Cyber Index Corporate Survey 2023
December 2023
Japan Federation of IT Organizations
Cyber Security Committee Corporate Assessment Subcommittee

Copyright (C) 2023 Japan Federation of IT Organizations All Rights Reserved. All rights reserved.

(1) Importance of Cyber Security
Information Disclosure(Results of a survey by the Japan
Federation of IT Organizations)1Trends in cyber risk disclosure (SEC rules)
The U.S. Securities and Exchange Commission (SEC) has adopted new cybersecurity disclosurerules, effective December 15, 2023. Since the rules apply not only to U.S. companies but also tocompanies outside the U.S. (Foreign Private Issuer, FPI), Japanese companies listed on the SEC
must also comply.
Objective.

To enhance and standardize cyber risk management, strategy, governance, and cyberincident disclosures of listed companies, and to improve cyber security standards
throughout society

Contents
Material Incident
Reporting

Main
Requirements

Cyber Security Risk
Assessment andManagement

GroupForm

Term

U.S. securities registeredCompanies

8-K (Report of importantmatters)

Foreign Private Issuer(FPI)

6-K (Report on importantmatters)

Within 4 business daysof confirming theincident(effective from
December 18, 2023)

U.S. securities registeredCompanies

10-K (Annual report)

Annual report

Foreign Private Issuer(FPI)

20-F (Annual report)(effective fromDecember 15, 2023)

Approximately 40% of the world's market capitalization shares are traded on the New York Stock Exchange
and NASDAQ, and approximately 7,000 companies are required to comply with this rule2

U.S.-Japan investor cybersecurity awareness survey
In October 2023, the Japan Federation of IT Organizations conducted a survey of 610 Japaneseand U.S. investors on their attitudes toward cybersecurity information disclosure.
• Survey Objective: To understand institutional investors' awareness and focus
on cyber security• Survey respondents: Japanese and U.S. investors (Japan: 353, U.S.: 257)
• Survey period: September 2023
Attributes of share holdings (N=610)
43%

Shares of Japanese companies
Shares of U.S. companies
Shares of British companies
Shares of European companies

39%
15%

and Taiwanese companies

12%

87%

29%
33%

12%

Shares of Chinese, Hong Kong

89%

18%
3

90% of US investors consider this as part of theirinvestment decisions

U.S. investors were more than 90% more likely than Japanese investors to have evaluatedcybersecurity disclosure as one of their investment decisions and influenced their investment
decisions (Japanese investors were 60%, or 27.4 percentage points lower)
Contingency (when an incident occurs)

Normal times

64%

67%

Have evaluatedand influenced
investment
decisions

88%

91%

30%

28%

7%
2%

6%

11%
2%

5%

U.S.(N=257)

Japan(N=353)

U.S.(N=257)

Japan(N=353)

Evaluate but
have neverinfluenced
investment
decisions

Percentage of respondents who evaluated cybersecurity-related disclosure (normal times and contingency) and its
4influence on their investment decisions.

Tighter regulations raise investorsʼ cybersecurityawareness

The top reason for placing importance on disclosure is ʻSEC cybersecurity disclosure mandatesʼ at60% for U.S. investors, and legal regulations at 50% for Japanese investors
Adoption of new SEC rules

59%

32%
46%
49%

Regulatory Compliance
ESG (Environmental, Social and31%

Governance)
SASB publishes IFRS disclosure standards *27%

3%

Losses due to security incidents at portfoliocompanies

31%

23%

Evaluation is recommended by company
policy36%

25%

Incident occurring at the investee

36%

12%

17%
U.S. (N=257)

Japan (N=353)* SASB (U.S. Sustainability Accounting Standards Board), IFRS (International Financial Reporting Standards)
Sustainability Disclosure Standards

Reasons for adopting cybersecurity of portfolio companies as one of your investment decisions (multiple responses) 5

Percentage of cybersecurity interviews with portfolio
companies

U.S. investment institutions are 98% more likely than Japanese investors to interview theirportfolio companies about cybersecurity (61% in Japan)
U.S. Investors (N=257)

Domestic investors (N=353)

Notinterviewed
2%

Not
interveiwed
39%

Interveiw
ed61%

Interviewed
98%

Percentage of interviews about cybersecurity in dialogue with portfolio companies

640% of U.S. investors have experienced an incidentrelated sale or lawsuit

U.S. investors are more likely than Japanese investors to have sold their portfolio companies due
to cyber incidents (46% in the U.S., 23% in Japan)
Selling experience

Lawsuit experience46%

Have sold23%

Not actuallysold, but haveconsideredsellingNeverconsideredselling

42%
31%

12%
45%

Have filed alawsuit

38%
12%

Not actually
filed a lawsuit,
but haveconsideredfiling one

Neverconsidered alawsuit

41%
30%

21%
59%
U.S. (N=257)
Japan (N=353)

Experience in filing a sale or lawsuit due to an incident at an investee company

7

The Need for Cybersecurity Indicators
More than 80% of Japanese and U.S. investors answered that they need a cybersecurity-specificindex provided by a third-party organization, and they are looking for a security index thatsimplifies making investment decisions.
U.S. Investors (N=257)

Domestic investors (N=353)

Not necessary1%
Not necessary
9%

None
12%

None11%

Necessary87%

Necessary80%

Need for third-party cybersecurity-specific indicators

8Results of individual interviews with investors

DomesticInstitutionalInvestors

If lack of organizational governance, including
cybersecurity, is confirmed, it may be reflectedin the resolution of confidence of directors as acomprehensive decision by shareholders
Management (such as CIO,CISO) must be able
to answer questions directly without a scriptfrom foreign investors after a major incident attheir company

Domestic
Institutional
Investors

Foreigncompany
rating agency

Standards for disclosure of cybersecurity
information are necessary. It is difficult tomake investment decisions unless comparable
information is available.
9(2) Cyber Index Corporate Survey
2023

10

What is the Cyber Index Corporate Survey?
With the aim of promoting the disclosure of
information on cybersecurity measures taken by
private-sector companies, a survey on cybersecurity
initiatives was conducted among the companies thatcomprised the Nikkei 500.
Companies that demonstrated excellent cybersecurity measures and information disclosure weregiven a star rating and commended.
11Company Survey Detailsl Conducted a comprehensive survey on
corporate cybersecurity initiatives anddisclosure stance by conducting aquestionnaire survey and public information
survey.

Third-party
evaluation

PrivateClosedPublicOpenl Continuing from last year, the results ofdiagnostic tool surveys of attack surfaces werealso added to the evaluation.
l ʻRatingsʼ based on original survey items
developed by the Corporate Evaluation
Subcommittee
ItemsQuestionnaire survey Self
evaluation

Public Information
Research+.
Diagnostic Tool Survey

FY2020

FY2021

FY2022

FY2023

Target Company

Nikkei 225 Component
Index

Nikkei 500 Component
Index

Nikkei 500 Component
Index

Nikkei 500 Component
Index

Public Information

Applicable

Applicable

Applicable

ApplicableNon-public
information

Not applicable

Applicable

Applicable

Applicable

Diagnostic ToolSurvey

Not applicableNot applicable

Applicable

Applicable
12

Survey methodology for the Cyber Index CorporateSurvey 2023
• Target: 500 companies that comprise the Nikkei 500 Index• Period: July - September 2023
• Overall score: Sum of the following 3 items• Survey Description:
Surveyed securities reports, corporate governancePublicreports, integrated reports, and corporate website entries,
Information as well as event speeches, ISMS certifications, P-marks, Annual Securities
and number of technical certifications obtained.
Reports, etc.
SurveyConducted a survey of companies to ascertain theircybersecurity initiatives that are not publicly disclosed,and created original questions based on the IPA
Cybersecurity Visualization Tool.

Questionnaire survey(Total 21 questions)

To investigate the degree of risk of the attacked area
Diagnostic from an external perspective, the scores from the AttackTool Survey Surface diagnostic tool survey conducted by the U.S.
Attack surface
Survey of tools toSecurity Scorecard (SSC) are used.
13Cyber Index Corporate Survey 2023 Results
Two stars were awarded to the 14 companies that demonstrated particularly outstanding efforts
and information disclosure on an ongoing basis.
Cyberindex Corporate Assessment 2023 Results
Rating★★
★

Evaluation basis

Companies that havedemonstrated a particularly
outstanding commitment andinformation disclosure on anongoing basis
Companies with excellent
initiatives and information
disclosure

Number of companies

14

11 companies
last year44

35 companies
last year
14