Development of Japan’s Cybersecurity Policy Framework
Attacks on
Web Server
Vulnerability

Successive
defacementof gov. website

Jan 2000
Attacksof Sept.11
Fiscal year

Sep 2001

Prosecution & wanted for
Remote control
Chinesemilitary personnel
Attacks to Iran’svirus
in the US
Nuclear facility
Fake site
Watering Hole Illegal remittanceguidance scam
Large scale
Large scale
Attackby infected PC
Worldwide
Guidedattacks toSpyware
failure in
Pensionattacks
US andSept.18 South
Ransomware
Targeted
attackAttacks on
appeared South Korea Attacks
Service info.
Winny
Organizational SONY PicturesattacksKorea
breachsophistication
Entertainment
Large scale
cyberattacks
to Estonia

2000 2001 2002 2003 2004 2005 2006 2007 2008 2009
Individual
efforts byeach agency

Dos attacks,
Measure for computer virus
e-JapanStrategy(Jan-22 2001)

New IT Reform
Strategy(Decided by IT strategic H.Q.
on Jan-19,2006)

2011

2012

Risk-based measuresin Accident-based society

Zero Risk Society

e-JapanStrategy(Jul-2 2003)

2010

i-JapanStrategy
2015（Jul-6,2009）ref. Utilization of IT

National Strategy on
Information Security
1st edition(Decided by IT strategic H.Q. on May-19, 2010)

Measures forthe Government

SJ2006 SJ2007 SJ2008 SJ2009

IS2010

1st edition (by ISPC on Dec-13, 2005)
2ndedition (by ISPC on Jun-14, 2007)
3rd edition (by ISPC on Feb-4, 2008)

4th edition (by ISPC on Feb-3,2009)2011 edition (by ISPC on May-11, 2011)2012 edition (by ISPC on Apr-21, 2012)

Action Plan on Information
Security Measures
for CII(by ISCP on Dec-13, 2005)

The Second Action Plan onInformation Security Measures for CII(by ISCP on Feb-3, 2009)

IS20122017

2018

New life styleduring
COVID-19

2019

2020

2021

Active cyber security measures against cyber attacks
Responding to new environmental changesDeclaration to bethe Worldʼs Most
Advanced IT Nation
・Basic Plan to utilize
Public and private data
(Cabinet decisionon May-30, 2017)

Cybersecurity Strategy（Cabinet decision on Sep-4, 2015)(Decided by ISPC on Jun-10, 2013)

IS︓Information Security
IS2011

Basic Acton Cybersecurity
Nov-12, 2014

Cybersecurity Strategy(Decided by ISPC on Feb-2, 2006) ( (Decided by ISPC on Feb-3, 2009)2016(Cabinet decision on Jun-14, 2013,
amended on Jun-24, 2014, Jun-30, 2015 and May-20,2016)(Decided by Information Security Policy Council (ISPC)on May-11, 2010)

SJ︓Secure Japan2015

Declaration to be the World’s
Most Advanced IT Nation

New Strategy on Information
and Communications
Technology

National Strategy on
Information Security 2nd edition

2014

Cyber security as national
security and crisis management

Information Security Strategy
for Protecting the Nation

Basic Strategy

Annual Plan

2013

WorldwideInformation
theft attack
on CI

Revised Basic Act
on Cybersecurity
Apr-22, 2016

Declaration to be the World’s
Most Advanced IT Nation
Basic Plan to utilize Public and Private data

Priority Policy Programto achieve
Digital Society(Cabinet decision on Jun-15, 2018,
amended on Jun-14, 2019 and Jul-17, 2020)

Cybersecurity Strategy（Cabinet decision on Jul-27, 2018)(Cabinet decisionon Jun-18, 2021)

CybersecurityStrategy（Cabinet decisionon Sep-28, 2021)

Revised Basic Act
on Cybersecurity
Dec-12, 2018

CS︓Cybersecurity
CS2013

CS2014

CS2015

CS2016

CS2017

CS2018CS2019CS2020CS2021

Common Standards on Information Security Measures of the Government Entities

Guidelines for the Formulationof Information Security Policies(Jul 2000)

2014 edition

2016 edition(by ISPC on May-19, 2014)(by CS H.Q. on Aug-3, 2016)2018 edition(by CS H.Q. on Jul-25,2018)2021 edition(by CS H.Q.
on Jul-7,2021)

Critical InfrastructureProtection
Special Action Plan on Countermeasures toCyber-terrorism ofCritical Information Infrastructure (CII)(Dec 2000)
Organization
Framework

IT Security Office(Established on Feb 2000)

National Information Security Center (NISC) (Established on Apr 2005)
Information Security Policy Council (ISPC) (Established on May 2005)

The Basic Policy of Critical Information
Infrastructure Protection (3rd Edition)(Decided by ISCP on May-19, 2014,
Revised by CS H.Q. on May-25, 2015)

The Cybersecurity Policy for Critical Infrastructure Protection(4th Edition)(Decided by CS H.Q. on Apr-18, 2017,
Revised by CS H.Q. on Jul-25, 2018 and Jan-30, 2020)

Cybersecurity Strategic Headquarters (Established on Jan 2015)
National center of Incident readiness andCybersecurity Council(Established on Apr 2019)

Strategy for Cybersecurity (NISC) (Established on Jan 2015)

0

Government Security Operation Coordination team (GSOC) (Rolled out on Apr 2008)
Cyber incident Mobile Assistant Team (CYMAT) (Established on Jun 2012)