Mitsubishi Electric Group
Information Security Report 2023

Editorial Policy■ Contents / Editorial Policy ･･････････････････････････････ 1

The purpose of this report is to apprise customers
and stakeholders of the information security initiatives
that the Mitsubishi Electric Group engages in on a daily
basis in order to enhance the quality of life in oursociety.

■ Executive Message ･････････････････････････････････････ 2

Period Covered by the Report

Contents

Fiscal 2022 (April 1, 2022 – March 31, 2023)■ Basic Information Security Principles
Basic Policy ･･･････････････････････････････････････････････ 3

Scope of the Report

Information Security Organization Structure ･･･････････････ 4

Information security initiatives at the Mitsubishi ElectricGroup■ Information Security Management
Management Principles ･･･････････････････････････････････ 5

Publication Date of the Report

Information Security Regulations and Guidelines ･･････････ 6

November 2023

Information Security Inspections ･･････････････････････････ 6
Information Security Education ･･･････････････････････････ 7

Inquiries

Activities for Personal Information Protection ･･････････････ 7

Corporate Information Security Division

Other Measures･････････････････････････････････････････ 9

100-8310
Tokyo Building, 2-7-3, Marunouchi, Chiyoda-ku,■ Information Security Initiatives

Tokyo(Technological and Physical Security Measures)

Cyberattack Countermeasures ･･････････････････････････ 10
Physical Security ･････････････････････････････････････････ 13

web

Promotion of Information Security Measures ･････････････ 13■ Initiatives Regarding the Security Quality of Products
and Services
Roles of the Mitsubishi Electric PSIRT ･････････････････････ 14
The Mitsubishi Electric PSIRT Organization Structure ･･････ 14■ Factory (OT Security) Initiatives
Promotion of OT Security Measures ･･････････････････････ 15

1Inquiries about the Information
Security Report

Executive Message
We tackle information security as an important management issue.

Recognizing that cyber security is an important management
issue, the Mitsubishi Electric Group has established the Corporate
Information Security Division in April 2020, supervising theinformation security measures of the Mitsubishi Electric Group.
In recent years, business operations and environments havechanged with an increase in teleworking and cloud services. To
adapt to the change, we should work to drive digitaltransformation (DX) with security as a business challenge.
Furthermore, business environments should be made more
resilient against increasing geopolitical information security risks
associated with conﬂicts. The Corporate Information Security
Division is developing necessary security measures to cope withthese changes and sharing and deploying them throughout the
Mitsubishi Electric Group.
Also, the Mitsubishi Electric Group has made a Declaration ofConfidential Corporate Information Security Management andformulated the Personal Information Protection Policy to foster a
corporate culture that ensures the appropriate handling of confidential
corporate information and personal information. To put the above
declaration and policy into practice, the Mitsubishi Electric Group is not
only developing regulations and frameworks, providing education
regularly to all employees, and implementing IT-based comprehensive
measures, but also constantly making improvements through the PDCA
cycle, including inspections.
Furthermore, we have implemented vulnerability handling processes
and secure development processes for products and services throughwhich we will contribute to the realization of a safe and secure society.
In addition to preparing for increasingly sophisticated and diversified
cyberattacks, we will establish quicker response processes in overseas
regions against global laws, regulations, and economic security. The
Mitsubishi Electric Group will continue to carry out information security
actions that will meet your expectations.
This report provides information on the Mitsubishi Electric Group’s
information security efforts. We hope that it will be useful to you.

2

Eiichiro Mitani
Executive Officer,

CIO (in Charge of Information Security and IT),
Mitsubishi Electric Corporation

Basic Information Security Principles
Basic Policy
The Mitsubishi Electric Group will improve its information
security management system as well as strengthen
cyberattack countermeasures to prevent a recurrence of
information breaches. Our goal is to achieve Level 2 orhigher for the Cybersecurity Maturity Model Certiﬁcation(CMMC)*1 Version 2.

engineering, and intellectual property information, basedon the concept of the Declaration of Conﬁdential Corporate
Information Security Management established in February
2005. We will once again inform this declaration widely
across the Mitsubishi Electric Group to ensure thoroughinformation protection and management considering thepast incidents.

We are managing the information entrusted to us bycustomers and stakeholders of Mitsubishi Electric as well as
conﬁdential corporate information, including sales,*1 The Cybersecurity Maturity Model Certification framework by the U.S.
Department of Defense. Certification Level 2 or higher means excellent
security measures and management structure.

Declaration of Confidential Corporate Information Security Management
With respect to the information assets that constitute its core business activities, Mitsubishi Electric Corporation shall disclose
information that should be released externally in a timely and appropriate manner, while ensuring strict and appropriate management ofconfidential corporate information.
In the unlikely event that valuable information or confidential corporate information entrusted to us by others were to leak, this would
not only cost the trust and confidence invested in the Company; the improper use of this information could also threaten national, societal
and individual security.
Recognizing that appropriate management of confidential corporate information is a key corporate social responsibility, the Company
hereby declares that all employees shall comply with the following confidential corporate information management policies.
1) Appropriate Management of Confidential Corporate Information through Compliance with Laws, Ordinances and Regulations
The Company shall manage all confidential corporate information concerning business activities appropriately in accordance with laws,
ordinances and Company regulations.
“Confidential corporate information” means valuable technical or business information held by the Company, and information (such as
personal information, information obtained from outside the Company and insider information), which if disclosed or used in an
unauthorized way, could be disadvantageous to the Company and/or its stakeholders. Physical objects that constitute confidential
corporate information are also subject to control.
2) Enforcement of Security Management Measures
The Company shall implement appropriate security management measures for the protection and proper control of confidential
corporate information.
“Security management measures” means organizational, human, technological and physical measures that are strictly enforced
according to the confidentiality level of the applicable corporate information.
3) Enhancement of Information System Security Measures
The Company shall enhance its information system security measures to prevent unauthorized access, intrusion and wrongful use ofconfidential corporate information, and implement comprehensive countermeasures with IT.
4) Education
Recognizing that the awareness of individual employees who are involved in handling confidential corporate information isfundamental to management, the Company shall provide regular education for all employees concerning the importance ofconfidential corporate information management and the Company’s efforts to enhance it.
5) Continual Improvement of Management through the PDCA Cycle
The Company shall establish a confidential corporate information management system and improve it proactively and continually
through the PDCA (Plan-Do-Check-Act) cycle.
6) Timely and Appropriate Information Disclosure
In addition to rigorously managing confidential corporate information in an appropriate manner in line with items 1 through 5 above,
the Company shall disclose information that should be externally released in a timely and appropriate manner.
Date of formulation: February 16, 2005
Date of revision: July 28, 2021
Kei Uruma, President & CEO
Mitsubishi Electric Corporation

3

Information Security Organization Structureof factory security.

In April 2020, we established the Corporate Information
Security Division directly under the president and integrated
three functions—“confidential corporate information
management and personal information protection,”“information system security,” and “product security”—tosupervise overall information security management activities.
Since April 2021, we have enhanced the functions of thedivision and added members. We will invest over 50 billion yen
to strengthen the cyber security measures and improve ourinformation security management system to achieve Level 2 orhigher for the Cybersecurity Maturity Model Certification(CMMC) Version 2.

The PSIRT,*3 in the division, which in charge of enhancing
product security was certified as a CNA*4 in November 2020. It
has begun allocating CVE IDs*5 to vulnerabilities that affectMitsubishi Electric products and announces thesevulnerabilities to the public. By doing so, the PSIRT strengthens
vulnerability handling processes cooperating with outside
stakeholders. The PSIRT reports identified vulnerabilities
according to the processes and issues instructions to respondproperly and prevent secondary damage.
Business groups and business sites (offices, branches, andworks) provide instructions and guidance on information
security to domestic and overseas affiliates. As for cybersecurity
issues at overseas affiliates, the Corporate Information Security
Division will cooperate with overseas regional representative

The Executive Officer in charge of information security
supervises information security management. Under his
instructions, the Corporate Information Security Division plans
and implements the Mitsubishi Electric Group’s information
security management system and cybersecurity
countermeasures. Meanwhile, Corporate CSIRT in the divisioncooperates with CSIRTs*2 in business groups and business sites

managers in America, Europe, and other Asian countries
considering each region's circumstances.
*2 CSIRT stands for Computer Security Incident Response Team.
*3 PSIRT stands for Product Security Incident Response Team. It works on
improving the security quality of products and services.
*4 CNA stands for CVE Numbering Authority, and CVE stands for Common
Vulnerabilities and Exposures.
*5 Globally used vulnerability identifiers.

to ensure information security.
In addition, in response to the cyberattack that happened at afactory of a manufacturer causing production to shut down,
Mitsubishi Electric has formed a group in the division in charge

4Information Security Management
Management Principles
The Mitsubishi Electric Group oversees confidential corporate
information management and protects personal information as
its continuous improvement activity using the Plan, Do, Check,
Act (PDCA) cycle and implements four security measures, which
are organizational, human, technological, and physical security
measures, to safeguard confidential corporate information andpersonal information while taking into consideration external
factors such as handling of personal data overseas.

Continuous improvement

Enhancement of
the level of
information security

PDCA cycle
We strive to continually raise the level of our information
security in an upward spiral. First, plans are formulated at the
beginning of the fiscal year based on an annual policy (Plan).
Then, various information security measures are rolled out andemployees are trained (Do). Afterward, the status of information
security management is checked (Check). Finally, the measures
are revised accordingly based on the results (Act).

Upward spiral
ACT

PLAN
CHECK

DO

PDCA cycle to ensure information security

Four security measures
Organizational security measures consist of systems such as amanagement framework, internal rules, and internal audits tosafeguard confidential corporate information and personal
information. They are revised as needed to ensure no loss ofeffectiveness due to changes in the operating environment.
Human security measures consist of education for employees
and personnel management to ensure employees carry out
information security measures.

Organizational

Security
measures

Technological security measures consist of information
system security efforts such as cyberattack countermeasures.

Human

Education for employees,
personnel management

Technological

Information system security

PhysicalPhysical security measures consist of site and room access
control as well as physical protection for equipment to prevent
unauthorized third parties from entering a business site andpotentially accessing confidential corporate information andpersonal information.

Four security measures

Global activities
To maintain and improve the information security level of the
Mitsubishi Electric Group including overseas affiliates, various
inspections are conducted according to information
management system prescribed in the Guidelines toInformation Security Management Rules for AffiliatedCompanies.

5

Management framework, internal rules,
inspections

Site and room access control,
physical protection for equipment

Information Security Regulations and Guidelines
from the perspective of the four security measures, and reviews
them as necessary to comply with current laws. In addition, we
set similar rules for personal information protection and haveapplied to affiliates.

In accordance with Declaration of Confidential
Corporate Information Security Management and Personal
Information Protection Policy, Mitsubishi Electric Corporation
has established information security regulations and guidelines

Item

Basic regulations
Regulations on confidential corporate information
security management / Personal data protection guidelines

Organizational security measures
Security measures

Human security measures

Regulations on the work of employees

Technological security measures

Regulations on information security management

Physical security measures

Physical security guidelines

Responding to changes in the operating environment
smartphones, management standards to strengthen
information security in the supply chain, and other regulations
to address today’s changing business operation environment.

In addition to the basic regulations given above, we haveestablished regulations concerning the release of information
on public-facing websites, regulations concerning the use ofInformation Security Inspections
Group reviews measures based the results, and this leads to theA (Act) stage of the PDCA cycle.

The Mitsubishi Electric Group performs the following
inspections as part of the C (Check) stage of the PDCA cycle athead office management departments, business groups andoffices, and affiliates. These inspections focus on checking
whether confidential corporate information management andpersonal information protection activities are being
implemented properly by the Mitsubishi Electric Group as awhole, and on confirming the status of those activities. The

These inspections are set down in the Confidential Corporate
Information Management Regulations, which cover Mitsubishi
Electric Corporation, and in the Guidelines for Information
Security Management Regulations, which cover domestic andoverseas affiliates.

Name Content

Name

Self-check

Self-check program for confidential
corporate information management
and personal information protection

Using a checklist, each Mitsubishi Electric Group company performs aself-inspection of its activities for information security.

Third-party check program for
confidential corporate information
management and personal
information protection

Mitsubishi Electric’s business sites mutually check each other’s status of
information security management.
Mitsubishi Electric checks the status of information security at affiliatedcompanies.

Personal information protection
audits (Personal information
protection management system
audits)At Mitsubishi Electric, the status of personal information protection is audited
company-wide under the instructions of the Audit Manager for Personal
Information Protection appointed by the President & CEO of Mitsubishi
Electric. At affiliated companies in Japan that have been granted the right touse the “PrivacyMark”, the same audit is carried out by the audit manager of
each company.

Third-party check

Content

6

Information Security Education
Education corresponding to each career stage

Mitsubishi Electric is working on fostering a corporate culturethat ensures the appropriate handling of confidential corporate
information and personal information. We provide theeducational programs described below to train employees on
how to fully implement concrete security measures, including
storing files on servers or encrypting them in accordance with
their confidentiality level.

We teach confidential corporate information management
and personal information protection through training programsfor new employees, newly appointed section managers, thepersonal information asset manager, the Corporate Secretariat
involved in operation and the like, so that our employees canfulfill the roles expected at each career stage in the duties forwhich they are responsible.

Education for all employees

Exercises to practice handling spoofed e-mails

An e-learning program on information security is provided
once a year to all employees and other staff members (about
50,000 in total) to ensure their full understanding of the
Mitsubishi Electric policies, status of data breach incidents, laws
and regulations related to the protection of personal
information, Unfair Competition Prevention Act, and security
measures (organizational, human, technological, and physicalmeasures) that each employee must be aware of. In addition,
due to the rapid increase in teleworking and the shift inbusiness type and environment due to the use of cloud services,educational materials for employees are released as needed.

As a measure against cyberattacks, Mitsubishi Electric
regularly conduct exercises that allow all employees, including
officers, to verify that they know how to handle spoofed e-mails.
Employees of affiliates in Japan can participate in this exercise.
At overseas affiliates in America, Europe, and other Asian
countries practice exercises are conducted according to local
circumstances under the direction of regional representative
managers.

Other individual training
Employees posted overseas are provided with a preliminary
education program which covers risks in confidential corporate
information management and personal information protection
outside Japan and examples of data breach incidents that haveoccurred overseas.

Activities for Personal Information Protection
Personal information protection
Mitsubishi Electric formulated company rules on personal
information protection in October 2001, and since then, it has
ensured that all employees and relevant individuals understandthe rules and it is working on protecting personal information.

Personal
information

In 2004, the company formulated the Personal Information
Protection Policy and improved it as a set of personal
information protection activities that meet the requirements of
JIS Q 15001: 2006 Personal Information Protection Management
Systems. In January 2008, we were granted the right to use the“PrivacyMark”, which certifies the establishment ofmanagement systems that ensure proper measures for personal
information protection. We have been renewing the“PrivacyMark” certification since then.

Personal information
protection

Information such as handbooks about
personal information protection

Structure of personal information protection rules

We are also reviewing company rules in order to properly
comply with the revised Act on the Protection of Personal
Information, which came into effect in April 2022.

7

Basic policy

Basic rules

Operational
procedures

has been granted the right to use the “PrivacyMark” and ismaking ongoing efforts to ensure the proper handling of
personal information.

Personal information collected from customers throughquestionnaires, registration of purchased products, after-sales
service, and so on is managed in accordance with the “Personal
Information Protection Policy”. Furthermore, Mitsubishi Electric

Personal Information Protection Policy
Mitsubishi Electric (“the Company”) will continually improve its technologies and services by applying creativity to all aspects of its
business, thus enhancing the quality of life in society. Through these activities, the Company collects various types of information from its
customers and affiliated persons. Since personal information is an important asset of individuals, it is the company’s social responsibility toprotect the personal information appropriately and use it correctly and safely in compliance with laws. The Company has established thepersonal information protection management system as a part of corporate management. With this system, the Company will ensure that
the Company’s employees (including corporate officers, employees, short-term/long-term part-timers, and temporary staff ) and affiliatedpersons fully understand personal information protection, implement the actions listed below, and improve and maintain personal
information protection.
1. Objective of Personal Information Protection
The objective of personal information protection is to appropriately and effectively use personal information and protect the rights andinterests of individuals with due consideration given to the usefulness of personal information.
2. Purpose of Use of Personal Information
The Company uses personal information within the extent of the purpose of use clearly described to the information owner and uses
such information only when required for business reasons.
3. Acquisition of Personal Information
The Company acquires personal information through legal and fair means. When acquiring information directly from the information
owner, the Company will clearly explain the requirements, including the purpose of use, and obtain consent.
4. Disclosure and Submission of Personal Information
The Company will obtain the consent of the information owner before disclosing or submitting his/her personal information to a third
party for the purpose of outsourcing or collaboration.
5. Handling of Personal Information(1) Compliance with laws and regulations on the protection of personal information
The Company fully complies with laws, regulations, national policies, and other rules concerning the protection of personal
information.
(2) Prevention of data breach, losses, and damage to personal information (e.g., security measures), and corrective measures
The Company takes reasonable safety actions and necessary security measures to prevent unauthorized access, losses, corruption,
falsification, or leakage of personal information. It also audits all departments to check the handling of personal information andimplements corrective measures. Through this audit, all divisions review the latest data breach risks or issues and make
improvements to avoid similar incidents in the future.
(3) Creation and operation of the personal information protection management system
The Company has created and is operating the personal information protection management system inline with the requirements of JIS Q 15001: 2006 Personal Information Protection Management Systems. It
has also been reviewed by JIPDEC and as a result, obtained the right to use “PrivacyMark”, which is given
to businesses that handle personal information properly. It will continue to protect personal information
while continually improving the personal information protection management system.
6. Handling of Information Related to Individuals
When the Company handles information related to an individual such as location data, IP address, andcookies on the Company website or in other places, it may notify the information owner of the purpose of“PrivacyMark”
use and obtain his/her consent.
7. Responses to Inquiries from Information Owners
When the information owner requests the disclosure, correction, removal, or suspension of use of his/her personal information, or when
the Company receives inquiries, including complaints or consultation, from the information owner, it will respond without delay.
The Company also strives to keep personal information accurate and up to date.
Date of formulation: April 16, 2004
Date of revision: April 1, 2022
Kei Uruma, President & CEO
Mitsubishi Electric Corporation8

Proper handling of personal information

handled appropriately in accordance with internal regulations
adapted to Japan’s “My Number” system. Employees who
handle personal identity numbers are trained individually.

We handle personal information appropriately; we acquire itby specifying the purpose of use, use it only within the intended
scope, and provide it to a third party only with the consent of
information owners. At the same time, we will further
strengthen security measures, including storing data on servers
and using data encryption, to address the risk of data breachcaused by cyberattacks.

Compliance with the EU General Data Protection
Regulation (GDPR) and China’s Personal Information
Protection Law
The Mitsubishi Electric Group handles personal data from the
EU in an appropriate manner with due consideration to theGeneral Data Protection Regulation (GDPR) that was put into
force in the EU in May 2018 as a framework to protect privacy.
Outside the EU, the Personal Information Protection Law cameinto effect in China on November 1, 2021. Therefore, therestricted transfer of personal information across borders is
becoming a global trend and we will act appropriately.

PrivacyMark
Mitsubishi Electric and some affiliates in Japan have been
granted the right to use the “PrivacyMark”.

Response to Japan’s “My Number” system
Personal identity numbers are managed strictly andOther Measures
Contractor management
Confidential corporate information and personal information
are entrusted to a contractor only after a proper non-disclosureagreement is concluded between Mitsubishi Electric and thecontractor. The agreement stipulates all the security andpersonal information protection matters that we require.

with appropriate control, before entrusting the information to
the contractor, we confirm that the contractor will maintain theproper level of protection. After submitting the information, we
supervise the contractor by regularly examining a status reporton the use and management of the information that we havesubmitted.

To ensure that confidential corporate information andpersonal information entrusted to a contractor will be handled9

Information Security Initiatives(Technological and Physical Security Measures)

The information security initiatives of the Mitsubishi Electric Group include cyberattack countermeasures and physical security
measures for the IT infrastructure.

Cyberattack Countermeasures
Cyberattacks against companies are becoming moresophisticated and diversified every year, posing major threats tothem.

detection of suspicious activities and intrusions. Furthermore,developing incident response processes helps to prevent andminimize damage.

To fight against cyberattacks, which have become moresophisticated and diversified with the increase of the use ofcloud services and teleworking, the Mitsubishi Electric Group
carries out centralized management of the networks, computer
terminals, and servers (cloud) and adopts defense in depth
based on the concept of zero trust security. Defense in depth
provides protection against cyberattacks and enables the

To support work at the office as well as work requiring accessfrom home or on a business trip, strong multifactor
authentication has been introduced and authentications arecentrally managed. Internet websites are constantly exposed tomany external threats, and so we only launch websites that areapproved in order to maintain a high security level.

(3) Instructions to change
the necessary settings

CSIRT
Configuration andsetting management
Identification of damage

Detection of the intrusion(2) Detection of the intrusion

Centralized security infrastructure management platform(centralized management of networks,
terminals, servers, and authentication)

Configuration andsetting management

Logging

Attacker

Each site(1) Intrusion by the attacker

Computerterminal

Centralized security management

10

Network
deviceServerDefense in depth

Mitsubishi Electric Group also develops and fully implements
rules, educates employees, and carries out inspections.

The Mitsubishi Electric Group has adopted defense in depth,
consisting of three layers of technological security measures,
which are network, computer terminal, and server (cloud)security measures.

NetworkIn the network security measures, various security devices are
installed at perimeter to control and monitor email and web
communications, among others. This will block unauthorizedaccess or malware from outside or prevent information frombeing leaked. The Mitsubishi Electric Group will improve thiscommunication filtering function.

Endpoint

Server(cloud)Confidential corporate
information/
personal information

Multilayered defense

Computer Security Incident Response TeamIn the computer terminal security measures, anti-malware
software detects and removes malware, and security patches forsoftware vulnerabilities are applied. Doing so will lead to theprevention of computer terminal malware infections,suppression of attacks, and localization of damage. For thisreason, computer terminals are centrally managed, andmeasures are sure to be applied to them. Anomaly behavior
detection (EDR: Endpoint Detection and Response) tool*6 will be

The Mitsubishi Electric Group has established the Mitsubishi
Electric Corporation Computer Security Incident Response Team(MELCO-CSIRT) to monitor cyberattacks and respond
immediately to any incidents.
In order to prevent cyberattacks, we have also developed aprocess to monitor our affiliates inside and outside Japan, which
has been insufficient in the past. The above-mentioned
communication monitoring identifies suspicious behavior,
allowing you to quickly detect and block cyberattacks. On theterminal side, information on malware infections and thecurrent soundness of computer terminals are gathered andidentified. In the event of an incident, the MELCO-CSIRT will
utilize these security measures to immediately assess thedamage, make prompt and appropriate responses, restore
operations, and minimize damage as much as possible. After
that, it will analyze the incident in detail and support theimplementation of permanent measures by the department
where the incident occurred.

installed in all computer terminals to enhance computer
terminal security. In addition, we have deployed multifactor
authentication that combines two or more authentication
factors to implement more powerful security measures.
Servers that are becoming cloud-based are periodicallychecked to find vulnerabilities, and communications andoperations are monitored. This will make servers (cloud) robust,which have critical information.
To confidential corporate information and personal
information stored in servers or in the cloud, access control andencryption is applied based on the principle of least privilege.
For the management of these types of information, the*6 EDR stands for Endpoint Detection and Response.

AttackerInternet
Monitoring/
Blocking

Incident
response

Affiliates in Japan

Affiliates outside JapanMELCO-CSIRTMELCO-CSIRT

11

Security measures for teleworking

protect them from cyberattacks based on the concept of zerotrust.

Teleworking is becoming more common as work styles
diversify to include working from home or at a satellite office, in
addition to mobile work during a business trip. Working fromhome has become normal lately as a measure to prevent the
spread of the novel coronavirus. It is believed that teleworking
become a common work style.

Management of Internet websites
As a lesson learned from past incidents that occurred due tounauthorized access, the Mitsubishi Electric Group now ensuresthat only websites that have been approved by Mitsubishi
Electric are launched in order to maintain the security level ofwebsites.

Meanwhile, the use of a network and the cloud contributes tothe diversification of business operation, and traditional security
measures at the perimeter becomes insufficient due to anincrease in normal access from outside. For this reason, we are
implementing more powerful security measures, including theencryption of communications using a virtual private network(VPN) for security and the use of multifactor authentication.

Websites may go live only after they have passed a security
test and problems have been resolved. We also regularly inspect
our public websites on the Internet to assess their management
status. By doing so, we remove unnecessary websites andstrengthen security measures for websites where they are
insufficient.

For work from home, work at a satellite office, and mobile
work (business trips), we will improve security measures to12Physical Security
Entry/exit access control

To prevent suspicious individuals from entering a businesssite and coming into contact with confidential corporate
information, the Mitsubishi Electric Group sections physicalspaces of human activity, such as a site’ grounds, corridors,
offices, meeting rooms, server areas, and data rooms, into areas
and designates a security level (area level) for each area.

We use entry/exit access control to ensure that only
authorized persons enter rooms and sites when going between
areas with different area levels. In particular,
Mitsubishi Electric sites use ID card-based authentication
systems to ensure security as well as more efficient entry andexiting.

Area levels
The designation of area levels is as given in the following
table. We define security rules according to area level.

High

Level

Evaluation criteria

Area level
4

Onsite; areas that can beaccessed and used only by alimited number of Mitsubishi
Electric employees, employees
of affiliates, etc.

Special rooms,
specially managed
project rooms

Area level3

Onsite; areas that can beaccessed and used only by
specific Mitsubishi Electric
employees, employees ofaffiliates, etc.

Server rooms,
drawing/projectrooms, development
rooms, criticalequipment rooms

Area level2

Onsite; in principle, areas thatcan be accessed
and used by all Mitsubishi
Electric employees,
as well as specific persons(such as employees
of affiliates).

Offices, common
meeting rooms (forinternal use)

Onsite; in principle, areas thatcan be accessed
and used by all Mitsubishi
Electric employees
and persons who completed
entry procedures(such as employees ofaffiliates, business partners,
and general visitors).

Commonoutdoor/indoor areas,
common meetingrooms (including
those for externaluse), corridors

OffsiteOutside common
outdoor areas

Area level0

Room entry / exit
Level 3: Server rooms, etc.
Room entry / exit
Level 2:Offifices
Room entry / exit

OffsiteLevel 1: Common outdoor andindoor areas, common
meeting rooms

Site entry / exit
OffsiteOffsiteLow

Level 4: Specific project rooms, etc.

OnsiteArea level
1

ExampleDesignation of area levels

Level 0: Outsidecommon outdoor

Entry/exit access control

Promotion of Information Security Measures
Access management
5

Mitsubishi Electric Corporation is continuously working to
improve its information security management system as well as
strengthen cyberattack countermeasures.

4

Risk management

Media protection

3

In order to evaluate these improvement activities, we set
specific goals for information security measures and conduct
self-assessments for Mitsubishi Electric Corporation and its
domestic affiliates based on the major assessment axes andinspect the effectiveness of the measures we have formulated.

2
1
Incident response

We will continue to improve our information security
measures through the PDCA cycle, including these inspections,and going forward, we plan to expand this evaluation to theentire Mitsubishi Electric Group, including overseas affiliates.

0

Configuration
management

Physical security

Communication
protection
Vulnerability detection
and response（CMMC Level 2 is rated as 5 points.）

2022.92023.9

Self-assessments for information security measures and conduct13

Initiatives Regarding the Security Quality of
Products and Services
Roles of the Mitsubishi Electric PSIRT
Mitsubishi Electric has formed the Mitsubishi Electric Product
Security Incident Response Team (PSIRT), an internal unit forhandling issues related to the security quality of products andservices, and is making company-wide efforts to ensure theinformation security of our products and services.

● Gather information on vulnerabilities in products andservices provided to customers

The roles of the Mitsubishi Electric PSIRT are listed on theright:● Strengthen and promote technical initiatives to preclude
vulnerabilities from the stage of product and service
development● Respond swiftly to vulnerabilities discovered in cooperation
with product design and production departments andservice management departments● Provide necessary security training to all officers
and employees concerned with product and service
development● Disclose vulnerability information and measures to
Customers

The Mitsubishi Electric PSIRT Organization Structure
established within the Corporate Information Security Division
to improve the security of product and service.

Mitsubishi Electric has appointed PSIRT managers to allbusiness group headquarters and business sites to reduce risks
by tackling security issues. A corporate PSIRT has been

President & CEO

Business Area

Executive
Board

Business Area

Business Group

Business Group

Business Group

General Manager

General Manager

General Manager

Business GroupPSIRT Manager

Business GroupPSIRT Manager

Business GroupPSIRT Manager

Works

Works

Works

Works Manager

Works Manager

Works Manager

Executive Officer in Chargeof Information Security
Corporate Information
Security DivisionCorporate PSIRT

Mitsubishi Electric
PSIRT

PSIRT Manager

The Mitsubishi Electric PSIRT Organizational Structure

14

PSIRT Manager

PSIRT Manager

Factory (OT Security) Initiatives
Promotion of OT Security Measures
factories from cyberattacks, we have organized a specializedgroup for OT (Operational Technology) security within the
Corporate Information Security Division and are working tostrengthen cybersecurity measures for our factories.

Various new technologies and environmental changes, suchas IoT, DX, and teleworking, are flowing into factories that havebeen operating in closed environments with no external
connections such as the Internet. As a result, factories are now
starting to operate in more open environments.

Specifically, based on the Purdue reference model*7, we arepromoting security measures at each factory by logicallystratifying installation positions of systems and equipment
within the factory into layers and clarifying the security
requirements for each layer in documentation. The security
requirements are based on IEC 62443-2-1*8 and other standards.

Consequently, the threat of cyberattacks, which had
previously been unheard of in the factory environment, hasreached factories, leading to numerous incidents that causesignificant damage, such as factory shutdowns, in recent years.
At Mitsubishi Electric, as an internal framework to protect ourLayer4.5
Networkboundary

RouterDMZ

Layer5External area

FW

Core
systemOA terminals

Development/
design system

Layer4IT

IT (OA) network
Countermeasureexample 2

Relay
serverHistorian
serverCountermeasureexample 1

Countermeasur
example 2

Relay
serverHistorian
serverFW

DMZ

Countermeasureexample 1
FW

DMZ

IDS

Layer3.5
Networkboundary

IPS/IDS

Manufacturing
Execution
System (MES)Countermeasureexample 3
Warehouse
Management
SystemComputer-Aided
Manufacturing
System (CAM)

OT terminals

Countermeasureexample 2
Softwaredevelopment
system

OT network

Countermeasureexample 3

Monitoring andcontrol terminals

Manufacturing
equipment

Countermeasure example 1 :Blocking unnecessarycommunication by FW

Countermeasureexample 3

Layer3OT

Softwaredevelopment terminals

OT network
IF unitCountermeasureexample 2

OT network

Monitoring andcontrol system

Manufacturing
equipment

Countermeasureexample 3

Monitoring andcontrol terminals

OT network

Manufacturing
equipment

Scope of OT security

OT network
Countermeasureexample 2

Scope of Information Security

External lines for dedicatedmachines and VPNs

Internal networ

Layer2Layer1
OT

ControllerCountermeasure example 2 :Network partitioning
Architecture configuration

Countermeasure example 3 :Protection of terminals within the OT networkfrom unauthorized accesses

Overview of the overall factory system based on the Purdue reference model*7 Purdue reference model: A framework that logically categorizes industrial control systems into functional layers, enabling to present a map of IT/OT networkzones that need to be secured.
*8 IEC 62443 is a set of standards issued by the International Electrotechnical Commission (IEC), which is widely used as security guidelines for control systems.
Among them, the IEC 62443-2 series provides requirements specifically for factories.

15www.MitsubishiElectric.co.jp