Kyocera Product Security

Version 072021/July 5, 2021

©2021 KYOCERA Document Solutions Inc.

Table of Contents
Kyocera Commitment to Security of Products and Services ......................................................3
Security of Products and Services First .................................................................................3
Product Development Life-Cycle Security ..............................................................................3
Secure Operation...............................................................................................................4Security Threats Analysis and Measures ................................................................................4PSIRT ..............................................................................................................................4
Incident Handling Process ...................................................................................................5©2021 KYOCERA Document Solutions Inc.

Kyocera Commitment to Security of Products and Services
In recent years, cyberattacks have increased around the world. The various products connected tonetworks improve convenience while also exposing those products to the risks of the cyberattacks
such as malicious unauthorized access and information leaks. To ensure that customers can use
Kyocera products securely with ease, we commit to provide rigorous protection against these threatsand minimize the risks with our security measures described in this document.

Security of Products and Services FirstThe security of products and services is always our top priority. Kyocera implements appropriate
security measures in all phases of the product development life cycle. Especially given the “Securityby Design” principle that security should be engineered into products at the earliest stage. Kyocera
works hard not to create any vulnerabilities in the product from the outset. Also, after products arereleased to the markets, we continuously provide customers with secure products and services.

Product Development Life-Cycle Security
Kyocera takes strong security measures in product development lifecycle security, including planning,development, evaluation, production, and sales:•

In the planning phase, we continuously check for the newest security trends andvulnerability information. We learn from the vulnerability information to incorporate theminto our new models and solve any security issues at an early stage.

•

In the development phase, we actively utilize security design, secure programming, or static
analysis tools for development. We also strictly check throughout the development process
for potential vulnerabilities to ensure we do not embed any known issues.

•

In the evaluation phase, we conduct testing not only within Kyocera but also conduct anothersecurity evaluation using an objective, independent third-party organization before releasing
our products.

•In the production phase, we establish a secure environment and ensure secure production
by strictly following procedures that enable us to perform precise operations.

©2021 KYOCERA Document Solutions Inc.

Secure Operation
Even if sufficient security measures are taken at the time of product release, they may become
insufficient later because new vulnerabilities are discovered daily. We continuously work hard toidentify a security vulnerability, mitigate its impact, and take appropriate security measures againstthem after product release and operation.

Security Threats Analysis and Measures
Kyocera conducts threat analysis to proactively eliminate any vulnerabilities at the upstream stagesof development. More specifically, we consider what assets need to be protected, what potential
threats to the assets are, what the risks caused by the threats are, and what security measures
should be taken against the risks.

These are all incorporated in security requirements before

development.

PSIRT
When an incident occurs, an organization must take immediate action. Kyocera has established ateam called PSIRT (Product Security Incident Response Team) internally. PSIRT is composed ofrepresentatives from development, quality assurance, risk management, public relations, andKyocera Group sales companies to quickly respond to security issues (i.e., vulnerabilities andincidents). PSIRT is an organization focused on risk management related to security vulnerabilities
that potentially threaten the confidentiality, integrity, or availability of Kyocera’s products andservices.
PSIRT has roles such as early detection of critical vulnerabilities in our products, prompt response
to vulnerabilities in our products, and communication management with stakeholders.
When a vulnerability is found in practical, PSIRT takes appropriate action in accordance with thefollowing incident handling process.

©2021 KYOCERA Document Solutions Inc.

Incident Handling Process
Once a vulnerability is discovered, Kyocera focuses on responding promptly and appropriately,
including responding to customers based on security vulnerability information. PSIRT generally
proceeds in the following four steps: (1) gathering and sharing security vulnerability information,(2) investigating security issues and analyzing their impact on our products, (3) taking security
measures against vulnerabilities, and (4) announcing to the public.

(1)

Gathering and sharing security vulnerability information
We mainly check security information at an official open databases of vulnerability
information such as CVE, JPCERT, and US-CERT, and search and obtain security informationfrom the press such as newspapers and the Internet.

More information is also provided bycontacting the customer’s nearest sales company or by inter-office members.
CVE: Common Vulnerabilities and Exposures
JPCERT: Japan Computer Emergency Response TeamUS-CERT: United States Computer Emergency Readiness Team(2)

Investigating security issues and analyzing their impact on our products
At the development division, we investigate and analyze the phenomenon’s effects when avulnerability is exploited, the difficulty and conditions when a malicious attacker tries toexploit a vulnerability.

(3)

Taking security measures against vulnerabilities
From above, if the results indicate that there is an impact, the development divisioncontinues to prepare technical and operational measures such as applying security patches.

(4)

Announcing to the public
We make an announcement of our security measures via the Kyocera website, the PSIRT
contact window, sales companies, or a service person.

©2021 KYOCERA Document Solutions Inc.

______________________________________________________________________________The document is provided for information purpose only. The content of this document is subject tochange from time to time without notice. Customers are responsible for making their own
independent assessment of the information in this document and any use of Kyocera’s products orservices. The information in this document is provided “as-is” without warranty of any kind,
whether express or implied. Although care has been taken when compiling this information,
Kyocera makes no representations or warranties about the accuracy, completeness or adequacy of
the information provided herein, nor fitness for a particular purpose, and shall not be liable for any
errors or omissions. The only warranties for Kyocera’s products and services are as set forth in theexpress warranty statements accompanying them. Nothing herein shall be construed as
constituting an additional warranty.

1-2-28 Tamatsukuri, Chui-ku, Osaka 540-8585, Japan
Phone: +81-6-6764-3555

Kyocera Document Solutions does not warrant that any specifications mentioned will be error-free. Specifications are subject to change without notice. Information is correct at time ofgoing to press. All other brand and product names may be registered trademarks or trademarks of their respective holders and are hereby acknowledged.

©2021 KYOCERA Document Solutions Inc.