advance digital management, matters thatJapan’s society and economy must achievebusiness managers are expected to practice todigital transformation accompanied by various

improve corporate value have been summarized

innovative changes in order to achieve the vision

as digital management guidelines, and businessof creating “a society where people can choose

managers are encouraged to implement them,services that suit their needs and realize diverse

from the perspective of creating an environment

forms of happiness through the use of digital

where funds, talent, and business opportunities

technology.”

flow toward companies that autonomously pursue

As the opportunities and impacts brought bydigital transformation affect all stakeholders

digital transformation.
Moreover, to strengthen cybersecurity, thewithout exception, they must be aware of DX withgovernment will build on previous efforts to raise

Cybersecurity, and related initiatives must beawareness about guidelines that illuminate theadvanced in all respects.

importance of advancing security measures under

It is vital that the perspective of cybersecurity is

the leadership of management. This will be doneby continuing to promote their use throughinitiatives in the course of promoting the digitalization

guidance and examples provided to facilitate theirof the economy and society—raising executive

implementation, and updating them as necessary.

awareness, implementing initiatives directed toward

With this understanding, the government will

local regions and SMEs, building a foundation for thework to ensure that efforts to strengthen

entire cyberspace as it becomes increasingly public,

cybersecurity in line with digitalization areinterconnected, and interrelated in the digital age, andvisualized so that investors and other stakeholders

improving the literacy of all members of the economy

who value sustainability will be aware of them,and society.

and that incentives are generated for such efforts.
It is expected that this will lead to a general

4.1.1

Raising executive awarenessrecognition—from both inside and outsidecompanies, including markets—of companies’

The impact of COVID-19 accelerated the shiftefforts as contributing to a sustainable

toward digitalization. Going forward, it will

improvement of corporate value, fostering a

become important for companies to have amomentum to promote further efforts. Specifically,

foundation for creating digital services, etc. withcybersecurity initiatives will be positioned inhigher added value in order to remain competitive.

policies to promote digitalization, including tax

It is assumed that executives must understandmeasures for digital-related investments and theboth digitalization and cybersecurity measures as

selection and announcement of forward-looking

basic skills and knowledge for management andcompanies that practice digital management

basic matters underpinning core operations andguidelines and work on digitalization. In addition,

revenue. As such, they must take full ownershipthe use of tools and guidelines to visualize theand seek to achieve them both simultaneously.

status of initiatives to stakeholders in and outside

Cyber risks will no longer serve as an excuse forcompanies will be advanced. Through such efforts,
Cybersecurity Strategy

Enhancing socio-economic vitality and sustainable development —Advancing DX with Cybersecurity

incorporated and measures are advanced for all

27

the government will follow up on the status of

specialized in security. These are issues that must

corporate initiatives when the promotion of

be addressed.

practices such as ascertaining cybersecurity risks

Therefore, in building local communities basedby executives and the disclosure of corporateon the idea of mutual help, the government will

information is expected.

continue to develop their functions and promote

Moreover, the government assumes thatefforts to create opportunities for local regions

communication with experts in and outside

faced with a lack of resources to address issues

companies will be indispensable for executives

and generate added value. The government will do

who pursue cybersecurity measures along withthis not only through consultation with experts but

digitalization through such integrated advancement

also by matching businesses and human resources,

measures as those stated above to appropriately

nurturing talent, and developing regional security

identify the risks inherent in the digital services

solutions. Leading practices will also be shared tothat are the source of their company’s competitive

help roll out these activities across Japan.

strength. To this end, the government will push

For SMEs, it is difficult to allocate a large budget

Enhancing socio-economic vitality and sustainable development —Advancing DX with Cybersecurity

forward with efforts to create an environment

to security. To address this issue, security

where executives can gain additional knowledge asmeasures targeting SMEs will be advanced,

needed even when they may not necessarily haveincluding making inexpensive, effective, andexpertise or work experience related to IT oraccessible security services and insurance products

security, when such knowledge becomes necessary

widely available for SMEs. Specifically, thein collaborating with internal and external security

government will advance efforts including review

experts (hereinafter referred to as “‘Plus Security’and registration of services that meet certain

knowledge”). 27

criteria for granting trademark usage rights, andself-declaration of security measures, in

4.1.2

Promotion of“DX with
Cybersecurity”among local
regions and SMEs

As businesses are forced to respond to thecooperation with an industry-led consortium
established with the aim of enhancing the
cybersecurity of entire supply chains, including
SMEs. The government will also create incentives

pandemic, business models, workstyles, andby making self-declaration a requirement for

employment patterns are changing as well.

subsidies targeting SMEs. It is expected that these

Against this background, opportunities for

initiatives will help visualize efforts to strengthen

digitalization are expected to spread to local

cybersecurity for business partners, etc., creating

regions, SMEs, and various industries and businessan opportunity to expand initiatives to cover local

categories that were previously unrelated toregions and SMEs.

cyberspace, without exception.

In addition, the government assumes thatOn the other hand, SMEs face a lack ofwidespread use of cloud services among SMEs will

expertise, talent, and other resources in theiralso become an important option going forward.

effort to pursue cybersecurity measures along with

Use of such services will entail a certain amount ofdigitalization due to a difficulty deploying staff

risk that information may inadvertently be leaked

27 Specific measures for creating an environment where non-executives can also gain “Plus Security” knowledge will be discussed in detail in
4.4.2 (1) (i).

28Cybersecurity Strategy

due to the placement of information assets off

increased impact on real space are raising concerns, andcompany premises, as well as problems with

it is assumed that risk management with a view of entire

settings, etc. Accordingly, the government will

supply chains will become increasingly important.

communicate guidance and other matters that cloudWith this understanding, the government will

service users must keep in mind, and consider ways

promote efforts to develop and implement

to urge cloud service providers to offer necessary

concrete security measures in the industry bysupport, including the provision of information andformulating both industry-specific and cross-tools to the users, to prevent or reduce

industry guidelines and promoting their use based

configuration errors when using cloud services.

on the above frameworks, etc.
The government will also assist efforts made by

4.1.3

Building a foundation for ensuring
trustworthiness of supply chainsthat support new value creationa consortium that engages in awareness raisingand developing concrete initiatives with the aim ofstrengthening cybersecurity measures across
supply chains, joined by organizations fromnew value by freely establishing interconnections

various industries. Under this framework, it isand interrelationships toward the realization of

expected that the government expands its

Society 5.0, in which cyberspace is integrated withactivities to cover local regions and SMEs throughreal space at a high level. On the other hand, fromsupply chains, and increase the trustworthiness ofthe perspective of ensuring its trustworthiness, it

entire supply chains, by evaluating, registering,

will be necessary to respond appropriately toand recommending services that target SMEs andissues that arise under such newly establishedmeet certain criteria, and by visualizing the statusinterconnections and interrelationships.

of efforts to strengthen cybersecurity.

In light of frameworks, etc., for security
measures that are formulated with the aim of(2) Ensuring trustworthiness of data flow

addressing such issues appropriately and coverIn advancing various social and economic

both cyberspace and physical space, theactivities in cyberspace, it is important to secure

government will advance initiatives to ensure

the authenticity of data and reliability of thecybersecurity that will serve as a foundation forfoundation of data flow that are the source of its

building trustworthiness in supply chainsvalue, including the perspective of ensuring data

supporting new value creation in Japan.

governance toward the realization of a Data Free
Flow with Trust (DFFT).28(1) E nsuring trustworthiness of supply
chainsAs supply chains have become more complex andBased on the characteristics of data whose
attributes keep changing as it flows between
different stakeholders, the government will work todigital services more connected, it is now possible toclarify the definition of data management andbuild more flexible and dynamic supply chains. On theestablish frameworks including procedures forother hand, from the perspective of cybersecurity, theidentifying risks and use cases, from the perspective

expansion of possible origins of cyberattacks andof identifying risk points. The government will use

Enhancing socio-economic vitality and sustainable development —Advancing DX with Cybersecurity

It is expected that all stakeholders will create

28 The then Prime Minister Abe’s speech, “Toward a New Era of ‘Hope-Driven Economy’ (tentative translation),” at the World Economic Forum
Annual Meeting (January 23, 2019)

Cybersecurity Strategy

29these frameworks to ascertain gaps between thetechnology and innovation, nurture products andrules of each country that handles data distributed

services made in Japan without relying excessively

across national borders.

on other countries.

It is also necessary to create an effective

Specifically, the government will promotemechanism for preventing spoofing of sources,business matching by establishing a foundation

falsification of data, etc. (hereinafter referred to as

for verifying the effectiveness of security products“trust service”) to make it available for use. Withand services and by performing verification tests

respect to the reliability of trust service, which

in production environments. In addition, theensure and prove the authenticity and integrity of

government will review, register, and list up

elements such as stakeholders, intentions, facts,

security services that meet certain standards andinformation, presence, and time, the government

promote the use of such services by government

will work on establishing and clarifying theagencies. The national government will also

requirements that must be fulfilled, evaluating

discuss efforts to visualize the reliability of

their reliability, providing relevant information,verification service providers toward the creationand establishing frameworks for internationalof a verification business market.

collaboration (confirmation of interoperability
with other nations), etc.

(4) Practical application of advanced
technology and innovation(3) Ensuring trustworthiness of security
products and services
Enhancing socio-economic vitality and sustainable development —Advancing DX with Cybersecurity

For independent efforts aimed at cybersecurity

As digitalization continues to advance, there will
be an increasing need for security measures thatare based on clear evidence and can be easily

to spread, security products and services provided

explained to parties within and outside

in the market must be trustworthy. As concerns

organizations, or that make use of automation,

about supply chain risks grow, and it becomesetc. for greater efficiency. The government must

increasingly difficult for the developers themselves

respond to the demand from society by urgently

to identify risks in entire systems due to common

advancing the establishment of a government-

use of open API29 and OSS30, it is believed thatindustry-academia ecosystem that facilitates

demand will grow for objective third-party

active industry-academia collaboration, and by

verification and evaluation from the perspective of

encouraging open innovation activities.

demonstrating the reliability of company products,

Security products and services used in Japan are

etc. both internally and externally, and businesses

largely dependent on overseas manufacturers,

that meet such demand will become even more

making it difficult to accumulate the necessary

important as an industry. From these perspectives,

know-how and knowledge for product and service

the government will work to build a foundation

development.

for ensuring reliability and, coupled with efforts
related to the practical application of advanced

As part of its effort to break through thissituation, the government will build an intellectual

29 API, which is an abbreviation for Application Programming Interface, is an input and output mechanism that one software makes available
to another software.
30 OSS, which is an abbreviation for Open Source Software, collectively refers to software whose source code can be used, investigated,reused, modified, expanded, and redistributed, regardless of the purpose of the user.

30

Cybersecurity Strategy

foundation for collecting, accumulating, analyzing,On the other hand, literacy is not something

and providing cybersecurity information within thethat can be gained overnight. Amid increasing

country, and while being mindful of information

opportunities to use various digital services andmanagement from the perspective of national

the advancement of efforts to digitalize thesecurity, the government will share suchgovernment, popularize the Individual Number

information effectively with various stakeholders

Card, and implement the GIGA School Program,32

as a node for industry, academia and theit is more important than anything to encourage

government. In doing so, the government willourselves to actively try using them and gain

actively share opinions with stakeholders andexperience toward enhancing and establishingform communities so that it will be useful for theliteracy. At the same time, various initiatives togovernment, industry, and academia in R&D andaccompany efforts to advance information

product development.

education should be implemented.

In addition, the government will develop and

The government will work to raise the awarenessdemonstrate a foundation for use with IoTof the people through joint activities by the public

systems and services across entire supply chains,and private sectors, in collaboration with efforts toand promote practical application with an eye tosupport the use of digital technology that leveragevarious industrial fields.

opportunities for such uses. For example, theAs part of its effort toward the practical

government will raise awareness about mattersrequiring attention concerning cybersecurity

government will promote technical reviews aimed

through collaboration with mobile phone dealers

at the use of new technologies in governmentand other local stakeholders for efforts targeting

agencies. In addition, to facilitate the global

the elderly, and with elementary schools, juniorexpansion of security products and services madehigh schools, and cybercrime prevention

in Japan, the government will continue to advancevolunteers for efforts targeting children. As for the

initiatives toward international standardization andadvancement of the GIGA School Program, thesupport for exhibiting at overseas trade shows.

government will deploy assistants who will help
teachers with their daily use of ICT, enhance the

4.1.4

Advancing digital/security literacy
with no one left behind

The foundation of cyberspace is becoming abasic infrastructure for people’s lives. As we
pursue “people-friendly digitalization, with no one

ability to provide guidance on the use of ICT inteacher-training programs, prime students whenintroducing computers, and advance education on
information ethics using video materials, etc.
With regard to the spread of disinformation onleft behind”31 in this context, it is essential thatthe internet, the government will pursue wide-

each of the people acquire skills and basic

ranging efforts to raise awareness and encourageknowledge and ability (i.e., literacy) involuntary efforts by the private sector, given thatcybersecurity so that they can use their own

such information can have an inappropriate

judgment to protect themselves from threats andimpact on individual decision making and societal

enjoy its benefits.

consensus building.

31

Enhancing socio-economic vitality and sustainable development —Advancing DX with Cybersecurity

application of these new technologies, the“Basic Policy on Reform toward the Realization of a Digital Society” (approved by the Cabinet on December 25, 2020)

32 This program seeks to provide one computer for every student and broadband communication networks to schools.

Cybersecurity Strategy

31

4.2.
Realizing a digital society where thepeople can live with a sense of safety
and security

4.2.1

Providing a cybersecurity
environment which protects thepeople and society

Given the increasingly public nature ofcyberspace, it is necessary to realize a society
where all stakeholders can enjoy convenience and

Now that cyberspace is taking on an increasingly

cybersecurity. The national government will

public nature, and deeper interconnections andcollaborate with relevant stakeholders in thisinterrelationships are forming across cyber andeffort, working to visualize the technologicalphysical boundaries, providers of all services arefoundation and services that make up cyberspacerequired to take the idea of “mission assurance” aand improve traceability in the event of anstep further and practice risk management inincident. These improvements will foster ankeeping with such changes in cyberspace. The

environment where each stakeholder can choose

security of cyberspace must be ensured to enableappropriate risk management options suited to

all the people and stakeholders involved intheir needs. In addition, by securing traceability

cyberspace to participate in it with peace of mind.

and encouraging victims of cybercrimes to report

To that end, the national government will take ato the police and notify public agencies, thecomprehensive approach to cybersecurity andnational government will eliminate factors andwork in cooperation with relevant stakeholders toenvironments that tolerate cybercrimes. These

create an environment where autonomous risk

initiatives will be pursued based on the principle

management is practiced through self-help andof “assurance of the free flow of information.”mutual help. For the socio-economic

With such changes taking place in cyberspace,

Realizing a digital society where the people can live with a sense of safety and security

infrastructure that serves as the foundation of thethe impact of incidents is becoming increasingly

people’s safety and security, the government willcomplex and may spread over a wide area. As

also lead implementation for the whole society bysuch risks come to the fore, the government will

actively introducing advanced initiatives while

work with relevant stakeholders to create anusing all means available to implement

environment where it is standard practice forcomprehensive cyber defense. This will be done

service providers to take a comprehensive view ofwhile constantly reviewing its defensive measures

the interconnections and interrelationships acrossand the key assets subject to defense against

cyberspace as they seek to thoroughly manage

cyberattacks, and collaborating with relevantrisks, focusing not only on the immediate users

stakeholders, with the aim of ensuring the safety

but also on the users who exist further

and trustworthiness of cyberspace.

downstream.

Through these initiatives, the government will

As for protecting the critical socio-economic

achieve a multi-layered cyber defense that is

infrastructure, the basic requirement will be forbased on the self-help, mutual help, and public

relevant stakeholders to ensure confidentiality,

help of all stakeholders involved in cyberspace,availability, and integrity according to their

which reduces risks and increases resilience forrespective roles. However, given the changing

the entire country.

nature of cyberspace as discussed above, it will
become more and more difficult to achieve thisgoal only by means of self-help and mutual help.
As such, the national government will actively

32

Cybersecurity Strategy

work together with relevant agencies, take thewill promote efforts to develop and implement

attackers’ viewpoints into account as well, and use

concrete security measures in the industry. This

all means available to implement comprehensive

will be achieved through the formulation of bothcyber defense, thereby working energetically toindustry-specific and cross-industry guidelines

reduce risks and increase resilience for the entire

based on a framework for security measures thatcountry.

cover both cyberspace and physical space.

It is also vital for the national government to

The national government will support industry-

constantly review the key assets subject to defense

led initiatives aimed at promoting information

against cyberattacks. In addition to information

sharing, reporting, and appropriate

related to national security, the personalannouncements within the supply chain, so that

information of the people and information

any risks that occur can be controlled by eachconcerning intellectual property, which is a source

stakeholder with a broad view of the entire supply

of international competitiveness, are important

chain, including SMEs, overseas offices, andassets that the national government must protect.

business partners.

As cyberattacks that steal these types of

In addition, the national government will build a

information compromise the safety and security ofmechanism for securing the reliability of supply

the people and injure fair economic transactions,chain components including devices, software,

the national government will take comprehensive

data, and services. In addition, the national

measures to protect those assets against

government will advance the construction of acyberattacks from a perspective of economic

mechanism for detecting and protecting against

security.

attacks that impair the maintenance and reliabilityof traceability, with the aim of continually(1) B uilding a safe and secure cyberenvironment for users

on the supply chain.
(ii) Ensuring safety and security inwith relevant stakeholders and pursue various

implementing new technologies andinitiatives to create an environment where theservices including IoT and 5G

stakeholders can choose appropriate risk

Amid the rapid proliferation of IoT, themanagement options suited to their needs,

government will work to realize a safe and secure

thereby contributing to enhanced risk

IoT environment by identifying devices that may

management based on self-help and mutual help.

be exploited to carry out cyberattacks and alerting

As an example, the government will work to

consumers. In addition, the government will

increase the traceability and visibility ofengage in collaborative activities, formulate

cyberspace through an integrated approach thatguidelines, share information, advanceencompasses both public and private sectors.

international standardization, and establish a

These initiatives will be pursued based on thesystem for addressing vulnerabilities, all with theprinciple of “assurance of the free flow of

aim of achieving secure IoT systems based on theinformation.”concept of security by design. Furthermore, in(i) Establishing supply chain management

terms of the use of IoT devices and systems, it will

grounded in cybersecurity

To undertake necessary supply chain measuresthat include risk management, the government

Realizing a digital society where the people can live with a sense of safety and security

The national government will work together

maintaining trustworthiness in these components

be necessary to combine cybersecurity measureswith measures taken from a perspective of safety,
so the government will advance the use of a

Cybersecurity Strategy

33

framework that meets the requirements for such abe implemented. Under such circumstances, thecombination of safety and security.

national government will always monitor the new

The government will also promote thetechnologies and services in cyberspace, analyze

establishment of a mechanism for safeguarding

their mutual impact on the stakeholders in

the cybersecurity of national and local 5G

cyberspace and the severity of the impact, andnetworks, as well as the development, supply, andcreate an environment where each stakeholder

deployment of 5G systems that ensure

can take responsible steps to safeguard

cybersecurity.

cybersecurity.

Moreover, the government will ensure safety

Cloud services in particular have become an

and security by formulating guidelines and codes

essential infrastructure in cyberspace, but usersof conduct for cybersecurity in new fields,

are also faced with unintended incidents due toincluding autonomous driving, drones, automatedmisconfiguration of services, for example. These

factories, smart cities, crypto assets, and theincidents may in some cases be hard to recognize

space industry.

or impossible to resolve alone. Also, in cloud(iii) Ensuring safety and security to protect

services the same incident may affect multiple

33

34

users

From the perspective of enabling secure use ofusers at the same time. In light of thesecircumstances, the government will push forward

telecommunications services and activities inwith the establishment of an open, high-quality

cyberspace, the government will study measures

cloud that is reliable and easy to use, so that users

for ensuring safe and reliable telecommunications

will be able to entrust their information assets to

networks while adjusting relevant laws andcloud services with peace of mind. The

regulations as necessary.

government will also work with the users, cloudAs for services used by many public institutions,service providers, system contractors, and other

Realizing a digital society where the people can live with a sense of safety and security

companies, and individuals, the government will

stakeholders to formulate cybersecurity rules that

promote cybersecurity measures including further

should be considered in the process of designing

supply chain management, considering their roleand developing information systems for

as a social platform.

government agencies, critical infrastructure
operators, and others to use cloud services. This(2) Strengthening cooperation with newproviders in cyberspace
Cyberspace is ceaselessly and advancingly

will enable users to select appropriate cloudservices that meet their risk management
guidelines, and correctly understand security

changing and new providers of services inpolicies and responsibilities, while fostering acyberspace are constantly appearing as ever-relationship with service providers in which any

improving technologies and services continue todifference of understanding can be properly

33 Smart cities are sustainable cities and communities where various issues faced by traditional cities and communities are resolved and newvalue continues to be created through the use of ICT and other new technologies, along with a wide range of private and public sector data. These
technologies and data are used to provide services that are tailored to each individual, and realize sophisticated management (e.g., planning,
maintenance, control, and operation) in various fields. Smart cities are places where Society 5.0 is realized ahead of the rest of the country.
34 Crypto assets are neither legal tender nor assets denominated in legal tender, but they can be used for the payment of compensation tounspecified persons or exchanged with legal tender in transactions with unspecified persons, as well as being electronically recorded and transferred.

34

Cybersecurity Strategy

addressed. At the same time, the government willthat are at high risk of being used to commit a

implement initiatives to visualize the safety ofcrime as revealed through criminal investigations,cloud services using ISMAP35 and other means.

and engaging with relevant business operators. In

These efforts will target a wide range ofaddition, the government will advancestakeholders in both public and private sectors

countermeasures against cybercrime in whichand promote increased use of cloud services thatpublic and private sectors collaborate each otherensure a certain level of security. As many cloudin information sharing and analysis, prevention ofservices are provided by foreign companies, Japan

damage due to cybercrime, and human resource

will work to advance global collaboration as well.

development. To prevent damage from cybercrime

These measures will be implemented in a multi-

by encouraging each individual to take voluntarylayered approach, and offered in a package asmeasures, the government will collaborate withnecessary, to ensure cybersecurity for SMEs andrelated institutions and organizations, including

users in local regions, building a safe and securevolunteer groups engaged in cybercrime

cloud service usage environment across Japan.

prevention, and advance public awarenesscampaigns.

(3) Addressing cyber crimes
In light of the fact that cyberspace is evolving to

For the purpose of dealing with crime where
advanced information and communication

involved, the national government shall continue

technologies are used, the government will

to push forward with the disclosure of criminals,

strengthen its digital forensics capabilities,

who exploit cyberspace, and malicious businessenhancing the technological prowess to analyze

operators, who provide criminal infrastructure

the latest in digital devices or malicious software,hindering traceability, with the aim of ensuring

and advancing comprehensive analysis forsafety and security on the same level as inpredicting threats to cyberspace and for unravelingphysical space.

those threats technologically.

To be able to deal with crime committed by

In addition to these initiatives, the government

misusing crypto assets, the dark web, social

will also strengthen efforts such as cooperation

media, and so on, and crime that makes use ofwith relevant business operators and international

advanced information and communication

collaboration, drawing on efforts made by othertechnologies, the government will strengthen its

countries, in order to remove environments andinvestigative capabilities and technologicalcauses that tolerate the current asymmetricprowess, and advance comprehensive analysis forsituation with attackers. Regarding the appropriate

predicting threats to cyberspace and for unravelingpreservation of communications history data logs

those threats technologically.

in particular, the government, on the basis of the

The government will also prevent cyberspacefrom becoming a criminal infrastructure throughrelevant guidelines, will get related business
operators to take appropriate measures.

public and private sector collaboration, leveraging

To ensure these efforts are implemented

information about infrastructure and technologies

effectively, the government will strengthen theRealizing a digital society where the people can live with a sense of safety and security

become a public space where all stakeholders are

35 Abbreviation of Information system Security Management and Assessment Program. ISMAP has been in use since FY2020 to assess the
security management of government information systems.

Cybersecurity Strategy

35

ability to respond to cyberattacks, for example, by

for general coordination in the event of a serious

considering creating dedicated operational units

cyberattack to enable a series of actions ranging

and a function for leading cyber departmentsfrom information collection and analysis towithin police organizations.

investigation, evaluation, issuing alerts,
responding to the attack, and subsequent(4) Deploying comprehensive cyberdefenseplanning of policy measures to prevent recurrence,
etc., to be pursued in an integrated manner.

As for serious cyberattacks that undermine theSpecifically, the government will improve response

people’s safety and security by disrupting criticalcapabilities and enable integrated and coordinatedinfrastructure services and stealing personal

response by marshalling resources andinformation, intellectual property, and money,

strengthening collaboration of responsible

there is a limit to the response that can be madegovernment agencies. The government will also

through individual stakeholders through self-help

strengthen collaboration with cyber-related

and mutual help, given the deepening

enterprises to expedite response and coordination,interconnections and interrelationships inincluding collecting information about cases

cyberspace. It is also difficult to assess the overall

whose impact may spread across different

impact of such cyberattacks, making it increasingly

organizations and sectors, and initial response.

challenging to implement effective defense.

The government will streamline public-private andFor these reasons, the government will respondinterstate information sharing, response, andRealizing a digital society where the people can live with a sense of safety and security

to such serious cyberattacks as a nationwide

coordination by further advancing collaboration

effort. Working in collaboration with relevant

between information sharing systems and withstakeholders and using all means and capabilities

relevant overseas agencies. These include theavailable, the government will implement

Cybersecurity Council,36 Cybersecurity Responsecomprehensive cyber defense measures thatand Coordination Center,37 and specialized

advance incident response ranging from obtaining

agencies that have sufficient technical capabilities

and analyzing appropriate information as needed

and expertise in communication and coordination

to dealing with specific cases, and policy measureswith stakeholders in and outside Japan. Moreover,including creating rules to prevent recurrence andthe government will carry out general coordination

make improvements.

with public and private stakeholders in light of(i) Strengthening the function of national CERTs/

issues presented by incidents and insights

CSIRTs that are responsible for generalobtained as a result. The national government will

coordination of comprehensive cyber defense

also formulate policies and implement measures

The government will reinforce the framework of

as necessary and in a timely manner, including

national CERTs/CSIRTs as a function responsible

establishment of systems.

36 The Cybersecurity Council was organized on April 1, 2019 based on the Act Partially Amending the Basic Act on Cybersecurity (Act No. 91 of 2018),
which was enacted in December 2018, to enable mutual collaboration between various public and private stakeholders and discussion on how to advancecybersecurity measures. The Council operates with the aim of preventing and containing damage from cyberattacks by enabling various stakeholders, bothpublic and private and regardless of the industry, to collaborate effectively and quickly share information needed to ensure cybersecurity.
37 The Cybersecurity Response and Coordination Center collects threat and incident information concerning cybersecurity for the Tokyo
Games, provides that information to relevant agencies, and supports and coordinates incident response by relevant agencies. It was establishedon April 1, 2019. It will be closed at the end of March, 2022.

36

Cybersecurity Strategy

Through these efforts, the government will

Also, given that incidents attributable to IT

enable rapid information collection as needed

systems implemented as part of the foundationfrom public and private stakeholders, andunderpinning Japan’s socio-economic activities andstrengthen the ability to quickly assess the overall

the lives of its people may lead to the suspension of

picture of damage. With the aim of improving

its functions, the government will assess

Japan’ comprehensive defense capabilities, thevulnerabilities in cyberspace that may jeopardize thegovernment will further advance the following:

autonomy of missions and functions, and consider

provision of timely alerts and information tailoredactions to ensure its trustworthiness, from theto various management and frontline needs,

perspective of economic security.

which contribute to greater impact and coverage(i) Efforts to support stakeholders that possessof information provided concerning national

the personal information of the people anddefense, and more effective defense andinformation concerning intellectual propertysystematic, detailed response according to the

The government will seek thoroughnature and severity of the attack andimplementation of countermeasures by providing

circumstances of each sector; cooperation withtimely and appropriate information about effective

global operations seeking to render cyberattacks

safety management measures that protect

harmless; and quick formulation of policy throughpersonal information from cyberattacks.
The government will also strengthen efforts inseamless general coordination.
(ii) Establishing an environment for steadycooperation with relevant organizations to

implementation of comprehensive cyberpromote the sharing of information that

defensecontributes to security measures by private

The government will work together and discusscompanies, universities, and other actors thatpossess or manage the personal information ofincluding vulnerability handling, technicalthe people and information concerning intellectual

verification mechanism for verifying the reliability

property.

and security of IT systems and services, and proper(ii) Ensuring“trustworthiness”of IT systems

and timely damage announcements, as well as

and services from the perspective of

establishing functions for investigating the cause

economic securityof relevant industrial control system incidents.

The government will advance measures
including study of systems to ensure the security(5) Ensuring trustworthiness of cyberspace

and trustworthiness of IT systems and services

Given that many of the cyberattacks currently

that are embedded in critical socio-economic

recognized target the personal information andinfrastructure with a major impact on its people’s

intellectual property information which is a source

lives and economic and social activities, as well asof international competitiveness, the national

their mode of business alliance and service

government will take comprehensive protective

contracts, examining various risk scenarios

measures against cyberattacks from a perspective

including supply chain risks as well. Theof economic security.

government will also advance the development ofRealizing a digital society where the people can live with a sense of safety and security

measures concerning “Active Cyber Defense”

38

38 Active Cyber Defense involves cooperating with cyber-related enterprises and implementing active preventive measures against threats inadvance.

Cybersecurity Strategy

37

new technologies needed to this end.
The government will advance the protection of

government, local governments, semi-public
sector, etc. and will be implemented.

international submarine cables and other

From the perspective of safe and secure data

infrastructure on which Japan depends for ausage, the Digital Agency will govern the planningmajority of its communication with overseas, andof ID systems which uniquely identify individuals

ensure their security, trustworthiness, andand corporations (e.g., Social Security and Tax

redundancy, through international and public-

Numbers, corporate numbers) and systems which

private collaboration.

ensure the authenticity of information and its

The government will advance efforts to create

provider (e.g., electronic signatures, electronicinternational standards for IT devices and services,

commercial registration certificates), in joint

and pursue international collaboration including

collaboration with relevant ministries, reform

standardization and establishing technicalthem from the user’s viewpoint, and promote

verification mechanism to ensure security andtheir utilization.

trustworthiness. In particular, the government will

The national government implements the ISMAP

enhance trustworthiness of IT systems andsystem, which supports the realization of the cloud-services from the perspective of both system andby-default principle, will update the system on an

technology. The government will do so by

ongoing basis in light of the implementation status,

strengthening efforts including supply chains forand encourages its use by the private sector as well.

procuring government information systems andadvancing the use of a security assessment system(ISMAP), and by initiating efforts to establish
technical verification capabilities and create
necessary standards.

4.2.3

Promotion of efforts by stakeholders which
underpin the socio-economic infrastructure (1)(Government agencies, etc.)

Each government agency is conducting security
measures in conformity with the unified

Realizing a digital society where the people can live with a sense of safety and security

4.2.2

Ensuring cybersecurity integral withdigital transformation (led by the
Digital Agency)

government security standards, while the national
government is working to enhance the overall
governmental security level through efforts

To realize “people-friendly digitalization, withincluding security audits based on the standards,

no one left behind,” it is necessary to thoroughly

CSIRT training as well as GSOC’s39 monitoring for

improve usability from the people’s perspective

malicious activities. Each government agency will

while also ensuring cybersecurity. For this reason,

strengthen security measures in every phase,the basic principle for cybersecurity will be

including the development and building phases of

proposed in the Digital Agency’s basic

information systems, as an essential aspect ofdevelopment and management principles

digitalizing the entire society.

(hereinafter referred to as “development policy”)
for the information systems of the national

In particular, critical systems commonly used by
the ministries will be maintained and operated by

39 Abbreviation of Government Security Operation Coordination team. The GSOC team operates the GSOC system designed for cross-government monitoring through sensors installed in each agency, analyzing attacks, providing advice to each agency, promoting mutual collaboration
between agencies, and information sharing. The first GSOC team was launched in April 2008 to monitor government agencies, and the second
GSOC team started operation in April 2017 to monitor incorporated administrative agencies.

38

Cybersecurity Strategy

the Digital Agency on its own or jointly with each

fourth GSOC (FY2021 to FY2024) and conduct

ministry, ensuring stable and continuous

technical reviews and revision of the unified

operation including security.

government security standards toward theIn addition, facing new security risk which has

implementation of security architecture with

been brought by the spread of remote work

continuous diagnostics and response, not limited

ascribed to COVID-19 and the introduction of

to the conventional “perimeter security model,”cloud services, the national government will

while initiatively promoting the implementation in

implement measures to ensure safe and secure

the government agencies from where possible.

realization of “new lifestyles.” In particular, theAlso, the government will discuss the roles andconventional “perimeter security model” is nofunctions of the GSOC in terms of measures tolonger adequate in some cases, so the national

address information security.

government will consider the suitable ways to

The national government will strengthen thedesign, operate, monitor and audit information

response to supply chain risks and IoT devices andsystems and address incidents under such cases

services (including IoT of industrial control

as well as how to arrange structures and humansystems) in administrative areas.

resources that will help to handle them.

The national government will implement

Given that the recent cyberattacks have become

security measures (e.g., authentication function,

increasingly complex and sophisticated, security

default settings of cloud services, vulnerability

measures have to be taken considering the overall

countermeasures) that should be adopted at the

supply chain where some subcontractors,

phases of the design and development of

including overseas offices and SMEs, may not

information systems.

have adequate measures and so may be targeted

The national government will maintain andimprove the cybersecurity response among

government will push forward with effective

government agencies, etc. through security audits

security measures that address such new threats

and CSIRT training, etc.

while assessing the effectiveness according to the

4.2.4

size of the organization and other factors.
Specifically, as security measures aligned withthe “cloud-by-default principle,”40 the national

Promotion of efforts by stakeholders
which underpin the socio-economic
infrastructure (2) (Critical infrastructure)

Japan’s economy and society depend on thegovernment will promote the revision andimplementation of the Common standards forcontinuous provision of various critical infrastructure

Governmental Agencies and Related Agencies inservices. Given the increasing interdependency

accordance with the expanding use of cloud

between critical infrastructures and increasing

services and consider enhancing the GSOC

complexity and globalization of supply chains, afunctions to enable cloud services’ monitoring.

safe and secure society cannot be realized without

41

The government will steadily implement thesafeguarding the cybersecurity of critical

Realizing a digital society where the people can live with a sense of safety and security

by cyberattacks. Therefore, the national

40 This principle summarizes the basic concept of cloud-by-default in government information systems, with the users of cloud services as thefirst candidate.
41

This is a unified framework for improving the level of information security of government agencies and incorporated administrative agencies. It
sets a baseline for their information security and specifies matters that need to be addressed to further raise the level of security.

Cybersecurity Strategy

39

infrastructure, which is subjected to threats thateach organization is widening. With thisincrease year after year, and enhancing its resilience.

understanding, the national government will base

The Basic Act clearly provides the responsibilities

its efforts on the current “The Cybersecurity Policyof critical infrastructure operators. The Act also

for Critical Infrastructure Protection (4th Edition)”42

provides that the national government mustwhich serves as a reference for criticalpromote voluntary efforts including formulation of

infrastructure protection, while also actively

standards, exercises, training, and sharing of

updating the policy to further enhance criticalinformation with regard to the cybersecurity of

infrastructure protection based on public-private

critical infrastructure operators, etc., andcollaboration. This will enable criticalimplement any other necessary measures.

infrastructure fields as a whole to flexibly respond

In light of the above, the government will ensure

to trends in future threats and changes in thethe stakeholders involved in critical infrastructure

environment surrounding systems and assets.

understand their responsibilities, and the

For the safe and continuous provision of critical

government will advance efforts toward theinfrastructure services, digital technology will playrealization of robust critical infrastructure througha huge role, and safeguarding cybersecurity

a joint approach by the public and private sectors.

concerns the very foundation of business
management. With this understanding, the(1) Advancing protection of criticalnational government will work to ensure that

infrastructure based on public-private

critical infrastructure services will be advanced,

collaboration

protected by appropriate security measures, andRealizing a digital society where the people can live with a sense of safety and security

For the safe and continuous provision of critical

maintain a suitable balance between business andinfrastructure services, which form the foundation

security. To this end, the national government willof the people’s lives and socio-economic activities,

further enhance the system of cross-sectoral

the public and private sectors will share a common

information sharing to facilitate information

policy between the national government, whichcollection by critical infrastructure operators, etc.,

bears responsibility for critical infrastructureso that each organization can make effective use

protection, and critical infrastructure operators,of lessons learned from prior examples. The

which independently carry out relevant protective

national government will also build a system thatmeasures. This will serve as the basic framework forwill enable management to fully exercise

critical infrastructure protection, and the national

leadership since it is important for the entire

government continues to promote these initiatives.

organization to work as one for security measures

Threats surrounding critical infrastructure are

to be effective.

becoming increasingly advanced and sophisticatedyear after year. On the other hand, due to thedifference in how systems are used in each field ofcritical infrastructure, the gap in threats faced by(2) Support for local governments
Local governments hold vast amounts ofsensitive information, including personal

42 The national government have formulated and advanced a common policy between the national government, which bears responsibility forcritical infrastructure protection, and critical infrastructure operators, which independently carry out relevant protective measures, as a basic
framework for critical infrastructure protection. This policy revises the 3rd Edition based on the idea of functional assurance that aims to provide
secure and sustainable services with an eye to the rapidly heightening threat of cyberattacks in recent years and the Tokyo Games.

40

Cybersecurity Strategy

information, and provide basic services closely
related to the people’s lives. In light of this fact,
the national government will provide necessary
support to ensure proper security at local
governments while considering the separation ofroles between the national and local governments.

4.2.5

Promotion of efforts by stakeholders
which underpin the socio-economic
infrastructure (3) (Universities, education
and research institutions, etc.)

Universities, inter-university research institutes,
etc. (hereinafter referred to as the “universities,

To ensure security measures are steadilyetc.”) consist of diverse members/organizations

implemented based on the “Guidelines forand own a wide range of information assets andinformation security policy for local

systems. Given this situation, the national

governments,” the national government will

government’s active support for them to build

support initiatives aimed at securing and training

collaborative and cooperative frameworks andhuman resources, enhancing systems, andinformation sharing is vital, along with theirsecuring necessary budgets.

autonomously taking measures.

43

The national government will continue toTo this end, the national government will

update the Guidelines and advance efforts toinitiatively help the universities, etc. establish andestablish necessary systems to be able to flexibly

prevalently comply with cybersecurity guidelines,

respond to the demands of a new era, such as

conduct seminars, training, and exercises on risk

standardization of local government information

management and incident response, appropriately

systems, handling administrative procedures

respond to initial response in the event of an

online, promotion of the cloud in line with theincident, and cooperate among the universities,“cloud-by-default principle,” and introduction of

etc., such as information sharing.

remote work as part of workstyle reform andbusiness continuity.

With regard to the universities, etc. that possess
cutting-edge technological information, theTo promote digital transformation (realization ofnational government will comprehensively help
them enhance common security measuresnational government will establish a security

implemented through the entire organization as

policy for local governments in the maintenancewell as technological measures for protecting thepolicy, in light of the “Basic Policy on Reform

technological information from advanced

toward the Realization of a Digital Society.”cyberattacks and effective measures against

44

With regard to the Social Security and Tax

supply chain risks.

Number System, which closely relates to thepeople’s lives and personal information, thenational government will enhancecountermeasures considering the balance between
convenience and security, and promote safe andsecure use.

Realizing a digital society where the people can live with a sense of safety and security

digital government) among local governments, the43 Revised by the Ministry of Internal Affairs and Communications in December 2020. These Guidelines explain the thinking behind information security policies and their content to serve as a reference for local governments when formulating and revising information security policies.
44 Approved by the Cabinet on December 25, 2020. This presents the government’s policy based on the discussions held in the working groupon digital transformation-related bills under the digital government cabinet meeting, concerning the future of digital society, thinking behind therevision of the Basic Act on IT, and thinking behind the establishment of the Digital Agency (tentative name).

Cybersecurity Strategy

41

4.2.6

Seamless information sharing andcollaboration by multiple stakeholders andapplication of knowledge gained throughefforts toward the Tokyo Games, etc.

cyber defense system through coordinatedcollaboration between stakeholders in cyberspace.

(2) Establishing an information sharing andcollaboration system that contributes

In light of the increasing risks in cyberspace, theto comprehensive cyber defense

national government will enhance risk sensitivity

To enable comprehensive response as the whole

and resilience, advance timely, geographically andcross-cuttingly seamless information sharing andof nation against cyberattacks, the national

collaboration for effective and responsive handling

government will strengthen collaboration betweenof cyberattacks, and maintain an ability to respond

information sharing systems, including theimmediately to large-scale cyberattacks even in

Cybersecurity Council, Cybersecurity Response andpeacetime.

Coordination Center, and specialized agencies that

To enable comprehensive response as the whole

have sufficient technical capabilities and expertiseof nation against new attacks, the nationalin communication and coordination withgovernment will leverage the findings and know-

stakeholders in and outside Japan, as part of

how obtained through efforts for preparation andefforts to improve a national CERT/CSIRT

operation for response capabilities and efforts forframework, and discuss the details of how torisk management for the Tokyo Games, as part ofcollaborate and coordinate with external parties.
The national government will actively make use

efforts to improve a national CERT/CSIRT

Realizing a digital society where the people can live with a sense of safety and security

framework. By doing so, the national governmentof the findings and know-how obtained throughwill advance efforts to raise the nation’s overall

efforts for preparation and operation for response

level of cybersecurity in peacetime, not just during

capabilities and efforts for risk management forlarge-scale international events, such as the EXPO

the Tokyo Games so as to support the business2025 Osaka, Kansai, Japan. The national

operators assisting the operation of the Tokyo

government will also share the findings andGames as well as nationwide operators’ efforts forknow-how obtained through operations during

cybersecurity measures. By doing so, the national

the Tokyo Games with the international

government will raise the nation’s overall level ofcommunity in an appropriate way.

cybersecurity at all times, from during large-scaleinternational events such as the EXPO 2025 to(1) Advancing information sharing andordinary times.

collaboration according to each field
and issue

4.2.7

The national government will enhance andstrengthen existing efforts for information sharing,
including CEPTOAR and ISAC45, and help toEnhancement of readiness to
respond to massive cyberattacks,etc.

Given that cyberspace and real space areestablish and facilitate new mechanisms forbecoming increasingly intertwined and the impact

information sharing under close collaboration withof incidents may spread over a wide area, andstakeholders in order to establish a multi-layered

based on damage forecasts that take these into

45 ISAC is an abbreviation for Information Sharing and Analysis Center. ISAC collects information on cybersecurity and analyzes it. The analyzed
information is shared among ISAC members and used for security measures.

42

Cybersecurity Strategy

consideration, the national government will
strengthen seamless and whole of nation
response capabilities even in peacetime keeping in
mind the possibility of a minor incident may
escalate into a major cyberattack.
The national government will strengthen
response capabilities against cyberattacks incooperation with communities in various fields
and regions, while also enhancing informationcollection, analysis, and sharing functions throughpublic-private collaboration.
The national government and each stakeholder
will strengthen response to large-scale
cyberattacks by training and utilizing security staff
through public-private collaboration.

Realizing a digital society where the people can live with a sense of safety and security

Cybersecurity Strategy

43

4.3.
Contributing to the Peace and Stabilityof the International Community andJapan’s National Security

presumed to be conducted by China to steal
information from companies related to themilitary industry and possessing advanced
technology, and by Russia to exert influence toachieve military or political aims. North Korea also
conducts cyberattacks to achieve political aims or

Amidst the growing severity of the security

obtain foreign currency.46 In addition, it is observed

environment surrounding Japan, the uncertainty

that China, Russia, and North Korea are continuingsurrounding the existing order that it has hitherto

to build the cyber capabilities of their military andenjoyed is increasing rapidly. Changes in theother institutions.47 Meanwhile, the United States,international community are accelerating andJapan’s ally, and like-minded countries that sharebecoming more complex, including the emerging

fundamental values have been accelerating efforts

interstate competition in the spheres of politics,

to build the capabilities of their cyber commands

economy, military affairs, and technology.

and strengthen the ability to respond to

Cyberspace has become a realm of competition
that reflects geopolitical tensions, even during

Under these circumstances, countries share the’Contributing to the Peace and Stability of the International Community and Japans National Security

normal times. The situation in cyberspace can noimportance of strengthening cooperation andlonger be deemed purely peacetime nor wartime,collaboration with their allies and like-minded

as alleged cases of cyberattacks by a military unit

countries, and they are collaborating to address

with advanced cyber capabilities targeting the

cyber incidents suspected of state involvement

critical infrastructure of another country. As greaterand conflicts over international rules in cyberspacesegments of society become increasingly

in particular. In the Japan-US Security Consultative

digitalized, cyberattacks have the risk of rapidly

Committee (hereinafter referred to as the “Japan-

developing into a graver situation. InfluenceUS ‘2+2’”), Japan-US Foreign Ministers’ meeting

operations carried out using cyberspace andand Japan-US Defense Ministerial Meeting held incyberattacks, which are difficult to attribute andMarch 2021, the ministers confirmed thewhose incurred damages are hard to assess, can,importance of further strengthening this field. In

at times, be conducted in combination withaddition, as national security has been expanding

military operations and used in an attempt toits scope to include economic and technologicalchange the status quo without engaging in armed

fields in recent years, Japan is likewise

attacks. In particular, cyber activities in which statecollaborating with its ally and like-minded

involvement is suspected include cyberattacks

countries to address conflicts over technological

46 Refer to the G7 Summit Communique (June 2021), G7 Foreign and Development Ministers’ Meeting Communique (May 2021), Final Report of
the Panel of Experts Assisting the UN Security Council Sanctions Committee on North Korea (March 2021), National Cyber Strategy of the UnitedStates of America (September 2018), and Cyber Strategy, US Department of Defense (September 2018) for more information about cyberattacks
carried out by China, Russia, and North Korea.
In addition, the Overview of Threats in Cyberspace 2021 issued by the Public Security Intelligence Agency and Review and Prospects of Public Orderissued by the Security Bureau of the National Police Agency (December 2020) refer to announcements made by the United States and others on
individual cases, in which the involvement of Chinese, Russian, and North Korean military and intelligence agencies is pointed out. See footnote 55
as well for more information on China.
47 Defense of Japan 2021, Ministry of Defense (Cabinet report of July 13, 2021)
48 Defense of Japan 2021, Ministry of Defense (Cabinet report of July 13, 2021)

44

cyberattacks.48

Cybersecurity Strategy

foundation and data as well.
In this context, the importance of ensuring “aunder the COVID-19 pandemic, so it has become
even more important to advance the rule of law in

free, fair and secure cyberspace” and contributing

cyberspace to deter such attacks and protect

to the peace and stability of the international

critical infrastructure. In the UN and elsewhere,

community and Japan’s national security has

Japan will actively promote its views on theincreased further. To ensure safety and stability of

application of international law, and collaboratecyberspace, Japan will place a higher priority on

with its ally and like-minded countries to ensure

cyber issues in diplomatic and national security“a free, fair and secure cyberspace” by actively

agenda. At the same time, Japan will promote theengaging in the practice of norms in cyberspace,rule of law, strengthen capabilities for defense,

based on its stance that the existing international

deterrence, and situational awareness against

law applies in cyberspace as well. Through suchcyberattacks, and further enhance international

activities, Japan will work to participate incooperation and collaboration.

discussions on the application of international law
and promote the practice of norms both in Japan

4.3.1

Ensuring“a free, fair and secure
cyberspace”

To ensure “a free, fair and secure cyberspace”
on a global scale, Japan will promote its basic
principles in the international arena. Japan will

and abroad, thereby contributing to Japan’snational security and efforts to enhance thedeterrent capability of the Japan-US Alliance as awhole.
As for measures against cybercrimes, Japan willcontinue to play active roles to advance the rule ofuse existing international frameworks such as thelaw in cyberspace and establish international rules

Convention on Cybercrime and advance its

in line with Japan’s basic principles, inuniversalization and enhancement. At the same

collaboration with its ally and like-mindedtime, Japan will promote the rule of law incountries.

cyberspace and further international collaboration
through full involvement in discussion on the(1) Promoting the rule of law in cyberspace

formulation of a new convention at the UN.

(formulating rules that contribute toJapan’
s national security)

In the G20 Osaka Leaders’ Declaration, the needis important for the peace and stability of theto promote Data Free Flow with Trust (DFFT) in ainternational community and Japan’s national

digital economy was confirmed, and the

security.

importance of trustworthiness in 5G security was

To ensure “a free, fair and secure cyberspace”

mentioned in the Prague Proposals.49 Theseon a global scale, Japan will promote to deliver theexamples show that moves toward international

concept of “a free, fair and secure cyberspace” inefforts based on collaboration among allies andthe international arena and play active roles tolike-minded countries are advancing. As for efforts

promote the rule of law in cyberspace. In

to create order in the form of “a free, fair andparticular, cyberattacks targeting medical

secure cyberspace” that Japan is pursuing,

institutions were observed in many countries

frameworks based on a multi-stakeholder’
Contributing to the Peace and Stability of the International Community and Japans National Security

The promotion of the rule of law in cyberspace(2) Formulating rules in cyberspace

49 The Prague Proposals refer to the Chairman Statement announced at the Prague 5G Security Conference in May 2019.

Cybersecurity Strategy

45

approach to internet governance such as theaware of the situation in cyberspace (situational

Internet Governance Forum are developing asawareness capabilities), while fundamentally

well.50

enhancing the government’s overall ability to

Meanwhile, in light of the fact that proposals
that may be incompatible with the existing order

respond seamlessly.
The National Security Secretariat will be inare being put forward, Japan will continue tocharge of overall coordination for these initiatives

deliver its basic principles to the international

related to national security. Under its coordination,community, and actively contribute to the

all relevant public and private stakeholders led byformulation of new international rules in line with

the National center of Incident readiness andthem. In addition, Japan will make every effort toStrategy for Cybersecurity with regard to defense,

ensure the formulation and implementation of

the ministries and agencies responsible forsuch international rules contribute to the peace

response measures with regard to deterrence, andand stability of the international community andinformation gathering and investigative

Japan’s national security. Japan will work with its

organizations with regard to situational awarenessally and like-minded countries and private

will closely cooperate from normal times andorganizations to combat efforts aimed at changing

proceed with the initiatives. When necessary,international rules in a way that impedes thedeliberation and decision will be made at thehealthy development of cyberspace.

National Security Council.
As part of the government’s overall effort

4.3.2

Strengthening Japan’s capabilities
for defense, deterrence, andsituational awarenessAmidst an increasingly severe security
environment surrounding Japan, cyberattacks haveconcerning national security, the Ministry of
Defense and the SDF will undertake various
initiatives based on the National Defense Program
Guidelines for FY2019 and beyond, andfundamentally strengthen cyber defense.

been taking place against governmental bodies,
critical infrastructure operators, companies and(1) Increasing defense capabilities

academic and research institutions possessing(i) Mission Assurance

advanced technologies. There are cases that could’
Contributing to the Peace and Stability of the International Community and Japans National Security

threaten to undermine the foundations ofprotect and support the people’s lives and socio-

democracy. Furthermore, some of these attacks

economic activities. A suspension of theirare suspected of state involvement.

functions would be a significant concern for

Given the situation, in order to protect Japan’snational security. The execution of their mission

national security interest from cyberattacks, it isrelies on the services provided by businessvital to secure Japan’s resilience against

operators which maintain critical infrastructure

cyberattacks and increase Japan’s ability to defend

and other systems. These operators also havethe nation from cyberattacks (defense capabilities),

important missions to provide the services

deter cyberattacks (deterrence capabilities), and beindispensable for the people and society.

50 The G7 Ise-Shima Leaders’ Declaration (May 27, 2016) states, “We commit to promote a multi-stakeholder approach to Internet governancewhich includes full and active participation by governments, the private sector, civil society, the technical community, and international organizations, among others.”

46

It is the mission of government agencies to

Cybersecurity Strategy

From the perspective of mission assurance,

organizations can exchange information andgovernment agencies and critical infrastructure

express their thoughts freely. It serves as one ofoperators, etc. must continue to advance efforts tothe foundations of democracy. On the other hand,ensure cybersecurity. The government will advance

it is necessary to prevent the malicious use offurther protection including risk reduction forcyberspace by terrorist organizations, such as

networks where critical information concerning

spreading and demonstrating violent extremism,

national security is handled. In addition, therecruiting of people into the organizations, andgovernment will steadily conduct joint exercises

gathering funds for organizations. For that reason,by the SDF and US military to defend critical

Japan will continue to work together with theinfrastructure and services that underpin theirinternational community and implement

activities. The Ministry of Defense and the SDF will

necessary measures against the activities ofstrive to fundamentally strengthen cyber defense

terrorist groups exploiting cyberspace, while also

capabilities, for example, by enhancing theguaranteeing the basic human rights including theposture of cyber-related units.

freedom of expression.

(ii) Protection of Japan’s Advanced
Technologies and Defense Related(2) Enhancing deterrence capabilities

Technologies(i) Measures for Effective Deterrence

As information crucial to Japan’s national

Existing international law, including the United

security is being targeted, further measures

Nations Charter, in its entirety is applicable inincluding risk reduction are needed to protect

cyberspace.51 Internationally wrongful acts

technologies relevant to its national security, suchcommitted by a state in cyberspace entail state

as technology related to space, nuclear power, andresponsibilities and a state that is the victim ofother advanced technology. As for the defense

such acts may, in certain circumstances, resort toindustry in particular, Japan will advance efforts toproportionate countermeasures and other lawful

maintain security by formulating new information

measures against the state responsible for the

security standards and further strengthening

wrongful acts. Under some circumstances,public-private collaboration. Moreover, thecyberattacks could amount to the use of force or

government will make further efforts toan armed attack under international law.52
Based on this recognition, in order to deterof threat perception with relevant businessmalicious cyber activities and protect the people’s

operators that underpin Japan’s national security,

safety and rights, Japan will continue to have close

including critical infrastructure operators, industry

coordination with its ally and like-mindedplayers in advanced and defense technologies,

countries from normal times, and will takeand research institutions.

resolute responses against cyber threats, including(iii) Measures Against the Malicious Use of

those possibly sponsored by states, utilizing

Cyberspace by Terrorist Organizations

Cyberspace offers a place where individuals and51

political, economic, technological, legal,
diplomatic, and all other viable and effective

In the 2015 report of the fourth session of the United Nations Group of Governmental Experts, it was confirmed that existing international law,
including the entire UN Charter, will be applied in cyberspace, and this was reconfirmed in the 2021 report by the UN Open-Ended Working Group.

’
Contributing to the Peace and Stability of the International Community and Japans National Security

collaborate and share information and awareness52 G7 Ise-Shima Summit, G7 Principles and Actions on Cyber (May 2016)

Cybersecurity Strategy

47

means and capabilities. In this regard, it wasquickly respond to incidents by seamlessly

confirmed in the Japan-US “2+2” in 2019 that atransitioning throughout the process of escalation

cyberattack could, in certain circumstances,from peacetime to large-scale cyberattacks andconstitute an armed attack for the purposes ofthen to armed attacks. In addition, Japan will

fulfilling the requirement of implementing thecontinue to maintain and strengthen the

Article V of the Japan-U.S. Security Treaty. In

deterrence of the Japan-US Alliance, in light of theaddition to employing capability to disrupt theoutcome of the Japan-US “2+2” in March 2021.

opponent’s use of cyberspace for an attack against(ii) Confidence Building Measures

Japan, Japan will take due steps including the use

Japan will work to build confidence amongof diplomatic means (e.g., condemningstates in order to prevent the occurrence ofcyberattacks) and criminal prosecution. As anunforeseen circumstances and deterioration of theexample of diplomatic means53, in July 2021, Japansituation caused by cyberattacks. The highly

issued a Foreign Press Secretary’s comment

anonymous and covert nature of cyberspace has

firmly condemning cyberattacks conducted by a

the risk of inadvertently heightening tensions

cyberattack group which the Chinese government

among states and aggravating the situation. In

is highly likely behind, and cyberattacks to haveorder to prevent such accidental or unnecessary

involved a cyberattack group which the Chinese

confrontations, it is important to build up

People’s Liberation Army (PLA) was highly likelyinternational communication channels as abehind,53 and indicating its will to take strict

confidence building measure during normal times

measures against these activities. Examples ofin preparation for the occurrence of incidents thatcriminal prosecution include investigations of aextend beyond national borders.

54

55

case in which the police sent an investigation

It is also necessary to increase transparency andreport to prosecutors in April 2021. Thesebuild confidence between states through theinvestigations led to the conclusion that the PLA

proactive information exchange and policy

was highly likely to be involved in the cyberattacks

dialogues in bilateral and multilateralby a group with close links to the PLA against

consultations. Japan will also cooperate with otherentities including Japanese companies.

states to utilize a mechanism for coordinating

Operational units established within the police

issues regarding cyberspace.

’
Contributing to the Peace and Stability of the International Community and Japans National Security

organization will continue to crack down on suchactivities.
Since cyberattacks have the risk of rapidly
developing into a graver situation, Japan will

53 To date, Japan has also issued a Press Secretary’s comment in 2017 criticizing North Korea’s involvement in WannaCry incidents, and in 2018
criticizing cyberattacks launched by a group called “APT10,” which is based in China, working in collaboration with its ally and like-minded countries.
54 A Foreign Press Secretary’s comment was issued firmly condemning cyberattacks conducted by a group known as “APT40,” which the
Chinese government is highly likely behind (July 19, 2021).
55 A case in which the Metropolitan Police Department sent an investigation report to the Tokyo District Public Prosecutors Office in April 2021,
naming a Chinese Communist Party member as a suspect. With regard to this case, the following comment was made in the press conference by
the Chief Cabinet Secretary on April 20, 2021:“We are aware that the investigation revealed that the contracted Japanese rental server was used tolaunch cyberattacks against JAXA (Japan Aerospace Exploration Agency) and other organizations, and that it is highly likely that an Advanced
Persistent Threat group called Tick, which the Unit 61419 of the Chinese People's Liberation Army is behind, was involved in the attacks.”

48

Cybersecurity Strategy

(3) S trengthening cyber situationalawareness capabilities(i) Increasing the Capabilities of Relevant
Governmental Bodies

Situational awareness capabilities are the

4.3.3

International cooperation andcollaboration

In cyberspace, the impact of incidents can easilytranscend national boundaries, and cyberincidents that occurred in other countries canfoundation of defense and deterrence capabilities.

easily affect Japan. Accordingly, it is important to

In order to deter increasingly serious cyberattacks

engage in multi-layered cooperation andand influence operations using cyberspace, incollaboration on various levels, including foreign

addition to enhancing response capabilities,

governments and the private sector. To this end,

adequate capabilities to detect, investigate, andJapan will advance the sharing of expertise andanalyze cyberattacks are necessary to identify thepolicy coordination, as well as international

attackers and hold them accountable. To this end,collaboration and capacity building support

Japan will continue to improve such abilities ofrelated to cyber incidents.

relevant agencies both in terms of quality andquantity, and advance efforts to further clarify theactual situation of cyberattacks, leveraging thenationwide networks, technical teams, and human
intelligence of relevant agencies.
In addition, the government will proceed with(1) Sharing expertise and policy
coordination
As conflicts over international rules andtechnological foundation come to the fore, Japan
will strengthen collaboration with its ally andwide ranging considerations of any effective

like-minded countries. This will include high-levelmeans including the development and securing ofcross-ministerial bilateral talks including cyber

cybersecurity human resources with high-level

dialogues with the US and like-minded countries,

analytical capabilities, and development andetc. and multilateral talks, as well as multi-layered

utilization of technologies for detecting,frameworks that enable the Cabinet Secretariat

investigating, and analyzing cyberattacks. The

and ministries to engage in practical international

government will also carry out initiatives related tocollaboration with their counterparts from normal

counter-cyber intelligence.56

times. Japan will actively advance cooperation(ii) Threat Information Collaboration

with the US, Australia, and India, as well as
ASEAN,57 and other countries in the field ofagencies within the government and with its ally andcybersecurity toward the realization of “Free andlike-minded countries will be advanced with the aim

Open Indo-Pacific (FOIP).”of accurately responding to and deterring diverse

Japan will also expand international

threats of cyberattacks, including those suspected ofcollaboration concerning information sharing instate involvement and those conducted by non-the private sector, acquire human resources in thegovernmental organizations. The government will

public and private sectors who can assert Japan’salso strengthen the threat information sharing andstance in the international arena, and develop

collaboration framework within the government led

human resources by dispatching them to otherby the Cabinet Secretariat.

countries and sending them to international

56 Intelligence defense activity against intelligence activity by foreign countries using information and communication technology’
Contributing to the Peace and Stability of the International Community and Japans National Security

Information sharing among relevant ministries and

57 Association of Southeast Asian Nations

Cybersecurity Strategy

49conferences. In addition, Japan will enhance theinfrastructure in recipient countries and promotes

communication of information about Japan’s

the development of the sound use of cyberspacecybersecurity policies to international audiences,

there.

and Japan will make international contributions by

Other countries are providing various capacity

sharing its experience at the Tokyo Games amongbuilding supports for developing countries. Under

others with other countries.

Japan’s basic principles, and based on the basic
policy on capacity building support that sets forth(2) Strengthening international
collaboration for incident response
To respond rapidly to cyber incidents andenhancing efforts including industry-academiagovernment collaboration, diplomacy, andnational security, Japan will provide the required

prevent the spread of damage, Japan will continue

supports strategically and efficiently as a

to enhance the sharing of information related tonationwide effort, and also in a multi-layered

cyberattacks (e.g., information aboutmanner in collaboration with diverse stakeholders

vulnerabilities and IoC58) with international

including like-minded countries, international

partners from normal times, and consider

organizations such as the World Bank, industry

disseminating information jointly with otherand academia.

countries. Japan will enhance its international

By ensuring cybersecurity in this manner, Japan

presence in the cyber community. To this end,

will promote the achievement of the SDGs andJapan will not only promote collaboration among

help maintain cyber hygiene. Moreover, Japan will

CERTs and participate in international cyberalso support capacity building not only throughexercises, but Japan will also lead such exercises

human resource development and cyber exercises,

and build trust for collaborative response, as well

but also in understanding and practicing

as serving as an information hub.

international legal principles, policy formation,
establishment of technical standards, and fields(3) Supporting for capacity buildingthat form the next-generation cyber environment

Today, as interdependence across borders has

such as 5G and IoT. Additionally, Japan will boost

deepened, it is not possible for Japan to secureoverseas business expansion in cybersecurity.59

peace and stability only by itself. Global

In addition to these efforts, Japan will’
Contributing to the Peace and Stability of the International Community and Japans National Security

coordination to reduce cybersecurity vulnerabilities

fundamentally enhance collaboration in the Indo-and to aim for their elimination is essential in

Pacific region in particular, including ASEAN. It willcontributing to ensuring Japan’s national security.

include diplomacy and national security in the

From this standpoint, assisting capacity building incyber field, based on Japan's achievements andother states directly leads to the security of theexperience in capacity building, and inentire cyberspace and contributes to theconsideration of the region’s geopoliticalimprovement of the global security environment

significance.

including Japan, as well as ensures the stability of
the lives of Japanese residents and the activities ofJapanese companies that depend on critical

58 IoC (Indicator of Compromise) is information that indicates traces of cyberattacks.
59 Infrastructure System Overseas Expansion Strategy 2025 (decided by the Infrastructure Strategy Economic Cooperation Meeting on June 17, 2021)

50

Cybersecurity Strategy

(1) Strengthening international

4.4.
Cross-Cutting Approaches to
Cybersecurity

competitiveness in R&D and building an
industry-academia-government
ecosystem
The field of cybersecurity research is new andIn order to achieve the three policy goals—

growing, with researchers flowing in from various“Enhancing socio-economic vitality andfields and the number of papers submitted

sustainable development,” “Realizing a digital

growing rapidly around the world. This is a fieldsociety where the people can live with a sense ofwhere active collaboration is seen, such as

safety and security,” and “Contributing to theinternational co-authorship and papers written forpeace and stability of the international community

government-industry-academia projects. Together

and Japan’s national security”—it is important towith the field of digital technology, this has

work on research and development, human

become an important field of research as the use

resource development, and awareness raising as aof digital technology becomes an integral part offoundation for the policy goals from both a cross-cybersecurity measures.

cutting and medium- and long-term perspective.
The government will advance initiatives keeping

While the number of cybersecurity researchers
has been increasing in Japan as well, societal

in mind the three directions of “Advancing digitaldemands have grown even further thanks to thetransformation and cybersecurity simultaneously,”

digitalization of the economy and society. To“Enhancing the overall safety and security ofachieve the digitalization of Japan and enhance,

cyberspace as it becomes increasingly public,

develop, and fully supply its own cybersecurity

interconnected and interrelated,” and “Enhancing

measures and technology, the government will

initiatives from the perspective of Japan’s national

promote research and government-industry-

security.”

academia collaboration from a medium- to longterm perspective, strengthen international

4.4.1

Advancement of R&D

competitiveness in R&D, and build a governmentindustry-academia ecosystem.
Specifically, the government will promote thethis field to pursue R&D with a practical approach,use of measures provided by relevant ministries toconsidering threat information and user needs. On

promote research and government-industry-the other hand, international competitiveness inacademia collaboration that will become sources

R&D and an industry-academia-governmentof scientific understanding and innovation, while

ecosystem must be established in Japan as aenhancing such collaboration and focusedfoundation for the effective implementation ofresearch coupled with voluntary development

practical R&D. The government will pursue

efforts by the research community. In addition,

initiatives aimed at building such a foundation

the government will strive to create anfrom a medium- to long-term perspective, as wellenvironment where researchers can engage inas practical initiatives based on such efforts.

research with peace of mind by providing fully

As it is also important to consider the progressequipped research environments.

of digital technologies, the government will

To establish a government-industry-academia

advance R&D taking medium- to long-term

ecosystem, voluntary development efforts by eachtechnological trends into account.

stakeholder is essential. The government will

Cybersecurity Strategy

Cross-Cutting Approaches to Cybersecurity

Cybersecurity research is extremely important in51

follow up on the status of these efforts as the

improve the effectiveness verification platform sogovernment advances its initiatives.

that products and services can be used with peaceof mind, and improve the business environment(2) Advancing practical R&D
Based on an understanding of current issues

businesses that meet the needs of SMEs. The

surrounding Japan (e.g., growing supply chain

government will also match businesses concerning

risks, providing cybersecurity with domestic

seeds and needs and promote their market

resources, possible occurrence of new threats due

expansion.

to the progress of AI, IoT, etc.), as well as a(iii) Enhance foundations for monitoring,

perspective of national security, the government
will advance practical R&D related to cybersecurity

analyzing, and sharing attacks

The government will strengthen informationin Japan along the following directions.

sharing platforms and the technology to observe,(i) Establish an all-Japan technical verification

identify, and analyze cyberattacks while using AI

system for addressing supply chain risks

and other advanced technologies, in order to

The government will advance R&D and practical

appropriately respond to the development ofapplication of verification technologies to verify

cyberattack threats, such as increasinglythat malicious programs and circuits are not built

sophisticated, complex, and diversified

into software and hardware. Specifically, thecyberattacks and increased vulnerabilities due togovernment will advance the establishment of athe spread of IoT devices.

comprehensive verification platform through theSpecifically, in order to respond to sophisticateddemonstration of high-level verification services

and complex cyberattacks and unknown threats toto test the trustworthiness of IoT devices,

IoT as it becomes increasingly widespread goingdevelopment of a system to ensure the security offorward, the government will develop more

5G components comprehensively andadvanced cyberattack observation technology

continuously, and R&D and practical application ofusing honeypot and other technologies thattechnologies to detect malicious functions throughflexibly respond to wide-area darknets andthe analysis of chip design circuits and observationdifferent attack types, and perform R&D on AI-

of system and service behavior, and of verification

based technology to automate the analysis oftechnologies toward the realization of a secureattack behavior. Moreover, to identify and analyze

Society 5.0.

the attack behavior of Advanced Persistent Threats

In light of these initiatives, the government will

and respond rapidly, the government will develop

Cross-Cutting Approaches to Cybersecurity

work as one to develop an implementationa more sophisticated platform for luring

framework for conducting technical verification of

cyberattacks and expand its usage, collecting

ICT device and service security, with the aim of

specific behavior samples and performing R&D on

ensuring the trustworthiness of the entire supply

technology to rapidly detect and analyze unknown

chain, considering efforts to secure and foster

Advanced Persistent Threats and other attacks. In

domestic technologies and possible uses in

addition, the government will perform R&D on

government procurement.

efficient wide-area network scans that will realize(ii) Advance support measures for cultivating/

improved traffic volume control and accuracy todeveloping domestic industries

With the aim of cultivating and developing the
cybersecurity industry, the government will

52of domestic industries such as by creating

Cybersecurity Strategy

identify vulnerable IoT devices with high reliability
and take security countermeasures. The
government will also advance initiatives to build

and share an intellectual foundation for collecting,advancing the widespread adoption and practicalaccumulating, analyzing, and providing

application of the results of R&D, the government

cybersecurity information within the country.

will also promote information exchange by(iv) Advance research of cryptography, etc.

relevant ministries toward the use of new Japan-

It is expected that existing encryption
technologies will become compromised when

made technology by government agencies as partof this effort.

practical, large-scale quantum computing isrealized. With this in mind, the government will
establish a foundation for advancing cutting-edge
research on post-quantum cryptography and(3) Taking medium- to long-term
technological trends into consideration
It is important to advance R&D based on aquantum cryptography to ensure security. The

medium- to long-term perspective ofgovernment will also establish lightweighttechnological trends, according to the progress ofencryption technology to enable secure

IT technology, including the development oftelecommunications even with devices with

“Beyond 5G”60 and other advanced network

limited resources such as IoT devices.

technologies. In particular, it will be necessary toSpecifically, in light of the realization of practicaltake the progress of AI, quantum, and otherand large-scale quantum computing, spread ofadvanced technology into consideration, and the

IoT, and developments in new encryption

government will advance efforts based on thetechnology, the government will engage infollowing understanding of the situation.

ongoing discussions on ensuring the security and(i) Measures with a view to the advancement

trustworthiness of encryption technology andpromoting its widespread adoption, and deliberateof AI technology

AI technology has been advancing at an

the creation of a guideline on post-quantum

accelerated pace in recent years, and by being

cryptography and lightweight cryptography. The

applied around the world, it is causing a major

government will also advance R&D to establish

impact on a wide range of industries and social

quantum information and telecommunications

infrastructure. Its relationship with cybersecurity

technology that uses quantum cryptography,

can be understood from three perspectives:

which is extremely difficult to eavesdrop on andcybersecurity measures using AI, cyberattacks

tamper with, and technology for using quantum

using AI, and security for protecting AI itself.

key distribution in micro-satellites.
The government will advance these efforts of

As for cybersecurity measures using AI (AI for
Security), security products and services using AI
are actually being commercialized. The

the strategy, follow up on the status of efforts

government will continue to support AI-based

including efforts of relevant ministries concerning

cyber measures pursued by the private sector

the promotion of research and government-

based on a comprehensive strategy on AI

industry-academia collaboration, and conduct

technology, while moving forward to establish

inspections and any necessary re-arrangement byhighly efficient and elaborate countermeasuremapping efforts and so on. In addition totechnology that uses AI in the prevention,

Cross-Cutting Approaches to Cybersecurity

relevant ministries during the planning period of

60 This refers to the further advancement of the characteristic features of 5G and addition of features that contribute to the creation of new,sustainable value.

Cybersecurity Strategy

53detection, and response phases.

concerning national security. Japan will likewise

From the perspective of addressing cyberattacks

pursue R&D on quantum communications andthat utilize AI, “AI for Security” initiatives will also

cryptography, as well as their commercialization

be important in terms of preventing theand standardization, as an alternative equipped

asymmetric relationship between the attackers

with confidentiality, integrity, and superior

and the defense side from expanding further. To

international competitiveness with an eye tothis end, it is important to take a proactive

marketization, and as a secure means of storing

approach to research by gaining insights from thecritical information. This will be done from theviewpoint of the attacker and enhance security

perspectives of ensuring the safety and security ofmeasures pre-emptively.

the state and its people, and strengthening

As for security to protect AI itself (Security for
AI), the vulnerabilities61 in AI are still not fully

industrial competitiveness.
In addition to the above, Japan will constantly

understood. Academically, for example, studies

study technical issues that it must actively

that attempt to generate hostile samples that may

address, considering various technical trends,

induce false recognition of machine learning andincluding Beyond 5G, from a medium- to long-studies on how to defend against such false

term perspective.

recognition are increasing overseas. In Japan, thegovernment will promote basic research andcontinue to study technical issues in a long-term
effort aimed at realization five to ten years down

4.4.2

Recruitment, development, andactive use of human resources

With cyberattacks becoming increasingly

the road.

complex and sophisticated, it is imperative for(ii) Measures with a view to the advancementcompanies to develop and secure human resourcesof quantum technology

The advancement of quantum computers has

needed to ensure cybersecurity in order to ensurebusiness continuity and create new value. While a

Cross-Cutting Approaches to Cybersecurity

given rise to the possibility that the public key

lack of cybersecurity human resources has longencryption technology underpinning today’s

been pointed out in Japan, progress has also beeninternet security may be deciphered. For thismade in public-private initiatives to train operators

reason, post-quantum cryptography has becomeand experts, including promotion of certification

an increasing focus of study around the world.

programs, tests, exercises, and relearning. Given an

Japan has likewise announced its plans tounderstanding of the current situation and theestablish a foundation for advancing cutting-edge

spread of efforts toward digitalization, theresearch on post-quantum cryptography, etc. togovernment need to further continue and deepen

ensure security.

efforts by the public and private sectors both in

Meanwhile, post-quantum cryptography also
carries the risk of being compromised, so countries

terms of quality and quantity.
Moreover, in order for digitalization to bearound the world are rapidly advancing R&D on

advanced along with measures to address

quantum communications and cryptography,

accompanying threats, it is important to create anwhich is guaranteed to be secure in principle, withenvironment where cybersecurity human

the understanding that this is a major threat

resources, regardless of gender, can play active

61 For example, possible threats include data poisoning attacks (attacks that involve polluting training data to cause decision errors).

54

Cybersecurity Strategy

and wide-ranging roles with diverse perspectives

operations and revenue. As such, they must takeand excellent ideas, and to create a virtuous cycle

full ownership and seek to achieve them boththat attracts talented human resources who will

simultaneously. It will be important to raise

lead the next generation. Accordingly, theexecutive awareness while creating an

government will create an environment thatenvironment where the necessary skills and basic

enables talented human resources to develop

knowledge can be acquired.

their careers spanning private sectors,(i) Creating an environment where people canmunicipalities, and government agencies, while

gain Plus Security knowledge

responding to changes in the environment andIn advancing “DX with Cybersecurity” as afocusing on efforts aligned with the following

society-wide effort, it is extremely important topolicy objectives.

provide Plus Security knowledge to various humanresources who may not necessarily have expertise(1) C reating an environment for humanor work experience related to IT or security,

resources needed for“DX withincluding management and executives involved in

Cybersecurity”

advancing digital transformation in companies

In order for digitalization to be advanced

and organizations, and ensure smooththroughout society along with efforts to ensurecollaboration with security experts both inside andcybersecurity (DX with Cybersecurity), it isoutside the organization. At the same time, it isimportant to link supply and demand—both

also important to secure human resources who

demand for talent and work in security and othercan plan measures based on management’s

fields that accompanies digitalization withinpolicies and coach workers and engineers, and thecompanies and organizations, and supply of talent

government will enhance “strategy management

and work through the inflow of young workers

level personnel” through these efforts.

and other human resources provided in response

However, human resources development

to societal demand or through appropriate

programs such as training and seminars related tomatching, must be increased in a way that creates

IT literacy and Plus Security knowledge are nota virtuous cycle.

necessarily prevalent in society. For this reason, as

An environment must be created where security

part of preparing the environment, thehuman resources can play an active role, from thegovernment will address both the demand andperspectives of establishing functions within

supply sides of human resources development

companies and organizations, as well as mobility

programs with the aim of forming and developing

and matching of human resources, not to mention

markets.
In various companies and organizations working

resources development programs for operatorson “DX with cybersecurity,” there is an increasing

and engineers. Otherwise, efforts to advanceneed for human resources (including executives)

digitalization of the economy and society will fall

who do not necessarily have relevant expertise or

into a vicious cycle and be faced with uncertainty.

work experience to gain IT literacy and Plus

For this to happen, management and everyone

Security knowledge so that they may engage inin a company or an organization who is engaged

digitalization going forward. This means that there

in digital transformation or is advancing it mustis potentially large demand. Accordingly, it isunderstand both digitalization and cybersecurity

important to encourage employees in thesemeasures as basic matters underpinning corecompanies and organizations to participate in

Cybersecurity Strategy

Cross-Cutting Approaches to Cybersecurity

securing the quality and quantity of human55human resources development programs, and toresources to play an active role, the government

provide staff training opportunities. The

will likely see more opportunities to use flexible

government and relevant agencies andmodes of employment, such as secondary andorganizations will lead awareness-raising activities

concurrent employment, in light of the changes into urge companies, etc. to engage in efforts thatthe employment environment and clarification ofwill lead to the manifestation of such demand.

how work hours should be managed, which

In addition, the government and relevant

resulted from the effort to respond to theagencies, companies, and educational institutions

COVID-19 pandemic. Given moves toward digitalthat provide human resources development

transformation, demand for human resources will

programs will provide leading and fundamental

likely increase among government agencies andprograms, and actively communicate information

local governments to handle digital-related work,

about public and private sector efforts through, for

including operational reform in the administrative

example, a portal site that lists compatible

field. To advance “DX with Cybersecurity” as aprograms. These initiatives will be undertakensociety-wide effort, the government needs towith the aim of creating a system where

create an environment that promotes the mobility

companies and organizations can expect a certain

and matching opportunities of IT and security

level of quality from the supply side. The use of

personnel using the diversification of workstyles

tools that will provide a deeper understanding ofand employment patterns and the advancement

laws and regulations will be promoted to facilitateof digital transformation as opportunities.

collaboration with experts aimed at advancing
measures.

trends and the even distribution of human(ii) Establishing functions within companies andresources as the government promote practices

organizations, efforts related to the mobility

related to building functions and securing andand matching of talentdeveloping IT and security personnel inside

Amid a rise in the digitalization of work, network

companies and organizations. To this end, theCross-Cutting Approaches to Cybersecurity

connection of products, development of digital

government will ascertain the situation concerning

services, and coordination between digital

human resource needs, conduct awareness-raising

services, future practices will need to focus on

activities in light of actual incidents, promote therapid and flexible development and response, as

use of reference guides, collect and compile

well as monitoring and response that address newleading examples of function building and peoplerisks. In particular, the concept of “security byplaying an active role in companies anddesign” will become ever more important in theorganizations, actively communicate information

practice of the former, with collaboration between

through portal sites, and provide relearning

planning, development, and operation

opportunities.

departments and the security functions of

As local regions and SMEs are faced with acompanies and organizations taking on greater

particularly dire lack of security talent, theimportance. On the other hand, it is also true thatgovernment will provide know-how and networks

there are not enough examples that can bethat will be useful in applying practices throughreferenced nor sufficient accumulation of humanmutual help initiatives in communities, and byresources to aid the establishment and promotion

building an ecosystem and promotingof these functions.

collaboration between industry and educational

In terms of providing a place for human56

Therefore, the government will consider theseCybersecurity Strategy

institutions.

(2) A ddressing increasingly sophisticatedand complex threats

with each other, pursue initiatives aimed atpromoting the use of qualification systems, andThe government are seeing greater numbers ofadvance efforts to secure experts at public

sophisticated and complex cyberattacks, including

institutions, including the police and the SDF.

those targeting industrial control systems, and as
supply chains become increasingly complex and(3) Pursuing government agency initiatives

globalized, risks are growing as well. Against thisFrom the perspective of facilitating the careerbackground, developing human resources

development of IT and security personnel, it isequipped with practical skills for handling suchimportant to create an environment that enablesrisks and attacks has become more important thantalented human resources to develop their careers

ever.

spanning ministries, local governments, private

For the training of operators and experts, public-

sectors, and incorporated administrative

private initiatives are being advanced, such asagencies.62 Based on this thinking, all government

developing and improving certification systems,

agencies will work together to enhance initiatives,

implementing programs for young talent andbased on a policy aimed at reinforcing the system

programs targeting operators engaged withof using advanced outside experts, promoting

industrial control systems, providing exercise

recruitment of successful candidates from theenvironments, and promoting relearning. At the

newly established “digital division” of thesame time, the government will address recent

Recruitment Examination for National Publicthreat trends, incorporate diverse perspectives andEmployees, and enhancing training in light of theexcellent ideas regardless of gender or educational

progress of digitalization.

background, further enhance efforts toward theBased on this policy, each ministry will develop

development of human resources equipped witha human resources recruitment and development

practical response capabilities, and develop andplan, steadily work to establish an adequate

improve content.

system by increasing the quota, conduct training

The government will also build a commonand exercises, and ensure appropriate treatment

foundation for developing human resources tounder the leadership function of the Deputy

handle cybersecurity as a society-wide effort, andDirector-General for Cybersecurity and Information

make it available to industry and academia so thatTechnology Management, etc. In addition, theeducational institutions and educational

government will follow up on the plan each fiscal

businesses can provide exercise services, while

year and further enhance initiatives.

maintaining the quality of instructors.

and national security, the government will notmatching of these human resources, theonly enlist the help of advanced outside experts

government will provide information about

but also develop and recruit our own advanced

various people playing an active role as leading

experts within government agencies.

examples, encourage people who completed
these programs to form communities and interact

Cross-Cutting Approaches to Cybersecurity

To facilitate the career development andIn particular, to address advanced cybercrimes

62 This is also indicated in the “Basic Policy on Reform toward the Realization of a Digital Society” (approved by the Cabinet on December 25,2020).

Cybersecurity Strategy

57

4.4.3Collaboration based on fullparticipation and awareness raising

As cyberspace and physical space become

follow up on the status of efforts, and makeongoing improvements. Moreover, theincreasingly intertwined, and cyberattacks

government will consider reviewing the action

increasingly sophisticated and complex, it will beplan including the response to the elderly.

vital for all the people to have an awareness andIn addition, guidelines and various explanatory

understanding of cybersecurity and undertake

documents are being prepared, particularly inbasic efforts even during normal times as public

response to the recent changes in people’s

hygiene activities in cyberspace, and to be able tobehavior and corporate activities, such as more

address various risks, as with crime prevention

and more people engaging in remote work andand traffic safety measures in physical space. It

using cloud services. Including these, thewill be important for the public and private sectors

government will take necessary steps with respect

to work together on raising awareness andto the nature (content) of information provision

providing information to reinforce behavior thatand awareness-raising activities.

allows the people to acquire literacy and protect
themselves from threats using their own
judgment.
Getting various stakeholders to work together
and collaborate in their own respective roles ismore important than anything. The government isrequired to build a system that enables
stakeholders to collaborate and cooperateaccording to their mutual division of
responsibilities while respecting the autonomous
activities of various communities such as regions,companies, and schools, and to play a role insupporting such a system.
With this understanding, the government haveformulated a detailed action plan toward“collaboration based on full participation” so thatstakeholders in industry and academia and the
public and private sectors can engage in smooth
Cross-Cutting Approaches to Cybersecurity

and effective awareness-raising activities, and thegovernment have advanced initiatives with a focus
on local regions, SMEs, and young people. The
idea of “Cybersecurity for All” that this strategy
sets forth includes the thinking that all
stakeholders must be independently aware of
their own role and engage in cybersecurity. As
digital transformation progresses, it is expectedthat a wider range of people will participate incyberspace. Under these circumstances, it will be

58

necessary to steadily advance the action plan,

Cybersecurity Strategy

5Implementation Framework

This strategy calls for ensuring cybersecurity inincluding headquarters for emergency response toline with the digital transformation that theterrorism, when established. Furthermore, thegovernment is pursuing. The government has

Headquarters will respond to issues concerning

been promoting a policy of improving

national security in close coordination with thecybersecurity measures to ensure Japan’s national

National Security Council. In such cases, thesecurity.

relevant ministries and agencies will work together

63

64

A concerted effort by the whole of governmentis needed to promote and implement
cybersecurity policy in order to ensure a free, fairunder the overall coordination by the National
Security Secretariat.
The Headquarters will work together withand secure cyberspace in line with Japan’s

relevant ministries and agencies to actively

cybersecurity policies. The Cybersecurity Strategic

communicate this strategy to stakeholders both in

Headquarters (hereinafter referred to as theJapan and abroad, in order to encourage each“Headquarters”) will make further efforts tostakeholder to take practical actions in response tostrengthen the capabilities and collaboration ofchanging cybersecurity risks, and further

relevant agencies so that initiatives based on thisunderstanding by foreign governments of Japan’s

strategy can contribute to the digital

stance and enhance deterrence against attackers

transformation led by the Digital Agency, and thatwith the importance of international cooperation

public agencies can make effective use of theirin mind.

limited resources to fulfill their roles. In these

Based on the direction indicated in this strategy,

efforts, the National center of Incident readinessthe Headquarters will establish a policy for

and Strategy for Cybersecurity (NISC) will assume

estimating expenses and work to secure anda key and leading role in coordinating the activities

execute the necessary budget as the governmentof ministries and promoting the collaboration ofso that the ministries can steadily and effectively

industry and academia and the public and private

implement their measures. Moreover, thesectors, as the secretariat of the Headquarters.

government will discuss the system needed to

The Headquarters will work closely with theenhance the ability to quickly detect, analyze,

newly established Digital Agency on formulatingassess, and address cyberattacks in an integrated

basic development policies. Crisis management

cycle, building on the information collection andneeds to be further enhanced as well. The

analysis function. To enable comprehensive

Headquarters will collaborate and share

response by the whole of government against

information with the crisis management organs,cyberattacks, the Headquarters will improve a

65

64 The National Security Strategy (Cabinet decision on December 17, 2013) states that “cyberspace is necessary for promoting both economic
growth and innovation through the free flow of information in cyberspace. Protecting cyberspace from the above-mentioned risks is vital to secure
national security.”
65 Pursuant to Article 43 of the Supplemental Provisions of the Act for Establishment of the Digital Agency (Act No. 36 of 2021), the minister in

Implementation Framework

63 “Priority Plan toward the Realization of a Digital Society” (approved by the Cabinet on June 18, 2021)

charge of digital affairs has been added as a member of the Cybersecurity Strategic Headquarters.

Cybersecurity Strategy

59

national CERTs/CSIRTs framework.
Going forward, the Headquarters will ensure thisstrategy is properly implemented by creating anannual plan for each fiscal year, verifying the
progress of each measure, summarizing thefindings in an annual report, and reflecting themin the annual plan for the next fiscal year during
the period of the three-year plan. Annual plans
and reports should be discussed in an integrated
manner, and the results and evaluation of theprevious year’s activities and the activities for the
next year based on this strategy should beorganized along matters outlined in this strategy
so that the whole sequence of the reports andplans will be clear.

Implementation Framework

60

Cybersecurity Strategy

Responsibility Assignment Matrix for Policy Approaches

Appendix66

Organizations*Contents
4.1.

（◎：Responsible, ○：Involved）

Enhancing socio-economic vitality and sustainable
development ―Advancing DX with Cybersecurity
4.1.1

Raising executive awareness◎：NISC66, MIC, METI
○：FSA

4.1.2

Promotion of“DX with Cybersecurity”among◎：NISC, MIC, METI

local regions and SMEs
4.1.3

Building a foundation for ensuring
trustworthiness of supply chains that support
new value creation(1)

Ensuring trustworthiness of supply chains◎：MIC, METI○：Other Ministries and Agencies(2)

Ensuring trustworthiness of data flow◎：DA, MIC, METI
○：MOJ

(3)

Ensuring trustworthiness of security products◎：METIand services○：NISC, MIC(4) P ractical application of advanced technology
and innovation◎：NISC, CAO, MIC, METI
※CAO：Director General for Science andTechnology Policy

4.1.4 A dvancing digital/security literacy with no one
left behind◎：NISC, MIC, MEXT○：DA, METI

4.2. R ealizing a digital society where the people can livewith a sense of safety and security
4.2.1

Providing a cybersecurity environment which◎：CAS, NPA*1, MIC, METI

protects the people and society○：MOFA, MOF, MOD, Other Ministries andAgencies※CAS：NSS(1) B uilding a safe and secure cyber environment
for users◎：NISC, CAS, CAO, FSA, CCA, Digital Agency,
MIC, MHLW, METI, MLIT○：CAS, CAO, Imperial Household Agency, NPA*1,
MOJ, MOFA, MEXT, MAFF, MOE, MOD※CAS（◎）：Drone Policy Office※CAO（◎）：Director General for Science andTechnology Policy※CAS（○）：CCS, Cabinet Affairs Office, CIRO,
Growth Strategy Council Bureau※CAO（○）：Office for Promotion of Regional
Revitalization

66 NISC is the abbreviation for National center of Incident readiness and Strategy for Cybersecurity. NISC (formerly called National Information
Security Center) was established in the Cabinet Secretariat on January 9, 2015, as an organization which handles the administrative work of the
Cybersecurity Strategic Headquarters. NISC is responsible for the function of the cybersecurity control tower in Japan. Assistant Chief Cabinet
Secretary (in charge of Situations Response and Crisis Management) concurrently holds the post of Director-General of NISC.

Cybersecurity Strategy

61

(2)

Strengthening cooperation with new providers◎：NISC, DA, MIC, METI

in cyberspace(3)

Addressing cyber crimes◎：CAO, NPA*1, MIC, MOJ, METI
※CAO：SPPC(4)

Deploying comprehensive cyber defense◎：NISC, CAS, NPA*1, MIC, MOFA, METI, MOD※CAS：NSS, CIRO

(5)

Ensuring trustworthiness of cyberspace◎：NISC, CAS, CAO, FSA, MIC, MEXT, MHLW,
METI, MLIT
※CAS：NSS※CAO：SPPC

4.2.2

Ensuring cybersecurity integral with digitaltransformation (led by the Digital Agency)◎：NISC, CAO, DA, MIC, MHLW, METI
※CAO：Office for Social Security and Tax
Number System

4.2.3

Promotion of efforts by stakeholders which◎：NISC, DA, MIC, MHLW, METI

underpin the socio-economic infrastructure (1)○：NPA*2, CAO, CCA, MOFA, MOF, MEXT, MAFF,(Government agencies, etc.)
4.2.4

MLIT, MOE, MODPromotion of efforts by stakeholders which
underpin the socio-economic infrastructure (2)(Critical infrastructure)

(1)
(2)

Advancing protection of critical infrastructure◎：NISC, FSA, MIC, MHLW, METI, MLIT

based on public-private collaboration○：NPA*1

Support for local governments◎：NISC, CAO, MIC○：DA, MHLW※CAO：SPPC, Office for Social Security and Tax
Number System

4.2.5 P
 romotion of efforts by stakeholders which underpin
the socio-economic infrastructure (3) ◎：MEXT○：NISC(Universities, education and research institutions, etc.)
4.2.6 S eamless information sharing and collaboration
by multiple stakeholders and application ofknowledge gained through efforts toward the◎：NISC,CAS,NPA*1,MOJ※CAS：Secretariat of the Headquarters for the
Tokyo 2020 GamesTokyo Games, etc.
(1)Advancing information sharing and◎：NISC, FSA, MIC, MHLW, METI, MLIT

collaboration according to each field and issue(2) E stablishing an information sharing andcollaboration system that contributes to◎：NISC, CAS, NPA*1, MIC, MOFA, METI, MOD※CAS：NSS, CIRO

comprehensive cyber defense
4.2.7

Enhancement of readiness to respond to
massive cyberattacks, etc.

◎：NISC, CAS, CAO, NPA*1, FSA, METI
※CAS：CCS※CAO：SPPC

4.3.

Contributing to the Peace and Stability of theInternational Community and Japan’s National Security
4.3.1 「Ensuring“a free, fair and secure cyberspace”(1)(2)

Promoting the rule of law in cyberspace (formulating◎：NISC, NPA*1, MOJ, MOFA

rules that contribute to Japan’s national security)○：MIC, METI, MOD

Formulating rules in cyberspace◎：NISC, MOFA, METI○：NPA*1, MIC, MOD

62

Cybersecurity Strategy

4.3.2 S trengthening Japan’s capabilities for defense,
deterrence, and situational awareness◎：CAS, MOD○：NPA*1, MOFA, MOF, METI
※CAS：NSS(1)

Increasing defense capabilities◎：NISC, CAS, NPA*1, MOJ, MOFA, MEXT, MOD○：CAO, MIC, MHLW, MAFF, METI, MLIT, MOE※CAS：CIRO(2)

Enhancing deterrence capabilities◎：NISC, CAS, NPA*1, MOFA, METI, MOD○：MIC, MOF, Other Ministries and Agencies※CAS：NSS(3) S trengthening cyber situational awarenesscapabilities◎：CAS, NPA*1, MOJ, METI, MOD○：MIC, MOFA
※CAS：CIRO

4.3.3

International cooperation and collaboration(1)

Sharing expertise and policy coordination◎：NISC, NPA*1, MIC, MOJ, MOFA, METI, MOD○：Other Ministries and Agencies(2) S trengthening international collaboration for(3)◎：NISC, METI, MOD

incident response○：NPA*1, MOFA

Supporting for capacity building◎：NISC, NPA*1, MIC, MOFA, METI, MOD
○：MOJ

4.4.

Cross-Cutting Approaches to Cybersecurity
4.4.1

Advancement of R&D(1)

Strengthening international competitiveness in
R&D and building an industry-academiagovernment ecosystem(2)

Advancing practical R&D◎：NISC, CAO, MIC, MEXT, METI
※CAO：Director General for Science andTechnology Policy◎：NISC, CAO, MIC, MEXT, METI○：Other Ministries and Agencies※CAO：Director General for Science andTechnology Policy(3) T aking medium- to long-term technologicaltrends into consideration◎：NISC, CAO, MIC, MEXT, METI
※CAO：Director General for Science andTechnology Policy

4.4.2 R ecruitment, development, and active use of human resources(1)Creating an environment for human resources◎：NISC, MIC, METI

needed for“DX with Cybersecurity”○：MHLW, MEXT

(2) A ddressing increasingly sophisticated and(3)◎：NPA*1, MEXT, MHLW◎：NISC, MIC, MEXT, METI

complex threats○：Other Ministries and Agencies

Pursuing government agency initiatives◎：NISC, NPA*1, MIC, MOD○：Other Ministries and Agencies

4.4.3

Collaboration based on full participation and◎：NISC, MIC, METI

awareness raising○：Other Ministries and Agencies

5.  Implementation Framework◎：NISC, CAS○：NPA*1, FSA, MIC, MOFA, MOF, MEXT, MHLW,
METI, MLIT, MOD, Other Ministries andAgencies※CAS：CCS, NSS

Cybersecurity Strategy

63*Organization Name Key
CAO

Cabinet OfficeCAS

Cabinet Secretariat

CCA

Consumer Affairs Agency

CCS

Assistant Chief Cabinet Secretary (Situations Response and Crisis Management)

CIRO

Cabinet Intelligence and Research OfficeDA

Digital Agency

FSA

Financial Services Agency

MAFF

Ministry of Agriculture, Foresty and Fisheries

METI

Ministry of Ecomony, Trade and Industry

MEXT

Ministry of Education, Culture, Sports, Science and Technology

MHLW Ministry of Health, Labour and Welfare
MIC

Ministry of Internal Affairs and Communications

MLIT

Ministry of Land, Infrastructure, Transport and Tourism

MOD

Ministry of Defense

MOE

Ministry of the Environment

MOF

Ministry of Finance

MOFA Ministry of Foreign Affairs
MOJ

Ministry of Justice

NPA*1 National Police Agency
NPA*2 National Personnel Authority

64

NISC

National center of Incident readiness and Strategy for Cybersecurity

NSS

National Security Secretariat

SPPC

Specific Personal Information Protection Commission

Cybersecurity Strategy